Oil & Gas UK Fire and Explosion Guidelines Issue 1 2007

OIL & GAS UK FIRE AND EXPLOSION GUIDANCE ISSUE 1

MAY 2007

Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither Oil & Gas UK, nor any of its members will assume liability for any use made thereof. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without prior written permission of the publishers. Crown copyright material is Her Majesty’s Stationery Office.

reproduced

with

the

permission

of

the

Controller

of

Copyright © 2007 The United Kingdom Offshore Oil and Gas Industry Association Limited trading as Oil & Gas UK

ISBN: 1 903003 36 2 PUBLISHED BY OIL & GAS UK London Office: 2nd Floor, 232-242 Vauxhall Bridge Road, London, SW1V 1AU. Tel: 020 7802 2400 Fax: 020 7802 2401 Aberdeen Office: 3rd Floor, The Exchange, 2 Market Street, Aberdeen, AB11 5PJ. Tel: 01224 577250 Email: [email protected] Website: www.oilandgasuk.co.uk

Issue 1

May 2007

FIRE AND EXPLOSION GUIDANCE

Foreword This guidance has been sponsored by Oil & Gas UK and the UK Health and Safety Executive, to provide a source of good practice on designing against fire and explosions on offshore installations. The guidance focuses on setting a philosophy for design and assessment in a realistic and simplified manner. It distils the latest thinking, based on research and practices, contributed by acknowledged and reputable experts and consolidates the research and development effort from over 300 projects carried out since 1988 to the present day. It is intended that the guidance will provide an accepted common base from which to support design decisions by designers and duty holders for both new installations and in making operational modifications to existing installations. Topics addressed by the Guidance include fire and explosion hazard types, fire and explosion management, the derivation of fire loadings, heat transfer and explosion loads and the response of equipment and systems to fires and explosions. Information is also included on legislation, standards and other initiatives, a summary of key issues related to man-machine interfaces and a review of available fire and explosion models. This Guidance establishes a new benchmark and will assist all sections of the industry in their evaluation of the risks from hydrocarbons arising from the components of the offshore infrastructure. The Guidance does not have the force of a Standard and contains information on good practice, which will always require clear justification in the context of specific hazards. Alternative methods to those presented may be used so long as they are justified by a risk assessment and provided their use leads to reducing risks to As Low As Reasonably Practicable (ALARP).

Issue 1

May 2007

Page 2 of 493


Acknowledgements It is appropriate to acknowledge the many contributors to this project. The Guidance was created in two major phases with different teams involved in each phase. Many thanks are due to our co-sponsors, the HSE for supporting this project since 2001. Many technical specialists in both HSE and UK oil and gas member companies have contributed to, provided information for and reviewed the Guidance as it has developed. For the project management, technical contributions and editorial responsibilities in general, thanks are due to fireandblast.com limited for their role in managing the project, collating and editing contributions from others and filling-in some of the technical gaps in the guidance. The first stage of the project covering the accumulated guidance on explosions was developed by a consortium headed by MSL Engineering Limited with other members being AkerKværner, Century Dynamics, Genesis Oil and Gas, Imperial College Consultants, Morgan Safety Solutions and WS Atkins inc. (Houston). The advisory panel to the consortium and the peer reviewers gave freely of their time and relevant background information to assist during this phase, many thanks are due to them for helping to hone the presentation of some of the more novel aspects of the guidance. The second stage of the project covered the accumulated guidance on fires and was prepared by acknowledged industry experts from MSL Engineering, Loughborough University, Health and Safety Laboratory, Steel Construction Institute, Risk Management Decisions, AkerKværner, Natabelle Technology, TBS Cubed, Shell Global Solutions and Mustang Associates. Thanks are also due to many individuals who contributed informally via the workshops and presentations undertaken during the development of this Guidance. Their contributions were invaluable. A full list of contributing individuals can be found in Annex H.

Issue 1

May 2007

Page 3 of 493


Contents 1

Introduction..........................................................................................................13 1.1 History ...........................................................................................................13 1.2 Objectives .....................................................................................................14 1.3 Fire and explosion events .............................................................................15 1.3.1 1.3.2 1.3.3

1.4

Identification.......................................................................................................... 15 Causes.................................................................................................................. 16 Consequence severity .......................................................................................... 17

Safety management systems (SMS) .............................................................18

1.4.1 1.4.2

1.5

Purpose of the SMS.............................................................................................. 18 SMS Content ........................................................................................................ 19

Hazard management systems.......................................................................26

1.5.1 1.5.2

2

General ................................................................................................................. 26 Policy .................................................................................................................... 27

Aims and principles of fire and explosion hazard management .....................30 2.1 Aims of fire and explosion hazard management ...........................................30 2.2 Reasonable practicability ..............................................................................31 2.3 Performance standards .................................................................................32 2.4 Safety critical elements .................................................................................34 2.5 Fire hazard management philosophy ............................................................34 2.5.1 2.5.2 2.5.3 2.5.4

2.6

Introduction ........................................................................................................... 34 Hazard philosophy ................................................................................................ 35 Prescriptive vs. performance based design.......................................................... 36 The application of fire hazard management ......................................................... 36

Understanding the fire and explosion hazard ................................................38

2.6.1 2.6.2 2.6.3 2.6.4 2.6.5

2.7

Understanding the fire hazard .............................................................................. 38 Understanding the explosion hazard .................................................................... 38 Identification and classification of fire and explosion hazards .............................. 40 Likelihood.............................................................................................................. 43 Fire hazards: understanding the source ............................................................... 44

Inherently safer design for fires and explosions ............................................51

2.7.1 2.7.2 2.7.3 2.7.4 2.7.5

2.8

Introduction ........................................................................................................... 51 Goals of inherently safer design ........................................................................... 52 Effective management of residual risk.................................................................. 56 Processes for achievement of inherently safer design goals................................ 58 Constraints and limitations of inherent safety ....................................................... 61

Risk screening...............................................................................................62

2.8.1 2.8.2 2.8.3 2.8.4 2.8.5 2.8.6

2.9 2.10

General ................................................................................................................. 62 Applying the risk matrix......................................................................................... 62 Risk screening acceptance criteria ....................................................................... 65 Low explosion risk installations............................................................................. 67 Medium explosion risk installations ...................................................................... 68 High explosion risk installations............................................................................ 68

Risk reduction ...............................................................................................71 The lifecycle approach to fire and explosion hazard management................73

2.10.1 2.10.2

Issue 1

Fire and explosion assessment during the installation lifecycle ....................... 74 Stages of the installation lifecycle..................................................................... 76

May 2007

Page 4 of 493

FIRE AND EXPLOSION GUIDANCE 3

Assessment of and protection from fires and explosions...............................81 3.1 Introduction ...................................................................................................81 3.1.1 3.1.2 3.1.3

3.2 3.2.1 3.2.2 3.2.3 3.2.4 3.2.5 3.2.6 3.2.7 3.2.8 3.2.9

3.3 3.3.1 3.3.2 3.3.3 3.3.4 3.3.5 3.3.6

3.4 3.4.1 3.4.2 3.4.3 3.4.4 3.4.5 3.4.6 3.4.7

3.5 3.5.1 3.5.2 3.5.3 3.5.4 3.5.5 3.5.6

Constraints on hazard identification...................................................................... 81 Selection of the representative design accident events........................................ 83 Consideration of escalation .................................................................................. 83

Fires on offshore installations........................................................................85 Fire types and scenarios....................................................................................... 85 Release events ..................................................................................................... 85 Ignition .................................................................................................................. 87 Fire scenarios ....................................................................................................... 87 Transition between fire scenarios ......................................................................... 88 Fire prevention methods ....................................................................................... 88 Gas and fire detection and control methods ......................................................... 92 Methods for mitigating the effects of fires ........................................................... 103 Active fire protection methods ............................................................................ 107

Appropriate performance standards ............................................................109 Application of performance standards ................................................................ 109 Functionality issues ............................................................................................ 109 Availability issues................................................................................................ 110 Reliability issues ................................................................................................. 111 Survivability......................................................................................................... 112 Written schemes of examination (WSEs) or verification..................................... 112

Methods and approaches to structural analysis ..........................................113 General ............................................................................................................... 113 Screening analysis.............................................................................................. 115 Strength level analysis........................................................................................ 115 Scenario or performance based strength level analysis ..................................... 117 Redundancy analysis.......................................................................................... 118 Ductility level analysis......................................................................................... 118 Assessment of fire barriers ................................................................................. 119

Explosion hazard management ...................................................................120 Common issues with fire hazard management................................................... 120 Detection, control and mitigation ........................................................................ 120 Control systems and safety critical equipment ................................................... 121 Equipment specific performance standards........................................................ 123 Levels of criticality of equipment items ............................................................... 123 Mitigation and consequence minimization .......................................................... 125

3.6 Particular considerations for floating structures, storage and offloading systems ..................................................................................................................135 3.6.1 3.6.2 3.6.3

3.7 3.7.1 3.7.2 3.7.3

3.8 3.8.1 3.8.2 3.8.3 3.8.4 3.8.5 3.8.6 Issue 1

Introduction ......................................................................................................... 135 Marine life cycle considerations.......................................................................... 135 Application of fire and explosion hazard management to floating structures...... 137

Particular considerations for mobile offshore units ......................................139 Introduction ......................................................................................................... 139 MODU classification ........................................................................................... 139 Conventions, codes and regulations................................................................... 140

Particular considerations for existing installations .......................................147 General ............................................................................................................... 147 Early operating phase......................................................................................... 150 Midlife operating phase....................................................................................... 151 Late operating phases ........................................................................................ 152 Aging installations and life extension.................................................................. 152 Particular considerations for accommodation and other areas for personnel..... 154 May 2007

Page 5 of 493


Interactions between fire and explosion hazard management......................156 4.1 General .......................................................................................................156 4.2 Fire and explosion prevention methods.......................................................156 4.2.1 4.2.2 4.2.3

4.3 4.3.1 4.3.2

4.4 4.4.1 4.4.2 4.4.3

4.5 4.5.1 4.5.2 4.5.3

4.6 4.6.1 4.6.2 4.6.3 4.6.4 4.6.5 4.6.6 4.6.7

4.7 4.8 5

Fire and explosion detection and control methods ......................................157 General ............................................................................................................... 157 Significance of area ventilation ........................................................................... 159

Fire and explosion mitigation methods ........................................................161 Active fire-fighting systems ................................................................................. 161 Fire-proofing systems ......................................................................................... 165 The temporary refuge ......................................................................................... 166

Combined fire and explosion analysis .........................................................166 Introduction ......................................................................................................... 166 Fire response of explosion damaged structures................................................. 166 Explosion response of structures at elevated temperatures............................... 168

Safety conflicts ............................................................................................169 General ............................................................................................................... 169 Conflicts arising from inherent safety measures................................................. 169 Conflicts arising from preventative safety measures .......................................... 169 Conflicts arising from detection safety measures ............................................... 170 Conflicts arising from control safety measures ................................................... 170 Conflicts arising from mitigation safety measures .............................................. 170 Conflicts arising from emergency response safety measures ............................ 171

Fire and explosion walls ..............................................................................171 Decks ..........................................................................................................172

Derivation of fire loadings and heat transfer ..................................................174 5.1 Introduction .................................................................................................174 5.2 Fire characteristics and combustion effects ................................................174 5.2.1 5.2.2 5.2.3 5.2.4 5.2.5

5.3 5.3.1 5.3.2 5.3.3

5.4 5.4.1 5.4.2 5.4.3

5.5 5.5.1

6

General ............................................................................................................... 156 Minimisation of leakage frequency ..................................................................... 156 Minimisation of ignition probability ...................................................................... 157

General ............................................................................................................... 174 Gas jet fire .......................................................................................................... 174 Pool fires on an installation................................................................................. 179 Gas fires from sub sea releases ......................................................................... 183 BLEVE ................................................................................................................ 183

Fire and smoke loading ...............................................................................184 Fire loading to the surroundings ......................................................................... 184 Thermal loading to engulfed objects................................................................... 186 Smoke loading .................................................................................................... 187

Estimating fire and smoke loadings.............................................................189 Inventories and release rates ............................................................................. 189 Typical values ..................................................................................................... 190 Predictive models for fire loading........................................................................ 197

Heat transfer ...............................................................................................198 Mechanisms for heat transfer ............................................................................. 198

Derivation of explosion loads...........................................................................217 6.1 Introduction to explosion load determination ...............................................217 6.1.1 6.1.2 6.1.3 6.1.4

Issue 1

General ............................................................................................................... 217 Dynamic pressures and overpressures .............................................................. 218 External explosions............................................................................................. 218 Far field effects ................................................................................................... 219 May 2007

Page 6 of 493

FIRE AND EXPLOSION GUIDANCE 6.2 6.3 6.4

Tasks for the determination of explosion loads ...........................................219 Determination of explosion frequency .........................................................220 Dispersion ...................................................................................................221

6.4.1 6.4.2 6.4.3 6.4.4

6.5

General ............................................................................................................... 221 Workbook approach for calculation of gas cloud size......................................... 222 Explosion Handbook approach........................................................................... 224 Equivalent Stoichiometric Clouds ....................................................................... 224

Ignition.........................................................................................................225

6.5.1 6.5.2

6.6

General ............................................................................................................... 225 Estimation of delayed ignition probability Prign .................................................... 226

Explosion overpressure determination ........................................................229

6.6.1 6.6.2 6.6.3 6.6.4 6.6.5 6.6.6 6.6.7 6.6.8

6.7

Explosion prediction methods and tools ............................................................. 229 Limitations of CFD codes.................................................................................... 230 Explosion code review/selection......................................................................... 230 Summary of main conclusions of HSL report [6.4] ............................................. 231 Practical use of CFD explosion prediction tools ................................................. 232 Validation/calibration of gas explosion prediction tools ...................................... 233 Example overpressure traces ............................................................................. 234 Extrapolation of the results of a worst case explosion simulation....................... 235

Development and application of nominal explosion loads ...........................237

6.7.1 6.7.2 6.7.3 6.7.4 6.7.5

6.8 6.9

Intended use of nominal explosion loads............................................................ 237 Factors influencing the overpressure values ...................................................... 237 Characteristics of a suitable data set.................................................................. 238 Bounding (minimum) overpressures and durations ............................................ 238 Other sources of bounding or generic overpressures......................................... 239

Impulse and duration related to peak overpressure ....................................240 Design explosion loads ...............................................................................242

6.9.1 6.9.2 6.9.3 6.9.4

6.10

Load cases for explosion response .................................................................... 242 Determination of explosion design loads ............................................................ 243 The COSAC risk assessment tool ...................................................................... 245 The PRESTO screening model .......................................................................... 245

Generating exceedance curves...................................................................245

6.10.1 6.10.2 6.10.3 6.10.4 6.10.5

6.11

Loads on piping and equipment ..................................................................251

6.11.1 6.11.2 6.11.3 6.11.4 6.11.5 6.11.6 6.11.7

6.12 6.13 7

General ........................................................................................................... 245 Exceedance curves for design explosion load case determination ................ 246 Generic exceedance curves ........................................................................... 249 Mobil North Sea methodology for early design blast analysis ........................ 250 Simplified methods for pressure exceedance curve generation ..................... 250 Load cases for piping and equipment response ............................................. 251 Dynamic pressure loads ................................................................................. 251 Loads on vessels ............................................................................................ 254 Loads on grating ............................................................................................. 255 Considerations in the use of CFD................................................................... 255 Estimation of vented gas velocities................................................................. 255 Strong shock and global reaction loads.......................................................... 256

Reporting template for ALARP demonstration ............................................256 The NORSOK procedure for probabilistic explosion simulation ..................257

Response to fires ..............................................................................................259 7.1 Properties of common materials in use offshore .........................................259 7.1.1 7.1.2

7.2 7.2.1 Issue 1

Overview............................................................................................................. 259 Mechanical and thermal...................................................................................... 259

Effects of fire and nature of failures.............................................................261 Standard hydrocarbon fire test ........................................................................... 261 Page 7 of 493 May 2007

FIRE AND EXPLOSION GUIDANCE 7.2.2 7.2.3 7.2.4

7.3 7.3.1 7.3.2

7.4 7.4.1 7.4.2

7.5 7.5.1 7.5.2 7.5.3 7.5.4 7.5.5

7.6 7.7 7.7.1 7.7.2 7.7.3 7.7.4 7.7.5 7.7.6

7.8 7.8.1 7.8.2 7.8.3 7.8.4 7.8.5

8

Jet fire test .......................................................................................................... 262 Types of failure ................................................................................................... 262 Escalation issues ................................................................................................ 269

Acceptance criteria......................................................................................270 General ............................................................................................................... 270 Criteria used in standard fire tests ...................................................................... 270

Methods of assessment ..............................................................................272 General ............................................................................................................... 272 Partial factors for fire........................................................................................... 272

Methods in structural design codes .............................................................273 Introduction ......................................................................................................... 273 Member analysis................................................................................................. 274 BS5950-8............................................................................................................ 274 EC3-1-2 .............................................................................................................. 275 Finite element modelling..................................................................................... 276

Attachments and coat-back.........................................................................279 Process responses......................................................................................279 General ............................................................................................................... 279 Relief................................................................................................................... 280 Relief sizing ........................................................................................................ 281 Blowdown ........................................................................................................... 281 Blowdown system design ................................................................................... 282 Failure criteria ..................................................................................................... 283

Personnel ....................................................................................................286 General ............................................................................................................... 286 Characteristics of fires relevant to human response........................................... 287 Harm criteria ....................................................................................................... 290 Human response to fire effects........................................................................... 291 Vulnerability/harm criteria ................................................................................... 297

Response to explosions ...................................................................................301 8.1 Overview of explosion response .................................................................301 8.2 Information required for explosion response calculations............................301 8.2.1 8.2.2 8.2.3

8.3 8.3.1 8.3.2 8.3.3

8.4 8.4.1 8.4.2 8.4.3 8.4.4

8.5 8.5.1 8.5.2 8.5.3

Information from the explosion load simulations................................................. 301 Other information from non-structural disciplines ............................................... 302 Overpressure load considerations ...................................................................... 302

Response considerations ............................................................................303 Elastic dynamic response ................................................................................... 303 Idealisation of overpressure time histories for response calculations................. 305 Equivalent static loads ........................................................................................ 306

Material properties for explosion response..................................................308 General ............................................................................................................... 308 Static material properties .................................................................................... 309 Strain rate effects................................................................................................ 311 Strain hardening ................................................................................................. 313

Structural performance standards ...............................................................313 Introduction ......................................................................................................... 313 Criticality categories for SCEs ............................................................................ 314 Deformation limits ............................................................................................... 316

1.1 ..........................................................................................................................316 8.5.4

8.6 8.6.1 8.6.2 Issue 1

Rupture ............................................................................................................... 316

Structural assessment.................................................................................317 Introduction ......................................................................................................... 317 Design criteria..................................................................................................... 317 May 2007

Page 8 of 493

FIRE AND EXPLOSION GUIDANCE 8.6.3 8.6.4 8.6.5 8.6.6 8.6.7

8.7

Strength level blast (SLB) ................................................................................... 318 Ductility level blast (DLB).................................................................................... 318 Dimensioning explosion...................................................................................... 318 The simple demonstration of ALARP.................................................................. 319 General remarks on structural response ............................................................ 319

Response prediction methods .....................................................................319

8.7.1 8.7.2 8.7.3 8.7.4 8.7.5 8.7.6 8.7.7

8.8

General ............................................................................................................... 319 Screening analysis.............................................................................................. 320 Strength level analysis........................................................................................ 321 Ductility level analysis......................................................................................... 322 Single degree of freedom idealisations............................................................... 323 Limitations of Biggs’ method............................................................................... 329 Pressure impulse diagrams ................................................................................ 330

Non-linear finite element analysis................................................................331

8.8.1 8.8.2 8.8.3 8.8.4

8.9

General ............................................................................................................... 331 Choice of NLFEA tools ....................................................................................... 331 Construction of the finite element model ............................................................ 332 Solution techniques in NLFEA ............................................................................ 333

Response of the primary structure ..............................................................333

8.9.1 8.9.2 8.9.3 8.9.4 8.9.5 8.9.6 8.9.7

8.10

Introduction ......................................................................................................... 333 Global loading scale effects................................................................................ 334 Global received loads ......................................................................................... 334 Plasticity and dynamic effects............................................................................. 334 Modified code checks ......................................................................................... 335 The use of NLFEA in global response ................................................................ 336 Global response considerations ......................................................................... 337

Response of equipment, pipework and vessels ..........................................338

8.10.1 8.10.2 8.10.3 8.10.4

8.11 9

General ........................................................................................................... 338 Response of equipment and vessels to explosion loading ............................. 339 Response of pipework to explosion loading ................................................... 340 Strong vibration............................................................................................... 341

Areas of uncertainty ....................................................................................342

Systems for fire and explosion management .................................................343 9.1 Common issues...........................................................................................343 9.2 Selection and specification..........................................................................343 9.2.1 9.2.2 9.2.3 9.2.4 9.2.5 9.2.6 9.2.7 9.2.8

9.3 9.3.1 9.3.2 9.3.3 9.3.4 9.3.5 9.3.6 9.3.7 9.3.8

9.4 Issue 1

Overview............................................................................................................. 343 The definition of a system................................................................................... 344 The role of a system ........................................................................................... 345 The suitability of a system .................................................................................. 345 The applicability of a system............................................................................... 345 Types and variations........................................................................................... 346 Interaction and limitations ................................................................................... 346 Functional parameters ........................................................................................ 347

Impact of fire and explosion type characteristics .........................................347 Requirement ....................................................................................................... 347 Response time and duration............................................................................... 347 Logic ................................................................................................................... 347 Sensitivity/preset values ..................................................................................... 348 Flow/application rates/concentration .................................................................. 348 Environmental conditions.................................................................................... 348 Failure criteria ..................................................................................................... 348 Survivability......................................................................................................... 348

Availability and reliability .............................................................................349 May 2007

Page 9 of 493

FIRE AND EXPLOSION GUIDANCE 9.4.1 9.4.2 9.4.3 9.4.4

9.5

Underlying principles .......................................................................................... 349 Design and build quality...................................................................................... 350 Maintenance, inspection and testing .................................................................. 350 Non-availability (downtime)................................................................................. 350

Actuation and initiation ................................................................................351

9.5.1 9.5.2 9.5.3 9.5.4 9.5.5

Manual vs. automatic.......................................................................................... 351 Duplication .......................................................................................................... 351 Diversity .............................................................................................................. 351 Over complexity/operability................................................................................. 352 False and spurious alarms.................................................................................. 352

10 Detailed design guidance for fire resistance...............................................353 10.1 Introduction .................................................................................................353 10.2 Minimising fire hazards throughout the design ............................................354 10.2.1 10.2.2 10.2.3 10.2.4 10.2.5 10.2.6 10.2.7 10.2.8

10.3

Introduction ..................................................................................................... 354 Project appraisal & concept selection ............................................................. 354 FEED stage .................................................................................................... 359 A methodology for an initial fire QRA.............................................................. 360 Detailed design ............................................................................................... 361 Construction/commissioning phases .............................................................. 368 Operational phase .......................................................................................... 368 Plant modifications.......................................................................................... 368

Best practice for fire protection systems......................................................369

10.3.1 10.3.2

Introduction ..................................................................................................... 369 Fire protection design ..................................................................................... 370

11 Detailed design guidance for explosion resistance ...................................383 11.1 General .......................................................................................................383 11.2 The design sequence ..................................................................................383 11.2.1 11.2.2 11.2.3 11.2.4 11.2.5 11.2.6 11.2.7 11.2.8 11.2.9 11.2.10 11.2.11 11.2.12 11.2.13 11.2.14

11.3

Best practice in explosion hazard design ....................................................391

11.3.1 11.3.2 11.3.3 11.3.4 11.3.5 11.3.6 11.3.7

11.4

Introduction ..................................................................................................... 391 Management of the explosion hazards........................................................... 392 Derivation of explosion loadings ..................................................................... 392 Response to explosions.................................................................................. 392 Specific considerations for blast walls ............................................................ 393 Integration with fire hazard management ....................................................... 395 Operations, inspection and maintenance issues ............................................ 395

Industry and regulatory authority initiatives .................................................396

11.4.1 11.4.2 Issue 1

Introduction ..................................................................................................... 383 Project appraisal and concept selection ......................................................... 383 Sub-sea layout................................................................................................ 385 Process engineering ....................................................................................... 385 Pipework ......................................................................................................... 386 Power requirements and electrical systems ................................................... 387 Instruments and controls ................................................................................ 387 ESDV, blowdown, pressure relief devices and isolation systems................... 387 Utilities requirements ...................................................................................... 388 Layout ............................................................................................................. 388 Structural arrangement – topsides.................................................................. 389 Structural arrangement – substructure ........................................................... 390 Explosion & fire hazards review...................................................................... 390 Brown field modifications: survey, hook-up and commissioning..................... 391

ATEX directives .............................................................................................. 396 Bolted pipe joints ............................................................................................ 396 May 2007

Page 10 of 493

FIRE AND EXPLOSION GUIDANCE 11.4.3

Small bore pipework, tubing and flexible hoses.............................................. 396

Annex A References..........................................................................................398 A1 - References – Chapter 1..................................................................................398 A2 - References – Chapter 2..................................................................................400 A3 - References – Chapter 3..................................................................................402 A4- References – Chapter 4...................................................................................405 A5- References – Chapter 5...................................................................................406 A6- References – Chapter 6...................................................................................409 A7- References – Chapter 7...................................................................................413 A8- References – Chapter 8...................................................................................415 A9- References – Chapter 9...................................................................................417 A10- References – Chapter 10...............................................................................418 A11- References – Chapter 11...............................................................................419 Annex B

Glossary of terms...............................................................................420

Annex C

Acronyms............................................................................................443

Annex D Human factors – man/machine interface .........................................450 D1 - Introduction.....................................................................................................450 D2 – Overview of assessment techniques .............................................................450 D2.1 - Commonly applied techniques include; .......................................................451 D2.2 - Task analyses..............................................................................................451 D2.3 - Human error analyses .................................................................................451 D3 - Awareness and competence ..........................................................................452 Annex E Legislation, standards, guidance and other initiatives...................453 E1 - Legislation in the UK.......................................................................................453 E1.1 - Legislation background ................................................................................453 E1.2 – Offshore legislation .....................................................................................453 E2 – Documents/guidance issued by the HSE.......................................................454 E2.1 - Assessment principles for offshore safety cases .........................................454 E2.2 – Fire and explosion strategy .........................................................................454 E2.3 – Other internal HSE guidance ......................................................................455 E3 - Codes, standards and guidance .....................................................................456 E3.1 - Introduction ..................................................................................................456 E3.2 - Recent developments ..................................................................................456 Annex F

Review of models ..................................................................................462

Annex G

Checklists ...........................................................................................472

Annex H

Acknowledgements ...........................................................................492

Issue 1

May 2007

Page 11 of 493


Issue 1

May 2007

Page 12 of 493


1 Introduction 1.1

History

Following the Piper Alpha disaster a large Joint Industry Project called ‘Blast and Fire Engineering for Topsides Structures (Phase 1)’ was carried out between May 1990 and July 1991. The main deliverable from this project was the Interim Guidance Notes (IGNs) [1.1] and 26 background technical reports written by the participants and published by the Steel Construction Institute (SCI) in November 1991. At about this time the Fire and Blast Information Group (FABIG) was set up and has subsequently issued a number of Technical notes on specific aspects of fire and explosion engineering [1.2, 1.3, 1.4, 1.5, 1.6, 1.7 and 1.8]. The Phase I JIP [1.9, 1.10 and 1.11] also included a review of open hydrocarbon pool fire models. Three types of model (current at the time) were evaluated, semi-empirical proprietary models, field models (e.g. CFD models) and integral models (falling between semi-empirical and field models). Compartment fire modelling looked at two types of code, zone models and field models. At that time, the zone models (typically used for modelling fires within buildings) encountered severe limitations in the modelling of large offshore compartment fires. Three further phases of the Blast and Fire Engineering Project JIP were conducted from 1994 to 2001, Phase 2 [1.12], Phase 3a and Phase 3b [1.13] consisting mostly of experiments to define and determine explosion overpressure load characteristics and to provide a basis against which load simulation software may be validated, however, some fire related experiments were also undertaken. The Phase 2 JIP also focussed on horizontal free jet fires of stabilised light crude oil and mixtures of stabilised light crude oil with natural gas and the main findings are listed below. •

The free flame releases, of crude oil only, were not able to sustain a stable flame and one of the mixed fuel releases was also unstable.

•

All the flames were particularly luminous compared with purely gaseous jet flames and generated large quantities of thick black smoke, mainly towards the tail of the flame.

•

All the flames were highly radiative, with maximum time averaged surface emissive powers (SEPs, heat radiated outwards per unit surface area of the flame) ranging between 200 kWm-2 to 400 kWm-2.

•

The incident total heat fluxes (radiative and convective) measured on the pipe target were significantly higher for the mixed fuel tests than for the crude oil only tests, by a factor of two in many cases. Typical values were in the range 50 kWm-2 to 400 kWm-2.

Phase 2 of the JIP included a fire model evaluation exercise. This considered three jet-fire scenarios, but no pool-fire scenarios. However it did generate high quality data that were considered suitable for future pool fire model evaluation. The main source of detailed information on the characteristics of jet fires covered in the reports on the programme of jet-fire research was co-funded by the European Community. This programme studied single fuel natural gas and propane jet fires (Bennett et al, 1990) [1.14]. A further project funded by the CEC, looked at the hazardous consequences of Jet Fire Interactions with Vessels (JIVE), this project covers the modelling of jet fires, large scale natural gas/butane jet fires and taking vessels to failure in jet fires and some results of jet flame impingement trials are reported in OTO 2000 051 [1.15]. Issue 1

May 2007

Page 13 of 493

FIRE AND EXPLOSION GUIDANCE Other valuable work on explosions, mostly executed in Norway and following the probabilistic approach, has resulted in the new NORSOK guidance documents [1.16 and 1.17] which are amongst the source documents for this Guidance. The results of these and other major investigations are summarised in the new Engineering Handbook published by CorrOcean [1.18]. During the same period, the HSE and others have funded approximately 300 individual projects and a number of Joint Industry Projects (JIPs) at a cost of £31 million, which have contributed significantly to the understanding of the key issues. The relative maturity of the subject has enabled a better defined approach to be adopted in this Guidance document relying more on ‘good practice’ which has been developed and implemented over the intervening years.

1.2 Objectives The primary objective of this document is to offer guidance on practices and methodologies which can lead to a reduction in risk to life, the environment and the integrity of offshore facilities exposed to fire and explosion hazards. Risk is defined as the likelihood of a specified undesired event occurring within a specified period or resulting from specified circumstances. Preventative measures are the most effective means of minimising the probability of an event and its associated risk. The concepts of Inherently Safer Design or ‘Inherent Safety’ are central to the approach described in this document both for modifications of existing structures and new designs. This document consolidates the R&D effort from 1988 to the present day, integrates fire type and scenario definition, fire loading and response development and provides a rational design approach to be used as a basis for design of new facilities and the assessment of existing installations. This Guidance is intended to assist designers and duty holders during the design of, and in making operational modifications to, offshore installations in order to optimise and prioritise expenditure where it has most safety benefit. An additional intent of this Guidance is to move the decision-making processes within the fire and explosion design field as much as possible towards a ‘Type A’ process from ‘Type B or C’ as defined in UKOOA’s document on decision-making, the key figure of which is illustrated in Figure 1.1 below [1.19].

Issue 1

May 2007

Page 14 of 493


Figure 1.1 - The UKOOA Risk Based Decision Making Framework The framework defines the weight given to various factors within the decision making process, ranging from decisions dominated by purely technical matters to those where company and societal values predominate. Design decisions required for a number of installations will lie in Areas A or B of the chart resulting in an approach which involves codes and Guidance based on experience and ‘best practice’ as described in this document and supplemented by risk based arguments where required. This Guidance will look to build past experience of the development of fire and explosion scenarios and the prediction of design load cases and their timelines as part of a developing “Type A” approach.

1.3

Fire and explosion events

In order to manage the fire and/or explosion hazard and apply risk judgements, it is necessary to identify the initiating events which may lead to a fire or explosion.

1.3.1

Identification

Projects must identify major safety and environmental hazards as early as possible in the project so that they can be understood, assessed and acted upon as necessary in a timely manner.

Issue 1

May 2007

Page 15 of 493

FIRE AND EXPLOSION GUIDANCE The means by which hazards are identified may be by formal processes such as: •

hazard identification studies (HAZIDs) and environmental hazard identification studies (ENVID)

•

hazard and operability reviews (HAZOPs)

•

layout review

•

hazardous area review

•

safety studies

Formal reviews should be attended by all relevant disciplines, including operational personnel, in order to obtain as broad an understanding as possible of potential hazards. Hazards may also be identified by the individual in the course of his work. A key element in the management of hazards is the establishment of an action tracking system. A log should be kept of all actions arising from hazard identification studies, reports and project concerns so that they can be formally held in a single data-base, tracked and eventually closed out, thus ensuring that none is forgotten or ignored. This is called the Safety & Environmental Action Monitoring System, or similar title, and is generally managed by the Safety Group within the project. Additionally, it may aid the management of hazards to compile a hazard register listing all significant hazards, their cause, and how each is handled.

1.3.2

Causes

Causes of a release may be dropped objects, ship impact, intervention, fatigue, vibration, extreme environmental conditions, imperfections, escalation from a fire, exceedance of design conditions and human error. These causes are often referred to as initiating events. Generic release scenarios based on historical evidence in the Gulf of Mexico [1.20] and the UK sector of the North Sea [1.21] are listed below starting with the most credible:1. Pump Seal or Gasket Leak: Often represented as a 5 mm orifice or the annular space between the flanges without a gasket or between the pump shaft and the case-less seal. 2. Small Fitting or Line: Often represented as a 20 mm orifice or the typically installed diameter for an instrument connection, or sample/drain line. 3. Medium Line or Partial Large Line: Often represented by a 50 mm orifice and evaluated as a possible credible release scenarios especially when considering dropped objects. 4. Large Transfer Line & Vessel Nozzle Failure: Full pipe diameter. Rarely considered as credible for design although frequently appears in loss databases. Evaluated usually for off-facility or facility separation distance determination and emergency response planning purposes. 5. Vessel Failure: Some suggestions by failure mode propagation or vessel de-inventory within 10 minutes. Rarely considered as credible for design although occasionally appears in loss databases usually as a result of inappropriate vessel materials selection (e.g. hydrogen embrittlement, chloride/caustic stress corrosion cracking), inadequate relief sizing, relief plugging, mechanical impact as well as incomplete inspection. Issue 1

May 2007

Page 16 of 493


Consequence severity

The direct and indirect effects of explosion overpressure should be identified. This should be achieved by assessing parameters such as; •

the vulnerability of Safety Critical Elements to dynamic pressure, overpressure, missiles, and strong shock response

•

occupancy of area immediately affected

•

vulnerability of people in adjacent areas

•

the relative location of the TR

•

levels of congestion and confinement

•

the suitability of the layout

•

the dimensions of potential explosive gas clouds

•

hazardous inventories, both isolatable and non-isolatable

•

the operating and control philosophy, influencing manning levels and occupation frequency the operating and control philosophy influencing extent of operator intervention and the potential for human error and inventory loss.

The following gives some guidance on the assessment of consequences: Low consequence outcomes would be predicted where the overpressure level is predicted to be relatively low and immediate and delayed consequences are also low. The equipment count would probably be low, being limited to wellheads and manifold with no vessels (i.e. no associated process pipework) resulting in low congestion and inventory. Confinement should also be low, with no more than 2 solid boundaries including solid decks. Manning would be consistent with a normally unattended installation with a low attendance frequency, less frequent than 6-weekly, a 6-weekly visit by a maintenance/intervention crew results in occupancy of a little over 1 %. A medium consequence installation would be typically a platform or compartment where the congestion and confinement exceeds that defined for the low consequence case but with still a low manning level consistent with a normally unattended installation. Congestion, typified by the amount of equipment installed, will be greater than for the low case. Manning would be consistent with a normally unattended installation with a moderate attendance frequency, more frequent than 6-weekly. Alternatively, a medium consequence installation may be a processing platform necessitating permanent manning but with low escalation potential to quarters, utilities and control areas which are located on a separate structure. A high consequence installation would encompass remaining installations and compartments where there is significant processing on board leading to significant congestion and potential confinement with populated areas within the consequence range of escalation scenarios. This may typically be characterised by a PDUQ/PUQ installation (jacket, semi-sub, F(P)SO or jack-up) with quarters on the same structure as the process.

Issue 1

May 2007

Page 17 of 493

FIRE AND EXPLOSION GUIDANCE Where there is doubt regarding the category into which an installation should fall, it is recommended that the category with next higher consequence is used.

1.4

Safety management systems (SMS)

Safety Management Systems will have common features for dealing with fire and explosion hazards, or any other accidental loads which can be envisaged. The system described in this section is generic in this respect.

1.4.1

Purpose of the SMS

A Safety Management System provides a framework whereby an organization can be assured that So Far As Is Reasonably Practicable (SFAIRP) its operations can be undertaken in a demonstrably safe manner. The SMS will demonstrate the means by which the organization’s safety policy is put into effect. The structure of the SMS should comply generally with accepted standards from the regulator and industry [1.22]. Effective safety management requires a structured approach to the identification of hazards, the assessment of those hazards and their elimination or minimisation, their control and mitigation. The means of achieving this are encapsulated in the Safety Management System (SMS) of the Duty Holder and designer and more specifically the HS&E Plan for the project. The safety management system SMS should specify the need for an HS&E Plan for all projects where significant risk to personnel or the environment is possible. The HS&E Plan(s) will define how health, safety and environmental issues will be handled throughout the life of the project. More than one plan may be in place, covering different parts or phases of the project. If this is the case an overall, bridging plan should be available to cover the interfaces between the individual plans. When hazards are identified with potential to give rise to risk to personnel or the environment, in the first instance the aim should be to eliminate or minimise the hazard and the risks associated with it. Thereafter the aims shall be (in order): •

remove personnel from the consequences of the explosion or escalating events;

•

inherently minimise the potential size/severity of the explosion event;

•

use detection and control systems to warn personnel and to minimise the explosion event;

•

install mitigation measures to reduce escalation and otherwise protect the workforce, environment and asset

If risks cannot be eliminated and where risk to individuals falls below that which is unacceptable but above the level of broad acceptability, then risks shall be reduced to As Low As Reasonably Practicable (ALARP). This Chapter provides the engineer with the means of managing the various factors which contribute towards;

Issue 1

•

the probability of explosion occurring;

•

the overpressure experienced once the explosion has occurred;

•

the control and mitigation of consequences of explosion. May 2007

Page 18 of 493

FIRE AND EXPLOSION GUIDANCE Further guidance on health and safety management can be found in the Basis Document covering management systems [1.23].

1.4.2

SMS Content

Each management system will have the same basic elements, these will include systems relating to:•

Policy and objectives

•

Organization resources and procedures

•

Risk identification and evaluation

•

Planning of work activities (including emergency response)

•

Implementation and monitoring (including means of measuring performance)

•

Audit to assess the operation of the SMS in practice

•

Review of the system – implementation of the audit process and review of the targets based on feedback from the monitoring system.

All of the above elements need to be underpinned by a commitment to safety from the organization’s management at the highest level, with effective leadership to ensure that the above elements are diligently carried out. The management needs to be aware of the safety policy and aims and provide the necessary resources to ensure that these aims are fulfilled.

Policy & Objectives

Organisation Resources Porcedures

Review

Leadership & Commitment Risk identification evaluation management

Implement Monitor

Planning

Audit

Figure 1.2 - Industry Standard SMS

Issue 1

May 2007

Page 19 of 493

FIRE AND EXPLOSION GUIDANCE 1.4.2.1

Policy & objectives

The organization must define and document its HSE policy and objectives. These should; •

be focused to the activities of the organization

•

be consistent with other sectors of the organization

•

be publicly stated and accessible

•

be consistent with or improve upon current legislation

•

have at least the same level of importance as other policies of the organization

•

commit the organization to improving safety performance

Senior management should provide strong, visible leadership and commitment to HSE issues and ensure that this commitment is translated into the provision of the necessary resources to ensure that all the elements of the SMS as described above can be carried out effectively. There should also be a driving force from management to achieve a continual improvement in HSE performance. Project management should maintain a high profile for HSE issues throughout the life of the project, with HSE issues featuring prominently at regular project progress meetings and at meetings to all levels within the management hierarchy. Effective leadership should also encourage involvement and participation in the HSE management process at all levels. This should seek to promote each member of the design team to look at the work he/she is doing and understand the effect it has, or may have, on the overall HSE performance of the project and the end product. This should further encourage each member of the design team to air any concerns they might have with regards to HSE performance.

1.4.2.2

Organization, resources & procedures

Project HSE Plans It is general practice within the Offshore industry (for all but minor projects) to have specific HSE Plans drafted at the earliest practicable stage, usually at the Front End Engineering Design (FEED) stage. This HSE plan defines how safety and environmental aspects of the project will be managed. Typical contents will include:

Issue 1

•

an introduction to, and outline of the project;

•

a declaration of project’s specific HSE policy statement and of the organization’s HSE policies;

•

a summary of the safety criteria and targets set for HSE design;

•

the project’s organization and reporting structure specific to HSE issues, from board level downwards;

•

details of the roles and responsibilities of those persons named in the safety organizational structure, including all levels within the project;

•

details of how the technical competency of the operational and design personnel is guaranteed;

•

details of the HSE activities on the project needed to ensure the appropriate level of safety and environmental integrity;

•

a schedule of HSE deliverables (i.e. documentation to be produced);

•

the control of quality regarding bought-in items, services and sub-contracts; May 2007

Page 20 of 493

FIRE AND EXPLOSION GUIDANCE •

relevant legislation and procedures available to undertake the above activities;

•

an audit plan.

The issues noted above are also important when dealing with bought-in items and services, the quality of work carried should match the standards expected from the company system. The high standard of design and product may be compromised by the input of others. Inputs from external organizations may include: •

CFD modelling of natural ventilation and gas dispersion

•

simulation of the explosion to give overpressures and exceedance curves;

•

the design and manufacture of pre-assembled units (PAUs), e.g. process skids;

•

construction activities;

•

the installation of the facility;

•

hook-up and commissioning.

Poor standards of workmanship, checking or other incorrect procedures are potential contributing factors in receiving a sub-standard product. All reasonable efforts therefore need to be made to confirm that the supplied goods and services are of an appropriate standard. To achieve this, as a minimum, prospective suppliers should be required to provide: •

a copy of their safety and environmental policies;

•

evidence that they have a functioning safety management system;

•

details of their safety and environmental performance, including accident history and details of any prosecutions or improvement notices served;

•

evidence that they have a quality management system complying with an acceptable modern standard.

If the supplier cannot give satisfactory information on these topics, they should be excluded from the supplier approval process or be subjected to an audit to identify shortcomings and preferably be coached to improve. The Plan should reinforce the premise that HSE is a line management responsibility, that each discipline and each individual is responsible for the safety and environmental impact aspects of his work. The role of the Safety Group to police the work of others beyond the usual interdisciplinary review of outputs cannot be relied upon. Where hazards or potential benefits are identified it is the individual’s responsibility to identify the scenario and ensure that it is resolved. The Plan should be approved by the appropriate representative of management and circulated to all disciplines for them to cascade to individual worker level. All personnel should be aware of the standards required with respect to safety and environmental issues and what their role is in achieving this.

Issue 1

May 2007

Page 21 of 493

FIRE AND EXPLOSION GUIDANCE Resources In order to carry out the work in a timely manner and with the necessary degree of competence sufficient resources must be made available. With respect to explosions the definition of the hazard must be identified at the correct time in the design process such that actions can be taken to accommodate it, So Far As Is Reasonably Practicable (SFAIRP). Resources in the context of competent personnel must be available during the following project stages: •

concept selection stage, to have safety and environmental input to ensure that the option chosen is the one with the lowest risk, as far as is reasonably practicable;

•

FEED stage, to ensure that layout issues are handled to minimize explosion hazard and risk;

•

detailed design stage, to ensure that control and mitigation systems are incorporated as necessary;

•

throughout the design period to quantify as necessary the explosion overpressures or fire loadings that may be encountered and the resultant risk.

Personnel undertaking the work should be suitably trained or experienced in the methods that need to be used. With respect to explosions, suitable training is particularly important as new research is continually developing fundamental information on the mechanism as well as innovative means of control and mitigation. Procedures It is one function of the SMS, to ensure that activities are carried out in a correct and consistent manner and at the correct stage. It is a requirement that procedures and design guides will be available for engineers to follow and consult at all stages of the project. They should state the methods by which the activity should be carried out, by whom the work should be done and any Performance Standards or criteria that should be met. Procedures for dealing with bought-in services should include the assessment process for prospective suppliers and the acceptance criteria required to qualify for the work. Procedures should be available at key locations (for instance in the design office and with the QA engineer) for consultation at any time. They should be regularly reviewed and updated as necessary to include new systems or as a result of the findings from audits undertaken.

1.4.2.3

Risk reduction options through the lifecycle

The exploitation of offshore hydrocarbon reserves may be considered to consist of the following phases:

Issue 1

•

Block bidding and license application

•

Exploration and drilling

•

Feasibility studies

•

Concept selection

•

Concept definition

•

Front end engineering design (FEED)

•

Detailed design May 2007

Page 22 of 493


Fabrication/construction

•

Installation/hook-up & commissioning/start-up

•

Operation

•

Modifications, maintenance and repair

•

Decommissioning and removal

The concept selection and definition phases are traditionally the time in which the most significant project decisions with respect to major accident hazards are taken. The majority of these decisions have a significant influence on the hazards which must ultimately be addressed by the engineering work and subsequently during the operational phase of the project. Figure 1.3 below shows that: •

Maximum safety leverage is available during the selection and definition phases.

•

The cost effectiveness of safety effort expended during the selection and definition phases is significantly better than during the later phases.

•

The impact on project schedule of safety effort expended during the selection definition phases is significantly less than during the later phases.

•

Unsuccessful safety performance during the selection and definition phases may result in failure to attain the maximum safety potential, or if it were to be attained it would be at the expense of significant cost and schedule penalties.

Attainable Safety Performance Maximum Attainable Safety Performance Level Execute

Successful Safety Input During Early Phases

Define

Select

Execute

Unsuccessful Safety Input During Early Phases

Define Select

Cost (CAPEX & OPEX)

Figure 1.3 - The cost of safety performance by design phase

Issue 1

May 2007

Page 23 of 493

FIRE AND EXPLOSION GUIDANCE By not robustly addressing the explosion hazard early in the phase of a project, the incremental costs of dealing with the hazard later in the project life increase significantly. In many cases a late design/construction change can be a magnitude greater in cost than had the feature been incorporated in the design basis of the project. This can result in a measure that becomes grossly disproportionate to the risk reduction achievable, whereas had the measure been introduced earlier in the project life this would not have been the case. The demonstration of ALARP is issue specific; it is recommended that the following general philosophy be applied for addressing fire and explosion hazards on offshore facilities: 1. Establish and apply nominal explosion overpressures if available and fire loads as appropriate to the potential fire types. 2. Utilize this Guidance to manage the fire and explosion hazards during the FEED and detailed engineering phases. 3. For high and medium risk installations, develop an explosion simulation model and continually update this model in line with design development. 4. For high and medium risk installations, develop a fire area assessment based on fire types and platform vulnerabilities and continually update this model in line with design development. 5. It should be noted that small bore pipework added late in the project may increase the severity of the explosion overpressure. This may not be apparent until late in the project. Table 1.1 below summarizes the factors affecting fire and explosion risks by project phase

Issue 1

May 2007

Page 24 of 493

FIRE AND EXPLOSION GUIDANCE Table 1.1 - Summary of life-cycle factors Project stage

Concept selection and definition

FEED

Detailed design

Construction

Operation

Decommissioning

Issue 1

Design factors affecting fire and explosion hazards and risks •

Offshore processing content (amount of equipment and potential leak and ignition sources)

•

Offshore structure type

•

Location of living quarters (may be carried over to FEED)

•

Equipment layout

•

Decks plated or grated

•

Operation and manning philosophy (exposure of personnel to fire and explosion risk)

•

Philosophy for engineering, piping, etc.

•

Deck sizing

•

Nominal explosion loading

•

Fire area sizing, firewall blast wall location

•

Determination of constructability

•

Element specific or low level performance standards set

•

Safety Critical Element (SCE) categorisation – identification of high criticality items

•

Design for overpressures, dynamic pressures

•

Finer points of layout

•

Firewater and vent piping, location and schedule

•

Supports for safety critical elements determined

•

Control systems designed

•

Verification of constructability

•

Assembly/writing of maintenance and inspection procedures

•

Small bore piping runs located

•

Changes to ensure constructability

•

Competence of construction

•

Assembly of Decommissioning procedures and assurance of integrity during decommissioning.

•

Maintenance

•

Inspection

•

Change control

•

Hot work procedures

•

Implementation of decommissioning procedures

•

Implementation of disposal procedures

May 2007

Page 25 of 493

FIRE AND EXPLOSION GUIDANCE 1.5

Hazard management systems

1.5.1

General

A structured approach to the management of fire and explosion hazards shall be put in place by all organisations responsible for the design or operation of offshore facilities. This structure shall ensure that the hazard management principles are implemented throughout the lifecycle. The proposed structure shall fit within the overall safety management system for that company and shall show the company safety policy is to be implemented. The management of fire and explosion hazards is a complex process and requires contributions from a very wide range of people, plant and processes. These may be required to prevent, detect control, protect or evacuate. It is not acceptable simply to manage each aspect in isolation to default standards and to presume that this will give an effective hazard management system. It is necessary to have a fully integrated process that ensures that all hazards have the necessary components in place and that these components all work together effectively. The approach may be based upon the generic frameworks outlined in HSG 65 [1.22], API RP 75 [1.24] or ISO 14001 [1.25]. These all use the standard 5 step hazard management process. All of these elements need to be underpinned by a commitment to safety from the organization’s management at the highest level, with effective leadership to ensure that the above elements are diligently carried out. The management needs to be aware of the safety policy and aims and provide the necessary resources to ensure that these aims are fulfilled. In summary, the following steps should be taken within the hazard management system; • Management responsibilities need to be accurately defined and clear boundaries for roles and responsibilities set out. • All fire hazards shall be identified, analysed and understood by everyone with a part to play in their management. • Every opportunity to minimise fire risks at source shall be identified, considered and where practicable, implemented. This shall cover minimising the likelihood, severity and the exposure of people and plant. • A practical strategy to manage each of the hazards shall be identified, documented and implemented. • An appropriate combination of prevention, detection, control and mitigation measures shall be put in place to implement the chosen strategies. • A strategy should take account of sensitivity of the installation’s overall risk profile to fire hazards and should weight the mitigation and control measures accordingly. • All of these measures, including people, processes and plant shall be documented, have clear ownership and shall have minimum performance standards • All causes shall be identified, understood and sufficient effective prevention measures shall be implemented. •

Where the effects of failure could require evacuation of overwhelm the installation, these measures shall be specifically identified and shall be of high integrity.

Issue 1

May 2007

Page 26 of 493

FIRE AND EXPLOSION GUIDANCE • The operating limits for the whole facility shall be identified and clear instructions as to the continued operation of the facility or use of additional controls whenever they are exceeded. • The systems provided to detect fires shall be suitable for the hazard types and the environmental conditions. • They shall provide sufficient information to warn personnel and to allow an assessment of the hazards to be undertaken without hazardous personnel exposure. • There shall be effective isolation of all major external sources of hydrocarbons including pipelines and the reservoir. This isolation shall be designed to survive all reasonably foreseeable fire hazards on the facility. • The characteristics of those hazards which may require evacuation shall be carefully studied so that the severity and potential for escalation may be reduced, thereby minimising the need to evacuate. • Personnel shall be located so that their exposure to fire hazards is minimised • The systems provided to protect personnel, plant, structures and safety system shall be suitable for the fire hazard effects. • Areas required to shelter personnel from fire effects and their supports shall remain viable until either the incidents have been brought under control or full controlled evacuation has taken place. • A minimum provision of routes, systems and arrangements to allow evacuation shall remain viable under the effects of every incident which may require them • All reasonably practical steps to reduce the risks from fires shall be taken, concentrating first on prevention and thereafter in descending order on control, the prevention of escalation and evacuation.

1.5.2

Policy

Each company should have a coordinated set of policies which cover the principles listed above and the means by which they are implemented and assured. Policies may be considered at four levels of increasing detail and specific application: Corporate policies: These should set the overall ethos of the company, its overall stance with respect to HSE and its public expression of commitment to the protection of its personnel and those with whom it interacts. It should set an overall standard of risk tolerability. This may be an expression of individual risk covering all types of exposure including occupational and major hazards risk. The organisation may also choose to set tolerable risk criteria for major hazards which may result in multiple fatalities. Most organisations should also demonstrate a commitment to continuous improvement. Corporate goals may also be set stating how the business should be organised and run in pursuance of their risk criteria. It may also set minimum standards relating to design and operations such as the requirements for the use of codes and standards. Regional and/or business policies: These should apply the overall corporate criteria to that business or region and set minimum standards. This will relate to the development of risk assessment processes and the criteria for acceptance in a wide range of activities from discipline engineering applications such as structural assessments and instrument criticalities to operations. The regional and/or business policies should set the framework for applicable management systems, and set the minimum technical and operational standards which apply across that region of business. Issue 1

May 2007

Page 27 of 493

FIRE AND EXPLOSION GUIDANCE Facility: specific policies and standards: These may be required for an individual facility. This would result from the assessment of the facility and would apply controls or set minimum technical requirements so that the risks are kept within the criteria. This may apply to operational or technical limits Other specific requirements: These would be the minimum standards for specific items of plant, competence, or any systems needed to manage hazards effectively.

1.5.2.1

Planning

Planning covers five specific items and these apply both in design and in operation; 1. The identification of the hazards and the analysis to give the understanding outlined in the hazard management principles; 2. The development of strategies to manage each of the hazards, identification of the people, plant and procedures needed to manage them and the setting or confirmation of the minimum standards for those elements; 3. The assessment of the risks from the hazards based on the chosen strategies and the performance of the elements chosen to reduce risks to ALARP; 4. The assessment of the business infrastructure and resources needed to implement the strategies both initially and thereafter to maintain them; 5. The documentation and communication of the hazard knowledge, the strategies and the measures needed to implement them; The planning process must be organised so that the understanding of hazards is in place before key decisions are made rather than using it to retrospectively justify them. In design, this requires the early development and resourcing of the risk assessment and management process through the use of an HSE plan. It also needs commitment from the project managers to ensure that this proactive culture flourishes and that everyone uses this information to optimise the design. This includes the discipline engineers, particularly process and layout who have the greatest opportunities to maximise the inherent safety. The specialist risk and safety engineers should act in support of these disciplines in furtherance of a safer design rather than as a discrete and independent group providing data for regulatory compliance. Operations should be represented both to provide their knowledge of the causes and risks and to agree the hazard strategies. Typically the HSE plan will include each of the following activities for each of the project stages: Concept development and selection: • Identification of the primary generic risk drivers; i.e. those that will apply whichever concept is chosen; • Identification of different viable concepts; • Hazard identification and qualitative risk ranking; • Comparison and selection of the concept.

Issue 1

May 2007

Page 28 of 493

FIRE AND EXPLOSION GUIDANCE Front end engineering design, (FEED): • Update and more thorough hazard identification; • Initial characterisation of the hazards; their cause, severity, consequence and potential for escalation; • Use of the hazard knowledge to optimise the inherent safety during the early process and layout design; • Selection of the strategy and associated primary systems to manage each hazard; • Selection of scenarios and detailed hazard characterisation (HAZOP, fire and explosion risk analysis, escalation analysis, vulnerability studies, evacuation and emergency response analysis); • Setting of the Performance Standards for each system; •

Risk assessment (This may be quantitative where required but is not essential).

Detail design: • Design of the systems to meet the Performance Standards; •

Preparation of the operational procedures.

1.5.2.2

Implementation

Putting the hazard decisions into practice and maintaining the minimum standards throughout the lifecycle requires the provision of a suitable and supportive business infrastructure. The infrastructure applications should include but not be limited to design engineering, integrity management, procurement, HSE, training, emergency response. The requirements arising from the planning process should be embedded into each business process. This should include the identification or cross referencing of elements critical to hazard causation and/or management and the correct documentation of the applied hazard management process. The operational procedures and controls developed at earlier stages of project development should be developed in conjunction with the designated operating team. The procedures should cover the prevention of accidents and management of incidents. The emergency response plans should acknowledge the potential hazards and their escalation.

1.5.2.3

Measurement

Measurement should include the verification that the hazard identification, analysis and management process has been thorough, is complete and of adequate quality. Thereafter, there should be confirmation that it is working, that there is a widespread understanding of risks and hazards, that the linkages between hazards and critical elements are in place and that the resourcing and infrastructure are sufficient. At a more detailed level, there should be confirmation that the design of the plant is appropriate and that the proposed standards of performance for people, processes and plant are being met.

1.5.2.4

Review and improvement

The review should examine trends from the measurement processes. It should be consider how the overall risks are changing including the specific performance history of plant, changes in personnel and their acquired competence. It should give structured proposals for investment in future risk reduction.

Issue 1

May 2007

Page 29 of 493


2 Aims and principles of fire and explosion hazard management 2.1

Aims of fire and explosion hazard management

Aims define what the philosophy requires of the end product. The top level goals define what is required from the overall process. These should confirm that:

•

•

all fire and explosion hazards have been identified, analysed and are understood;

•

overall risk from all major accidents including fires and explosion are assessed, and are "as low as reasonably practicable" (ALARP);

•

fire and explosion risks are defined as the risks from the initiating event and subsequent escalation;

•

an appropriate combination of prevention, detection, control and mitigation systems are implemented and maintained throughout the lifecycle of the installation;

•

the systems provided to protect personnel from the effects of fires and explosions are suitable for these hazardous events and have Performance Standards commensurate with the required risk reduction;

•

the design, operation and maintenance of the systems will be undertaken by competent staff who understand their responsibilities in the management of the hazards and possible hazardous events;

•

any changes to the installation which may effect the likelihood or consequences of fires and explosions are identified, assessed and the systems revised to take the changes into account as necessary.

These are achieved by;

Issue 1

•

the identification of all areas of the installation where there is potential for fire or explosion events to occur;

•

the elimination of the potential for fire or explosion events to occur, or if the previous step is not achievable,

•

the minimisation of the probability of occurrence of fire or explosion events,

•

the minimisation of the consequence of fire or explosion events

•

the implementation of a safety management system which ensures that the above goals are consistently achievable;

•

the implementation of operational management systems to minimise the potential for fire or explosion events to occur throughout the lifetime of the installation including decommissioning and removal.

•

the minimisation of exposure of personnel to fire or explosion events and to subsequent escalation events;

•

the minimisation of the environmental impact from fire or explosion events;

•

the minimisation of asset loss from fire or explosion events;

•

the determination of key fire or explosion hazard parameters;

•

suitable and sufficient assessments of the consequences and risks associated with the defined fire or explosion hazards; May 2007

Page 30 of 493

FIRE AND EXPLOSION GUIDANCE A further set of more specific goals ensure that personnel will reach a safe location in the event of a major accident event: •

that one escape route to the Temporary Refuge (TR) remains functional at all times;

•

the TR and its supports will maintain their integrity in all design explosion events;

•

that a means of evacuation to be available at all times;

•

that all large off-site inventories are isolated in the event of a design explosion event.

•

the ability of personnel to escape from, and to shelter safely from the effects of an explosion event and the ability to evacuate to a safe location where recovery can take place is not compromised.

Effective, economic FEHM depends on the appropriate timing and use of resources This can be achieved by following the principles for identification and assessment of the foreseeable hazardous events, see Section 3.1, and for selection and specification of safety systems see Section 9: This approach is structured around the life cycle concept described in Section 2.10. The following summarise the main principles: •

fire and explosion assessment should commence very early in the design and should be used as one of the bases of hazard management throughout the installation lifecycle;

•

everyone involved in the design, commissioning, operation, maintenance and modification of the installation should have sufficient knowledge of the hazards and their contribution to the overall risks;

•

the principles of inherent safety should be applied early in the design so as to eliminate or reduce hazards so far as is reasonably practicable;

•

safety systems should be selected based on the hierarchy of prevention, detection, control and mitigation;

•

resources should be assigned to systems taking account of the risks from the hazardous events and the role of the system in reducing them;

•

the hazard management process should be documented and communicated to operations personnel so that they have adequate information about both the hazards, hazardous events and safety systems provided to manage them;

•

the principles of industry adopted quality management systems should be followed.

2.2

Reasonable practicability

Operators/Owners of offshore installations must demonstrate that the risks to personnel from all major accidents have been reduced to a level which is ‘as low as reasonably practicable”. ALARP can be demonstrated by quantification or qualitatively by using experienced judgement. For all hazardous events including fires and explosions a more formal demonstration of quantified risk assessment is required.

Issue 1

May 2007

Page 31 of 493

FIRE AND EXPLOSION GUIDANCE In weighing the costs of risk reduction measures the principle of reasonable practicability applies so that there should be no gross disproportion between the cost of preventative or protective measures and the reduction of the risk that they would achieve to those already in place. In endeavouring to reduce risks to ALARP, resources should be concentrated on the primary risk contributors and on the areas or systems where the greatest risk reduction can be achieved for the expenditure. This must be a “top down process” starting with the hazard identification and consideration of areas for improvement and not a “bottom up’ process starting with the safety systems. It should be based on the need for improvements or enhancements and not on the ready availability of particular systems. Appropriate standards and accepted industry practice are tools to achieve and demonstrate reasonably practicable risk reduction. These should be appropriate to the hazards and hazardous events on the particular installation so that they contribute significantly to the reduction of risk. When concentrating on the primary risk contributors, care should be taken not to miss reasonably practical ways of reducing the risk from apparently less serious events. Unacceptable region 10 3 P

Risk cannot be justified except in extraordinary circumstances

The ALARP or tolerability region (risk is undertaken only if a benefit is desired)

Tolerable only if further risk reduction is impractical, or the cost is not proportionate to the benefit gained

Broadly acceptable region

Negligible risk

Risks closer to the unacceptable region merit a closer examination of potential risk reduction measures

Figure 2.1 - The ALARP triangle

2.3

Performance standards

For any goal it is usually possible to identify one or more measures whose performance will be a reasonable indicator of how successfully the goal is achieved. These can be described as Performance Standards and a general definition is shown below: A Performance Standard is a statement, which can be expressed in qualitative or quantitative terms, of the performance required of a system, item of equipment, person or procedure, and which is used as the basis for managing the hazard - e.g. planning, measuring, control or audit - through the lifecycle of the installation. Issue 1

May 2007

Page 32 of 493

FIRE AND EXPLOSION GUIDANCE When characterising “performance” in relation to the activities associated with an offshore installation, it is helpful to consider a hierarchy of Performance Standards, as a minimum, 2 levels should be adopted; •

High level Performance Standards can be applied to the organisation, the installation as a whole or to the major systems on the installation (e.g. the Temporary Refuge or the process system).

•

Lower level Performance Standards may be used to describe the required performance of individual systems or components (as necessary) which contribute to the high level Performance Standards.

An important principle to be adopted in setting Performance Standards is that the numbers developed and the level of detail they contain should be commensurate with the risk being managed. Thus, setting Performance Standards for systems, sub-systems or components of systems that contribute little to the management of risk should be avoided. Performance standards at this level may relate to the principal systems, used to detect, control and mitigate fires and explosions. However whatever performance standards are selected, three key characteristics should apply. 1. The selected items should make a significant contribution to the overall acceptability of the arrangements for managing fire and explosion hazards. 2. The parameters constituting the Performance Standard should be directly relevant to the overall achievement of the system goal 3. The Performance Standard should be capable of verification. The process of setting the more detailed low level Performance Standards therefore involves a review of the required performances under the anticipated emergency conditions of the systems, sub-systems or equipment that make up the fire and explosion arrangements. The review should identify those items that make the most significant contribution to the overall acceptability of the arrangements. It is necessary to identify those items where significant performance deviation would jeopardise the arrangements to the extent that the strategic objectives set for the installation would not be satisfied. It is also important when undertaking this review to determine what effective barriers to the occurrence of a particular hazard are provided. The number and integrity of these should take into account the magnitude of the hazardous event and the likelihood of the initiating event in the absence of these barriers. The assessment should indicate the most important factors contributing to the success of the system. For engineered systems, these can be expressed in terms of functionality, availability, reliability, survivability and the degree of interaction with other safety systems. The low level Performance Standards should relate to the overall ability of a system to fulfil its role, the probability of the system operating successfully when required and its ability to continue to function during a fire or following an explosion. One such hierarchy of Performance Standards that has been used in the industry is; 1. Risk-based Performance Standards (describing the high level goal in terms of a statement of risk); 2. Scenario-based Performance Standards (describing the generic fire and explosion scenarios that could occur on the installation); Issue 1

May 2007

Page 33 of 493

FIRE AND EXPLOSION GUIDANCE 3. System-based Performance Standards (describing the arrangements and performance described for equipment, sub-systems etc. as for the low level descriptions above). Performance Standards are particularly important and are a UK statutory requirement for defining the performance of elements that contribute to the management of a specific hazard.

2.4

Safety critical elements

The Safety Critical Element (SCE) is defined as any structure, plant, equipment, system (including computer software) or component part whose failure could cause or contribute substantially to a major accident, and thus includes any measure which is intended to prevent or limit the effect of a major accident. SCEs should have fulfilled their function or remain operational. For example, plastic deformation of the structure is acceptable provided collapse does not occur thus allowing other barriers to hazards to remain in-place and adequately resist any subsequent fires or other hazards. It may also be helpful to consider a hierarchical approach to the identification of SCEs. It is suggested that the number of SCEs (systems, equipment or functions) requiring detailed assessment are classified into three levels of criticality, these are illustrated with respect to the explosion hazard as below, using the Ductility Level Blast (DLB) and Strength Level Blast (SLB) defined later in this document. Criticality 1 Items whose failure would lead direct impairment of the TR or emergency escape and rescue (EER) systems including the associated supporting structure. Performance standard – These items must not fail during the DLB or SLB, ductile response of the support structure is allowed during the DLB. Criticality 2 Items whose failure could lead to major hydrocarbon release and escalation affecting more than one module or compartment. (Indirect impact on the TR is possible through subsequent fire). Performance standard – These items must have no functional significance in an explosion event and these items and their supports must respond elastically under the strength level blast (SLB) Criticality 3 Items whose failure in an explosion may result in module wide escalation, with potential for inventories outside the module contributing to a fire due to blowdown and or pipework damage. Performance standard – These items have no functional significance in an explosion event and must not become or generate projectiles.

2.5

Fire hazard management philosophy

2.5.1

Introduction

In general terms a release of hydrocarbon with immediate ignition will result in a fire; release of an inflammable vapour or gaseous mixture followed by later ignition (i.e. when the cloud of vapour or gas is adequately large) may result in an explosion. Consequently some of the probabilities, causes, methods of prevention and control of releases are identical for both the fire and explosion hazard. Indeed, many of the hazard management principles and practices apply to both hazards. This aspect is explored more in Section 4.2.

Issue 1

May 2007

Page 34 of 493

FIRE AND EXPLOSION GUIDANCE In this section the goals which should be achieved in designing for and managing fire hazard are identified, the legislative basis is reviewed and some high level Performance Standards are given. The features of an effective Safety Management System (SMS) are identified and the choice and management of detection, control and mitigation systems is discussed. The main characteristics of the fire hazard are also identified. The techniques of inherently safer design described in Section 2.7 are fundamental to the most effective approach to eliminate, prevent and mitigate the fire hazard particularly for new designs.

2.5.2

Hazard philosophy

The advantage of an inherently safer design or the ‘Inherent Safety’ design approach is that it attempts to remove the potential for hazards to arise. It does not rely on control measures, systems or human intervention to protect personnel. In order to focus effort where it is most needed, a risk screening method is described in Section 2.8 which classifies installations and compartments according to the level of their fire risk. The measures for frequency and consequence severity are based on process complexity and the exposure potential for people on board. These measures are combined in a risk matrix to give low, medium and high risk categories. The risk level is an indication of the level of sophistication to be used in the fire assessment process. Nominal loads for jet and pool fires have been available since the publication of the Interim Guidance Notes (IGN) [2.1] in the form of heat fluxes for engulfed objects in open conditions. A number of alternative values have since been published including nominal fire loads for confined and ventilation controlled fires [2.2]. Updated guidance on the selection of fire loads is given in Section 5.4 with recommendations on the limits of applicability. The overriding requirements for hazard management philosophy are to: •

protect personnel in the TR;

•

minimise injuries and fatalities from the initial event;

•

provide escape to TR and other means of escape/evacuation.

The philosophy should ensure that: •

the hazard scenarios are addressed;

•

suitable accidental loads are developed (either risk based and/or prescriptive);

•

plant and equipment minimises escalation, personnel within the TR do not continue to be threatened by the incident, until such time as the hazard has dissipated to a safe level via shutdown, blow down, or other means;

•

personnel are able to escape to a safe location away from the hazard.

The identification of key SCEs and corresponding Performance Standards provide the demonstration that such a philosophy has been met.

Issue 1

May 2007

Page 35 of 493


Prescriptive vs. performance based design

Prescriptive design against the fire hazard can be a valid alternative, for example for low risk installations. This method is based on standardized guidance or requirements, without recognition of site-specific factors. The size of the facility, hazards posed or specific water demand is not considered. Prescriptive approaches to fire design generally are a result of compliance with regulations, insurance requirements, industry practices, or company procedures. These are generalized approaches largely based on past incidents. Performance or scenario based design adopts an objective based approach to provide a desired level of fire and explosion performance. The performance based approach presents a more specific prediction of potential fire hazards for a given system or process. This approach provides solutions based on performance measured against established goals or performance standards rather than on prescriptive requirements with implied goals. Solutions are supported by a Fire Hazard Analysis (FHA) or, in some cases, a fire risk assessment.

2.5.4

The application of fire hazard management

A fire risk assessment takes account of the consequences and the likelihood or frequency of the fire and explosion scenarios occurring. A performance based approach looks at determining the need for fire and explosion design on a holistic basis. Performance objectives and measures allow the designer of fire systems more flexibility in meeting requirements and can result in significant cost-savings compared with the prescriptive approach. Conversely, for small projects, the cost of performance based design may not be cost-effective. In a scenario or performance based approach release scenarios are postulated and their consequences and probabilities of occurrence determined. For existing installations, reliable estimates of fire loads, extents and durations may be available from previous assessments. The most severe fires from the point of view of initial rate of release may be less frequent and less durable than fires of lesser severity and hence may present a smaller risk. Although the initial extent of the engulfed region may be greater, the lower duration may result in lower quantities of heat being delivered to those equipment items and structural members within the affected region. However, it is important to account for apparently small fires that on initial evaluation do not appear to have the potential for escalation. Dismissing such ‘small events’ can distort the Installation’s risk profile. The scenarios considered, should be sufficiently varied to cover the following: •

severe, but unlikely cases which give short duration fires with the potential for the maximum number of immediate fatalities

•

small long duration scenarios which still have sufficient size to cause local escalation.

•

intermediate scenarios which have the greatest potential for escalation or platform impact whilst lasting long enough to realise this potential.

Design or Dimensioning fire scenarios are selected on the basis of the risk they present and should be accommodated by the safety critical elements (SCEs) of the installation which will include parts of the structure, piping and equipment. It will be necessary to consider the effect of non-availability of mitigation measures such as shut-down, blow-down, venting, deluge or barriers in the construction of design scenarios. Issue 1

May 2007

Page 36 of 493

FIRE AND EXPLOSION GUIDANCE Some scenarios may also assume a prior explosion has occurred with fire being an escalation event. The identification of the common-cause failure modes that may defeat several mitigation measures needs to be carried out in a rigorous manner. Multiple or coincidental failures can lead to events moving from Minor or Controllable to Extreme, for example, fires that disrupt the UPS or auxiliary power supplies or common Installation air supplies. It is suggested in this Guidance, that the number of SCEs which need to be considered in detail is reduced by classification into criticality categories with respect to the fire hazard. The direct consequences of fires are immediate fatalities or delayed fatalities by the blockage of access ways by radiation or the development of a hot gas layer, smoke and fume generation, structural weakening and possible collapse. Further escalation through subsequent release of inventory may occur. The consequence measures of relevance to fires are: •

intensity, that is heat flux and temperature;

•

extent, that is the area or volume occupied by flame, affected by radiation or by combustion products;

•

duration;

•

frequency, that is the probability of occurrence depending on the probability of immediate or delayed ignition;

•

mitigation effectiveness will depend on detection, inventory isolation and deluge activation together with the probabilities that these measures will be initiated;

•

radiation thresholds for personnel safety and escape, the integrity of equipment and supporting structure.

Reducing risks to ALARP must be demonstrated in all cases, both through the justification of the choice of design scenarios and from a determination of the impairment frequency of the SCEs under the fire loads. An acceptable level of risk can be identified within the ALARP framework, which identifies the acceptable frequency of exceedance of the severity of the design or dimensioning scenarios. Typically this frequency of exceedance will be of the order of 10-4 to 10-5 per year depending on the risk to people on board, the impact on the SCEs and the overall individual risk including that from other hazards. Following NORSOK [2.3], ISO [2.4] uses a threshold probability of exceedance level (10-4 per year) below which individual contributing scenarios need not be considered further if the impact on personnel is low enough (i.e. numbers of personnel affected). Events with probabilities above this level are considered to be ‘Dimensioning’, and require further analysis to determine the size and extent of the resulting loading and subsequent effects. This Guidance proposes a similar approach, albeit couched in different terms. An event will be considered depending on whether the event impinges directly on the Temporary Refuge with probability of exceedance > 10-5 per year. Events directly affecting other regions where a barrier may be present to prevent impingement on the TR are considered if the probability of exceedance is greater than 10-4 per year.

Issue 1

May 2007

Page 37 of 493


Understanding the fire and explosion hazard

2.6.1

Understanding the fire hazard

Understanding the risks from fire hazards is the key to their minimisation. This applies at all levels of an organisation from the directors to those designing and operating the facilities. This knowledge should be used to inform people making critical decisions both in design and operation. It should not be acquired after these decisions have been made in order to retrospectively justify them. In other words, the knowledge should be used proactively to reduce risk. The type of understanding differs according to the level of people in the organisation and the responsibilities that they hold, some examples are listed below. Senior Management: They need to know the overall level of risk for the facilities to decide if the design is viable or if existing operations may continue. Project or Facilities Management: They need to know the pattern of risk by facility and the proportion of that risk which comes from different hazards such as fire. This will allow them to decide how the facilities are to be designed and operated. It will also allow them to provide sufficient resources. Discipline Engineering and the Supervision of Operations: They need an overall understanding of all the hazards for which they have responsibility. The understanding of the causes, severity and consequences will allow them to decide how each of the hazards will be managed and the measures needed to do so. Designers, Operators and Technicians: They need to understand the hazard characteristics so that they may design, operate and maintain critical elements to suit the needs of the hazards. It is essential that the information gained from hazard and risk studies is distilled, documented and communicated so that every level and person is kept informed. It must also be kept up to date. It is a living picture which becomes progressively more detailed and accurate as the design progresses. It also changes throughout the life of the facilities as different activities take place and the fields mature.

2.6.2

Understanding the explosion hazard

Gas explosions can be defined as the combustion of a premixed gas cloud containing fuel and an oxidiser that can result in a rapid rise in pressure. Gas explosions can occur in enclosed volumes such as industrial process equipment or pipes and in more open areas such as ventilated offshore modules or onshore process areas. For an explosion to occur a gas cloud with a concentration between the upper flammability limit (UFL) and lower flammability limit (LFL) must be ignited and amongst other contributing parameters, the overpressure caused by the explosion will depend upon: 1. The gas or gas mixture present 2. The cloud volume and concentration 3. Ignition source type and location 4. The confinement or venting surrounding the gas cloud 5. The congestion or obstacles within the cloud (size, shape, number, location) Issue 1

May 2007

Page 38 of 493

FIRE AND EXPLOSION GUIDANCE 6. Cloud density non-homogeneity 7. Ignition timing Confinement is defined as a measure the proportion of the boundary of the explosion region which prevents the fuel/air mixture from venting which is the escape of gas through openings (vents) in the confining enclosure. Congestion is a measure of the restriction of flow within the explosion region caused by the obstacles within the region. Gas explosions in more open environments can also lead to significant overpressures depending on the rate of combustion and the mode of flame propagation in the cloud. All of the above points from 1 to 5 can affect the explosion overpressures in this type of environment. Two types of explosion can be identified depending on the flame propagation rate: A deflagration is propagated by the conduction and diffusion of heat. It develops by feedback with the expansion flow. The disturbance is subsonic relative to the un-burnt gas immediately ahead of the wave. Typical flame speeds range from 1-1000m/s and overpressures may reach values of several bars. The overpressures are not limited to the 8 bar maximum typical of completely confined explosions. A detonation is propagated by a shock that compresses the flammable mixture to a state where it is beyond its auto-ignition temperature. The combustion wave travels at supersonic velocity relative to the un-burnt gas immediately ahead of the flame. The shock wave and combustion wave are coupled and in a gas-air cloud the detonation wave will typically propagate at 1500-2000 ms-1 and result in overpressures of 15-20 bar. Most vapour cloud explosions offshore would fall into the category of deflagrations. A typical vapour cloud explosion on an offshore installation would start as a slow laminar flame ignited by a weak ignition source such as a spark. As the gas mixture burns, hot combustion products are created that expand to approximately the surrounding pressure. As the surrounding mixture flows past the obstacles within the gas cloud turbulence is created. This turbulence increases the flame surface area and the combustion rate. This further increases the velocity and turbulence in the flow field ahead of the flame leading to a strong positive feedback mechanism for flame acceleration and high explosion overpressures. Large components of the structure such as solid decks or walls experience loads due to the pressure differences on opposite sides of the structure. Typically within an explosion there will be a strong variation of pressure in space and time. There will typically be localised high regions of overpressure with lower values of average pressure acting on large components. The overpressure at a location within a gas explosion will typically rise to a peak value and then fall to a sub atmospheric value before returning to zero overpressure. The duration of the positive phase in an explosion can vary greatly with shorter durations often associated with higher overpressure explosions. Typical durations range from 50 to 200 milliseconds with longer durations common in large open areas such as the decks of Floating Production, Storage and Offloading vessels. For smaller objects, such as piping, the overpressures applied to the front and reverse side of such items will be of approximately the same magnitude at any moment in time and in this case the overpressure difference will not be the only load component on the object. For this type of object the dynamic pressure associated with the gas flow in the explosion will dominate. Issue 1

May 2007

Page 39 of 493

FIRE AND EXPLOSION GUIDANCE Small objects may be picked up during the explosion, creating secondary projectiles. The peak energy for typical projectiles may be calculated from the dynamic pressure load time history and their mass. Secondary, external explosions may result as the unburnt fuel/air mixture comes into contact with the external (oxygen rich) atmosphere. These can affect the venting of the compartment and enhance the overpressure within. A blast wave will be generated which will propagate away from the explosion region and may impinge on adjacent structures.

2.6.3

Identification and classification of fire and explosion hazards

It may be helpful to classify fire hazards according to their potential for harm. This may be done by assessing what is in place either in a design or an existing facility and determining the classification. It is preferable to actively manage the fire hazards such that steps are taken to actively lower their classification by reducing the severity of the effects. This may be done by following the principles for inherently safer design (see Section 2.7) or by applying or optimising hazard management measures to minimise the size of releases, their location, effects on the facility, the rate of release and the duration. One method of classification follows. Catastrophic: As the name suggests, these events would overwhelm an installation and it would be impractical to counteract the effects such that the lives of those on board could be saved. This type of event should be designed out or very high integrity preventative measures provided such that the likelihood is minimised. Evacuation/Extreme: This type of event would have a major impact upon a large part of the installation such that the effects upon people, both physical and psychological, would be such that evacuation would be necessary. It would also apply to those events where the potential for escalation is widespread including structural, process, safety systems or the impairment of muster and escape routes. Typically these events are those which would give prolonged effects beyond the source module, in particular external flaming and dense smoke effects. In some cases it may be possible to suppress the widespread effects of these fires reducing the categorisation to the lower, controllable, level. If not, the effects must be fully understood and premature catastrophic escalation delayed, and personnel protected from smoke and heat until evacuation has been completed. By their nature these are inherently low frequency events, requiring a significant sized release from a major inventory and/or its combination with safety system failures such as ESD. Controllable: These events have the potential for local fatalities and may also be capable of escalation to a scale requiring evacuation. However, the moderate scale of the effects should allow these events to be controlled such that further escalation is prevented and evacuation is not essential to preserve life. Typically, the prolonged effects of these events will be limited to one module or process area and will be of finite duration. They would be associated with smaller releases from moderate inventories. In these cases effective control of the source inventory and the prevention of escalation will be critical. It may be practical to extinguish some of these events but in other cases, this may not be possible or may be dangerous in which case, they should burn out under controlled conditions. Minor: These events are of a very small scale. They may cause local injuries but would not have either the scale or duration to cause critical escalation. They may lead to damage to plant causing financial loss but not major loss of life. These events can be managed by limiting the size of the event and allowing it to burn out. Protection would only be needed for asset protection. Issue 1

May 2007

Page 40 of 493


Causes and likelihood of hydrocarbon releases

The causes of hydrocarbon releases are numerous and it is essential that a full causation is carried out so that effective preventative measures can be put in place. These causes can generally be broken down into three categories: 1. human or procedural error; 2. plant or equipment failure; 3. systemic failure; i.e. inherent weaknesses in the business processes and infrastructure supporting design and operation. Lack of maintenance, particularly over long periods may distort the understanding of the underlying causes of failures. Effective maintenance regimes are essential to determining the likelihood of plant failures. The likelihood of an event is a function of the propensity of the causes; e.g. the corrosivity of the fluids, the number of times containment is deliberately breached or the number of weak points such as flanges or tappings. It is also a function of the understanding of those causes and the effectiveness of measures which are put in place to manage them. Statistical data form a good start point from which to list causes and to determine likelihood. This should then be augmented with the knowledge of engineers, technicians and operators to give a more accurate picture for each facility. HAZOP procedures will give a rigorous identification of process causes but the overall examination should be sufficiently broad to address external and human effects. This examination should be fully documented so that there can be assurances that preventative measures are suitable and sufficient. For statistical data, the most frequent sources of the hazard as given by the history of releases experienced to date are documented as follows. The HSE document OTO 2001 055 [2.5] states that for the UK sector of the North Sea: 61 % of all releases are from pipework systems 11 % of all releases are from small bore piping 15 % of all releases are from flanges 14 % of all releases are from seals and packing Of the causes; 11 % are due to incorrect installation 26 % from degradation of materials (excluding corrosion and erosion) 11 % of all releases are due to vibration/fatigue 19 % of all releases are due to corrosion and erosion It is considered that 40 % of equipment related releases are attributable to poor design and 38 % to inadequate inspection and condition monitoring.

Issue 1

May 2007

Page 41 of 493

FIRE AND EXPLOSION GUIDANCE Avoidance of potential leak sources in design therefore needs to consider these above issues in particular. The importance of operational aspects is also shown in proportion of leaks attributable to poor inspection and monitoring. Sources of release data include WOAD [2.6], OREDA [2.7] release statistics published annually by the HSE and UKOOA [2.8, 2.9, 2.10 and 2.11]. The Minerals Management Service (MMS) of the US also publishes data on incidents on the Gulf of Mexico.

2.6.3.2

Ignition causes and probability

The probability of ignition will depend upon the following factors. •

The rate and duration of the release and the size of the consequent gas cloud

•

The location of the release

•

The type of fuel and the proportion of gas or volatile vapours which is generated in the short term

•

The nature of the release; whether high or lower pressure. The turbulence caused by high pressure gas releases will cause effective mixing with the air to give a well defined flammable cloud. High pressure liquid releases will encourage fine droplet formation and increase the vaporisation of any light ends.

•

The flammability characteristics of the gases and vapours. Each different gas or vapour has a specific flammability range, from a lower flammability limit; through stoichiometric and rising to a higher limit above which ignition should not occur. Very large releases may have a non flammable rich core but will be surrounded by a flammable region which may engulf ignition sources as it spreads away from the point of release. Each gas or vapour will also have a specific auto ignition temperature ranging from 200 - 550 °C. such that contact with hot surfaces such as an exhaust turbocharger would cause ignition

•

The dispersion characteristics; whether there are heavy vapours which will descend or lighter gases which should rise.

•

The confinement of the escaping vapours and gases by floors, ceilings or walls. These may also cause flammable gases to be directed towards areas without flameproof equipment

•

The ventilation characteristics in the areas, whether forced or natural and the variation of those characteristics with wind strength and direction

•

The characteristics of the fluid and its release, where this might build up static

•

The presence of sulphurous impurities in the fluids which might lead to the formation of pyrophoric scale

•

The number of fixed ignition sources and the standard of their maintenance, if designed for use in flammable atmospheres, including the presence or not of Ex equipment.

•

The proximity of the release to areas which are classified as “safe” and therefore are not fitted with flameproof equipment.

Issue 1

May 2007

Page 42 of 493


The gas detection philosophy and the local and wider shutdown of ignition sources upon detection

•

The detection of gas ingress at the air intakes to enclosures such as accommodation or equipment rooms and the closure of dampers.

•

The hot work philosophy on the facility, the number of these activities and the effectiveness of their control.

•

The possibility of ignition being caused by the action of personnel carrying out emergency response actions such as plant shutdown causing sparks at electrical breakers.

Ignition probabilities have been widely studied and this work is summarised in recent work for UKOOA studying ignition probabilities [2.12]. The probability of ignition should be determined using that guidance together with an assessment of the characteristics listed above. As with the likelihood of release, it is possible to influence the probability of ignition by design, good maintenance and operational controls.

2.6.4

Likelihood

The likelihood of an explosion will depend upon the likelihood of occurrence of a gas cloud and delayed ignition. The following parameters will influence the potential likelihood of an explosion: •

hazardous inventory complexity, i.e. the number of flanges, valves, compressors and other potential gas leak sources;

•

the type of flanges, valves or pipework, some generic types of flange tend to have lower leak frequencies associated with them, e.g. hub type flanges;

•

the number of ignition sources within the potential gas cloud;

•

the ventilation regime;

•

the equipment reliability and the maintenance philosophy.

The likelihood considerations tend to align closely with the consequence factors in that the low consequence installations will tend to be small and therefore less complex. Large installations will have more potential leak and ignition sources and therefore a greater requirement for intervention and maintenance. Low event likelihood installations and compartments will have a low equipment count. The frequency intervention of 6 weeks or more is also recommended as a criterion as this will be a surrogate for equipment count and reliability as well as a measure of maintenance risk with respect to explosion. Medium event likelihood is suggested by an NUI with equipment count greater than for the ‘low’ case. Similarly, where the planned frequency of maintenance/intervention is greater than a 6-weekly basis then this suggests a higher or less reliable class of equipment with medium level of potential for explosion. Where the complexity of the process in a compartment requires a permanently manned installation this suggests a high equipment level and therefore potentially a high likelihood of an explosion event, a large number of potential leak sources and high ignition potential. Issue 1

May 2007

Page 43 of 493

FIRE AND EXPLOSION GUIDANCE Where there is doubt regarding the category into which an installation should fall, it is recommended the category with next higher likelihood is used.

2.6.5

Fire hazards: understanding the source

2.6.5.1 General It is essential that the source of the hydrocarbons is examined and fully understood in order to examine the fire hazard effects resulting from a release. Key parameters would include the range of release rates and characteristics which can originate from any part of the plant. Each parameter would be associated with a failure causing a specific hole size. The release rate would then vary with time depending upon the source conditions of fluid, pressure, inventory, location within the hydrocarbon system and the functional characteristics (or the failure) of control systems such as ESD, depressurisation, and drainage. A detailed picture of the source terms from each inventory will allow the identification of the cases requiring analysis of the fire characteristics. If hazards are being classified as described above, it will give an initial indication which hazards fall into each category. It would show for example the process events which simply do not have sufficient inventory to realistically cause escalation, those which should be controllable and the events which require evacuation. For individual hazardous inventories, it would show the approximate conditions of hole size and control system operation which would determine whether it was controllable or require evacuation.

2.6.5.2 Reservoir hazards Direct releases from the reservoir may occur due to well intervention such as drilling or workover. In these cases the releases are likely to occur within the drilling facilities; typically at the bell nipple. These are likely to be of indefinite duration if the primary well control and blowout prevention systems have failed. Such releases may also contain drilling fluids, cuttings and other debris. In the case of blowouts from an oil reservoir with delayed ignition, the oil may build up over much of the top deck leading to a particularly hazardous and unpredictable situation when it ignites. Reservoir and drilling engineers should be consulted to identify the fluid composition and calculate the realistic flow rates. In most cases, the releases should be near the top of the platform with the flames rising above it. This will lead to rapid collapse of the derrick and severe radiation onto the top deck. It the release is below the drilling rig structure, this may collapse onto the wells leading to progressive escalation. A shallow gas blowout is another case in which a pocket of shallow gas is controlled by venting through a diverter. Diverters can fail due to erosion giving a large gas release of prolonged but finite duration within or below the drilling facilities with possible escalation as described above. Again drilling and reservoir engineers should be consulted to determine the possible flowrates and their likelihood. Large continuous releases from the Christmas Trees are much less likely due to the multiple valve isolation. They may occur during wire lining but only if there are multiple failures of the barriers. A more realistic scenario is a release from the lubricator via leakage through the valves and wireline BOP. In gas-lifted wells, it is possible that the gas within the annulus could backflow into the wellbay with typical inventories and pressures of up to 10 tonnes and up to 130 bar. The potential for escalation to other wells should be examined but is unlikely if they are fitted with effective downhole isolation or have a heavy-duty integrated Christmas Tree valve assembly. Flowline releases are considered to be part of the process hazards as they are downstream of the well isolation valves.

Issue 1

May 2007

Page 44 of 493

FIRE AND EXPLOSION GUIDANCE Completion failures may result in leakage from the reservoir into the well annuli or around the cement such that oil or gas may surface round the outside of the well at the seabed. This may arise during the initial completion of the well. It may also arise in later life due to seismic action or the deterioration of the well bore, for example by corrosion. Well completion engineers should be consulted about the possibility of this occurrence, the potential flow rates and the locations at which hydrocarbons may be released. The effects of fires on or under the sea are discussed in Sections 5.2.3.6 and 5.2.4.

2.6.5.3 Process hazards The process plant can have up to 40 sections which are segregated by ESD valves. Each of these is a source with individual characteristics of the fluids, pressures and volumes. Typically, the processing will include; Production fluids manifolding and mixing: The manifolds collect the reservoir fluids from the wells via the flowlines, mix the fluids and direct them to the appropriate separators. They contain well fluids (see below) which may be a mixture of oil, condensate, gas, water and other materials such as sand. The inventory will be based on the combined volumes of these pipes. It will range from less than 500 kg in a mature, low pressure gas field up to 5 tonnes of oil for a new field. In oil facilities running at low pressures or using gas lift, the fluid can be three phase with a relatively low density. It may also have a high water cut giving small inventories which may not have the potential for escalation if rapidly isolated. The process conditions, aggressive nature of the fluids and the complexity of the piping give a relatively high probability of a release, particularly large bore flowline failures which may be caused by corrosion or erosion. Potential process backflows of gas and 2-phase fluids from the gas lift inventories into topside blowdown systems also needs to be addressed when analysing topside hazards. Water, gas and oil/condensate separation: This takes place in large vessels, generally over 2 – 3 stages. The liquids have a 3 – 10 minute residence time. Typically, these vessels have total volumes up to 100 m3 and operate at pressures from 70 down to 3 barg. The flammable liquid inventories can be up to 30 tonnes but this may be divided in half by weirs which can reduce the amount which can realistically be released by half. There are relatively few release points providing that there is effective isolation at the outlet. Typically these are tappings for instruments and the possibility of corrosion in the body or welds of the separator vessel. These liquid inventories have the potential to overwhelm a moderate sized platform with a large fire lasting long enough to cause major escalation, particularly if the separators are located lower down in the topsides. They may have less of an impact if located on an open deck such as an F(P)SO as the smoke and flames can freely rise above the rest of the facility. The potential for harm is governed by the release pressure; see below under liquid fires. If these vessels are depressurised, the fires become much more controllable and the time to depressurise is critical. If they can brought below this pressure before escalation can occur or evacuation is required, this may reduce the classification of these hazards to the controllable level, at least for moderate sized holes. The free gas inventory will range from 200 kg for a very low pressure vessel to 5000 kg for a very high pressure vessel with high molecular weight gas. Typically it will be in the 1000 - 2000 kg range. However this may be doubled by additional gas released from the liquids as the vessel depressurises. This inventory has the potential to cause local escalation but is unlikely to overwhelm a medium sized facility. Its potential for harm may be minimised by depressurisation. Stabilisation and final dewatering: Some oil production platforms have a final stage of stabilisation or dewatering. These require large vessels which are filled with virtually stable oil plus a small quantity of water in the bottom. They operate at 2 – 6 bar and can contain up to 200 tonnes of oil. These lower pressures would result in a pool fire which would only be a Issue 1

May 2007

Page 45 of 493

FIRE AND EXPLOSION GUIDANCE threat to the platform if there were no arrangements to bund the release, minimising the size of the fire and further arrangements dispose of the oil and firewater. Oil/condensate pressurisation for export: Export pump arrangements may use one or two pumps in series. These pumps are usually duplicated with manifold arrangements. These complex piping arrangements can give an isolated inventory of up to 15 tonnes for a field with large throughput. The most likely releases are at the pumps themselves but the study of available inventory should carefully examine how much could realistically be released, taking into account the operating philosophy standby arrangements for off line pumps and the provision of valves and check valves. The pump pressures will range from 40 – 120 bar depending upon the pressures within the pipeline infrastructures. Transfer pumps to export tankers will run at much lower pressures. These pressures will drop to the vapour pressure of the oil on shutdown, giving a continuous rate of release until the available inventory is exhausted. The pump seals and the complex jointed piping lead to a high likelihood of a release. The inherent design of the plant requires the pumps to be located close to the lowest level of the platform, often beneath the separators. This will lead to a low level source with the potential for low level external flaming, smoke affecting most of the topsides and escalation to the inventories above. Shutdown of the pumps and careful management of the inventory which can be released will help to reduce the impact but it may still require evacuation in some cases. Gas compression including gas liquids condensing and knockout. Gas from the various stages of separation is progressively compressed and cooled allowing liquids such as ethane, propane, butane and water to be condensed and returned to the liquids system. Typically several compressors will be required with the final discharge pressures of 50 - 60 barg. It is likely that the compressor sections and their associated condensers and knockout pots will be sectionalised with ESD valves. This reduces the gas inventories to 1000 - 2000 kg. As with separation, this has limited potential for local escalation and this can be minimised with depressurisation. The major risk is that to personnel in the immediate area from flash fires or from explosions if the area is congested. There is a moderately high possibility of a gas leak arising from the compressors and associated vibration. The liquids which are condensed and collected in the gas knockout pots may be either liquefied gases or water. The gas-liquid inventories should be less than 2 tonnes and in many cases, just a few hundred kg. Only the larger inventories will have the potential for escalation. However, there is a major exposure to flash fires or explosions as these liquids are very reactive, will have a high release rate and the vapours may not disperse easily. The likelihood of release should be low as there are few release points in the liquid sections of these process plants. Gas drying: This will use either glycol units or molecular sieves and can operate at up to 60 bar. The largest inventory is likely to be a contactor with up to 3 tonnes of gas. Again, this has a limited potential for local escalation and can be minimised using depressurisation. High pressure export, gas lift and reinjection compression: A typical pressure for these systems is 150 barg. However it can be as high as 400 barg for some reinjection requirements. Again, the inventories will be moderate; typically 1 – 3 tonnes with the potential for local escalation. However, the high pressures can give high release rates from moderate hole sizes, increasing the risks from flash fires and explosions. Oil and gas metering: Metering is generally carried out using inline flow meters. From a hazard’s point of view, they are equivalent to piping with additional potential release sites at Issue 1

May 2007

Page 46 of 493

FIRE AND EXPLOSION GUIDANCE the instruments. The hazards are similar to the export pumping and compression respectively and may be part of the same inventory. Identification of the inventory of each process section should be carried out to determine the conditions and inventory during operation and immediately after shutdown. The behaviour of each section should be modelled using simple calculations to determine the gas and liquid release characteristics from a range of hole sizes. The intent is to build up a picture of the types of events that can occur in each part of the platform. These scenarios and associated hole sizes should reflect the failures which have been identified during the causation analysis. They should be sufficiently varied to cover the following; those large but unlikely cases which give short duration fires with the potential for the maximum number of immediate fatalities; those small long duration cases which still have sufficient size to cause local escalation; and those intermediate cases which have the greatest potential for escalation or platform impact whilst still lasting long enough to realise these effects – typically a 10 minute duration.

2.6.5.4 Import and export risers Risers may contain any of the fluids mentioned above, from well fluids to stabilised oil or dry clean gas. They may be connected to a major pipeline infrastructure or be small infield flow lines from satellite wells or for gas lift. The risers may be rigid steel or flexible. The releases may range from pinholes due to corrosion up to a full shear. The location of a release may be as follows: •

Immediately under the platform;

•

Closer to sea level where they may be exposed to ship damage or chafing and corrosion;

•

Sub sea or at the sea bed where it may be subject to internal corrosion.

The location will affect the release characteristics and the ignition probability. Release rates from these pipelines may initially be modelled using simple calculations, the Sintef and Scandpower fire calculations for the process industry [2.13] or using more sophisticated methods. They should be based upon the hole sizes which could realistically occur as identified in the causation analysis. The modelling should cover cases with and without the operation of subsea isolation valves or confirm where these are fitted or considered. They should take into account time delays in the operation of ESD valves and their operability with a high differential pressure following a major riser failure. Data such as valve closure times and internal leak rates should be derived from platform specific datasets. Information from incoming ESD valve trips, routine tests and maintenance will give a more accurate picture of equipment performance than generic information from generally available databases. ESD valves would not respond quickly enough to prevent the immediate fatalities rising from a major gas riser failure unless there was delayed ignition. The characteristics of pipeline releases from two phase fluids or liquids with dissolved gases should take into account the variation in release characteristics caused by; gas and liquids separation, slug flow, the elevation of the release point relative to the main inventory on the sea bed, and effervescence as gas separates carrying with it liquids in aerosol form. In some cases such as subsea releases, the fires may burn on the sea surface, see Section 5.2.4.

2.6.5.5

Types of fire hazard: - Liquids

Liquid fires generally have a greater potential for harm than gas fires for the following reasons: They have greater isolated process inventories arising from the higher densities of between 600 and 850 kg/m3. Typically these can be up to 20 – 30 tonnes in separators. Issue 1

May 2007

Page 47 of 493

FIRE AND EXPLOSION GUIDANCE The release rates will be much greater than gases for the same hole sizes and pressures. The heat fluxes from pool fires will be lower than gas jets but pressurised oil or gas liquids, particularly with dissolved gas can give the same or greater radiative heat flux. A moderate sized oil leak of 20 mm at 20 barg would have a flame volume of 4500 m3 and this has the potential to completely engulf a medium sized process module and cause some external flaming. A 20 tonne inventory would sustain this fire for 30 minutes assuming a constant release rate. This confinement with a roof and/or walls will also cause high radiative heat fluxes, even with pool fires. Liquid fires can also be the source of overwhelming quantities of smoke. Liquids tend to be located at the lower levels of a platform which causes the fire source to have a greater impact on the facility, engulfing the levels above and to the sides in flames and smoke and also leading to the exposure of structures, people and plant above it. Liquid releases can be difficult to detect if there is only a small gas content and this can lead to a build-up of oil on the floor, possibly spreading to lower levels prior to ignition. This can exacerbate the effects by increasing the total fuel quantity, the initial fire size and its spread into more vulnerable locations. The effect of increased water cut of the hydrocarbon from the reservoir on fire hazards should be considered carefully to avoid over-conservatism in the fire risk analysis. For example, some researchers consider that water cuts above 60% make the oil very difficult to ignite. These potential effects can give liquids the potential to overwhelm a platform giving many cases which could be classified as evacuation/extreme, even with moderate pressures and hole sizes on a poorly laid out facility. The fire characteristics will vary according to the release pressures and the fuel type. Most oil is only partially stabilised; i.e. it will have some dissolved and liquefied gas within it. It will also be pressurised; by the inherent state of the fluid (its own vapour pressure); by the pressurised gases above the liquid as in separators; or through pumping. The pressure will determine the release rate and the management of that pressure after the fire is detected is a key component of managing these hazards. This may be achieved by isolating the pumps or by depressurisation. The release rate is proportional to the square root of the pressure and will reduce as these actions come into effect. Equations for calculating release rates are given in the Handbook for Fire Calculations and risk assessment in the process industry, by Sintef and Scandpower [2.13], reference should also be made to the Phase 2 Blast and Fire Engineering for Topside Structures [2.14]. The pressure will also determine how the liquid will burn, for example, as a spray or a pool. The heat fluxes will drop with the pressures and this allows deluge systems to become more effective both in protecting exposed plant and in suppressing the fire itself, this is discussed further in Section 10.3. Lighter liquids such as condensate will have lower transition pressure. Gas liquids; ethane, propane and butane will be pressurised and it is unlikely that their operating temperatures will ever be low enough to allow them to burn as a pool. They are only likely to be found in moderate quantities of 1 – 2 tonnes within the gas compression and drying facilities. An additional issue to be considered is the potential escalating effect of flaming “rain out”; this can occur at ambient temperatures, especially with butane (also propane) and especially for the scenario of jet flame impingement on an obstruction, the next section discusses further detail of jet fires.

Issue 1

May 2007

Page 48 of 493


Types of fire hazard: Gas jet fires

Gases will give rise to an intense jet flame with high localised convective and radiative heat fluxes. The radiative content will increase both with the molecular weight and as the jet encounters obstructions. They are generally not large enough or sustained by a sufficiently large inventory to be significantly affected by confinement within a roofed module except where they directly impact the ceilings or walls. This makes their potential for escalation highly directional and this is likely only to affect a small number of critical items such as a single structural member, part of a vessel or some piping. Only very large inventories would have the potential for more widespread simultaneous failure. These large inventories require both high pressures and large volumes within the process plant or an isolation failure to a primary source such as a riser or well. Gas jets have moderate release rates unless there are very large hole sizes and/or high pressures. A 20 mm hole at 20 barg would give a methane jet of approximately 10 - 12 m and a flame volume of 100 m3. With a source of 40 m3 in volume, typical of the gas content in a separator, this would reduce to a jet of 7-8 m and a flame volume of 25 m3 within 10 minutes of the ESD operating. If the separator was depressurised, this would decay even faster but this may be offset by the disassociation of dissolved gas in the oil.

2.6.5.7

Types of fire hazard: Confinement and ventilation control

The presence of walls, ceilings, floors and obstructions will significantly affect the way in which air can mix with the fuel. They will also affect the flame shape. These two factors will change the heat fluxes, the efficiency of combustion and the density of smoke. The air requirements for stoichiometric burning of hydrocarbon fires are between 15 and 17 times the mass burn rate of the fuel. In most cases, this is the release rate unless there is containment of a pool fire to reduce the burn rate. Most modules have good ventilation and venting to minimise gas build-up and explosion overpressures respectively. The air input rate through a single opening in a wall is calculated using the formula Ma = ½A √H where Ma is the air input rate in kgs-1, A is the area of the opening in m2 and H is the height of the opening in m. With openings in the floors and ceilings or multiple openings in the walls of different heights, this becomes a complex calculation. Typically the fuel burn rate that can be sustained by a module with one open wall of 30 m by 8 m is 21 kg s-1. It is unlikely that severe ventilation limitation will occur unless there is a very high release rate and this is sustained for several minutes. If it does occur it is likely to involve a major liquid inventory rather than gas fires. If the ventilation is severely limited, then the combustion characteristics within the modules will be affected with reduction in heat flux, reduced liquid vaporisation rates, combustion instability, very dense smoke with high concentrations of carbon monoxide. Unburnt vapours may also be ignited as they leave the module giving the external flaming described below. It can take a few minutes before the fire becomes ventilation controlled as the air inside is consumed. It is more likely that a large fire will not be ventilation controlled but that its size will simply exceed that of the module. Once the flame volume reaches 1/3 of the free volume in a module (i.e. that volume up to the top of the highest opening and excluding the volume in between the ceiling beams), then the flames will spread across the ceiling and begin to extend beyond the module. In the initial stages of these fires, the flames build up across the ceilings with a hot flame layer slowly descending across the whole module. This is the neutral plane at which air entering the module mixes with the vapours. This can descend to 2/3 of the way down the openings in the walls with significant flame velocities as they travel towards the openings. These areas will have high radiative and moderately high convective heat fluxes. These will be highest near to or above the source of the fire but will provide a relatively uniform heating of all structures, piping and upper parts of vessels above the neutral plane. This is likely to lead to Issue 1

May 2007

Page 49 of 493

FIRE AND EXPLOSION GUIDANCE multiple failure of this equipment. These high fluxes will occur both with pool and spray fires but gas jets are less likely to develop this form of module engulfment for the reasons described above. The area between the ceiling beams becomes stagnant with high radiative but lower convective heat fluxes. External flaming will occur if either the fire is ventilation controlled or the fire size reaches that described above. With large external flame volumes the width of the base of the flame can be much wider than the opening. If it originates from the lower modules, it can engulf the whole side of the platform with wind causing it to tilt, possibly towards the accommodation or TR. This effect is graphically illustrated in the Piper Alpha Inquiry Report Part 2 [2.15], (see plates14b through to 18a). This will have a major impact upon the whole installation and it is likely to require evacuation if it is sustained for more than a few minutes. There is only limited understanding of this external flaming and there are limited predictive tools to quantify it accurately. Its characteristics may be similar to a large pool fire, with the flames subject to tilt in high winds.

2.6.5.8

Fires on the sea

Fires on the sea will be affected by a number of factors; the fuel, release characteristics, release rate, the sea and weather conditions. It requires a fairly large release and benign sea and weather conditions before the fire has a major impact on the facility. This could lead to structural or riser failure, smoke engulfment of the topsides or the impairment of evacuation. All of the contributing factors must be examined to determine the risk of failures and benign conditions occurring simultaneously. This may be very low in the North Sea but not in other parts of the world. Some development information was prepared in 1992 for the HSE and amongst the treatment of other fire types; a review of pool fires on liquid was undertaken [2.16].

2.6.5.9

Developing a set of representative scenarios

There is an almost infinite range of events which can occur on an offshore facility. A representative selection of scenarios should be selected from each of the hazards which are considered to have the potential for a major accident. An initial hazard identification and expert judgement will identify those hydrocarbon sources with the greatest potential for harm and those with a high probability. These should be subject to more intense scrutiny than lesser risks and any modelling should be based on platform specific parameters not generic fire scenarios with particular attention paid to the uncertainty surrounding two-phase releases. The events chosen for analysis should reflect the installation’s design features as much as possible and encompass the following cases •

Those with the greatest potential for escalation; i.e. the largest events with sufficient duration to cause failure

•

Those events which could realistically occur; i.e. those with clearly identified causes giving failures of an identified maximum size; e.g. the largest tapping size or the dimensions of typical corrosion failures

•

Those events of a critical duration such as the time to cause evacuation

•

The characteristics of the events whenever critical control systems such as ESD fail to operate

Issue 1

May 2007

Page 50 of 493

FIRE AND EXPLOSION GUIDANCE The examination of these hazards should be used to build a complete picture of causes, probability, the range of sizes, location, duration, the possible rates and timings to escalation and the effects when such escalation does occur. This should be documented so that everyone with a part to play in their management can understand the full implications of all design and operational decisions. Once the full hazard assessment is in place, the effectiveness of systems to counteract the effects can be evaluated and the future management of these hazards can be planned as described in Section 1.5.2.1. The analysis is a living process and should be capable of future use to examine different cases or the optimisation of control systems such as depressurisation both during design and operation.

2.7 Inherently safer design for fires and explosions 2.7.1

Introduction

Once the installation concept has been confirmed, it will be necessary to manage fire and explosion risk within the constraints imposed by the subsequent offshore layout. The advantage of an inherently safer design or the ‘Inherent Safety’ design approach is that it attempts to remove the potential for hazards to arise. It does not rely on control measures, systems or human intervention to protect personnel. All control systems have the potential for failure to operate as intended, generally expressed as the probability of failure on demand. Critical loops are designed according to their criticality in mitigating personal, environmental or commercial risk by setting a Safety Integrity Level (SIL). In setting a SIL, it is acknowledged that there is failure potential although this is designed to be inversely proportional to the importance of the loop in risk mitigation. There is always the potential for the systems to be damaged in a hazardous event. Inherent safety avoids this potential by aiming for prevention rather than protection and the preference for passive protection over active systems. It is particularly important to follow Inherently Safer Design principles where the consequences of process release or system failure are high. Where it is possible to reduce the reliance on engineered (active or passive) safety systems or operational procedures this should be done. The Inherently safer design approach contrasts with the process design spiral in Figure 2.2. The result of the application of the Inherently Safer Design approach is reduced complexity and a reduced requirement for human intervention, resulting in a simpler more robust system.

Issue 1

May 2007

Page 51 of 493

FIRE AND EXPLOSION GUIDANCE Enhanced monitoring requirements

More complexity, more leak sources

More maintenance intervention

Duplication to increase redundancy

More instrumentation /automation More safety systems

The process design spiral Reduced monitoring requirement Reduced complexity, fewer leak sources

Less maintenance, less intervention

Increased robustness

Less instrumentation, less automation

Reduction, reduced inventories

Attenuation, substitution

Inherently safer design cycle

Figure 2.2 - The process design spiral and the inherently safer design cycle

2.7.2

Goals of inherently safer design

The goals of inherently safer design are to avoid the hazard and maintain safe conditions through inherent and, where appropriate, passive design features; and to minimise the sensitivity of the plant to potential faults as far as can be reasonably achieved. This implies that the plant response to the fault should satisfy the following criteria in order: 1. The response produces no operational response or results in a move to a safer condition; 2. Passive or engineered safeguards should be continuously available and should make the plant safe; 3. Active engineered safeguards activated in response to the fault should make the plant safe.

Issue 1

May 2007

Page 52 of 493

FIRE AND EXPLOSION GUIDANCE In Inherently Safer Design the following processes are commonly employed [2.17]: •

Reduction – reducing the hazardous inventories or the frequency or duration of exposure;

•

Substitution – substituting hazardous materials with less hazardous ones;

•

Attenuation – using the hazardous materials or processes in a way that limits their hazard potential, e.g. storage at lower temperature or pressure;

•

Simplification – making the plant and process simpler to design, build and operate hence less prone to equipment, control failure and human error.

The application of the above principles should result in fewer and smaller hazards, fewer causes and consequences, reduced severity and more effective management of residual risk. In order to implement the principles, contributions will be required from all levels of the project team. Managers should show leadership in the focus on safety; discipline engineers will be involved in concept choice, plant layout and engineering detail; safety specialists must make the options visible and available to designers and document the process. Table 2.1 summarizes the major ‘inherent safety’ and control features necessary to achieve the goals stated above: Table 2.1 - Inherent safety features to achieve goals Safety goal Benefits of good layout (including partitioning effects or not)

Minimisation of potential leak sources/release potential

Issue 1

Inherent safety features •

place equipment, utilities and personnel areas along a clear hazard gradient

•

where possible use as much segregation as possible to limit escalation

•

avoid congestion in process areas

•

place safety critical equipment in uncongested areas where possible (limits vulnerability to high explosion loads)

•

use height between floors to provide ventilation space (cheap volume)

•

identify measures required by fire and explosions and balance benefits from measures for each hazard category

•

minimise number of pipe joints

•

maximise welded pipe joints

•

minimise invasive instrumentation

•

eliminate/minimise small bore pipework

•

minimise offshore processing and process complexity

•

minimise vibration

•

minimise corrosion/erosion

•

ensure effective inspection

May 2007

Page 53 of 493

FIRE AND EXPLOSION GUIDANCE Safety goal Minimisation of ignition potential

Minimisation of POB exposure to fire effects

Minimisation of hazardous inventory

Minimisation of potential release mass and severity of consequences

Minimisation of congestion

Minimisation of confinement

Maximisation of ventilation

Issue 1


ensure there are no naked flames in live plant

•

audit and review safety management system with respect to hot work procedures

•

insulate hot surfaces (where inspection is not critical)

•

ensure effective earth bonding

•

implement hazardous area zoning (area classification)

•

ensure an effective maintenance regime

•

separate quarters and non-operational personnel from process areas

•

minimise maintenance requirements

•

remote operation of processes

•

simplify the offshore process

•

introduce separate accommodation platforms

•

use fully rated fire barriers and protect non-redundant primary structure

•

provide multiple escape routes from each hazardous area

•

introduce structural redundancy

•

simplification/minimisation of offshore processing

•

use of small isolatable inventories

•

effect isolation from large inventories upon gas/leak detection

•

ensure effective blowdown of inventories

•

minimise inventory pressure and potential leak rate

•

minimise hazardous inventory

•

minimise module size, segregation of release sites from ignition sources and personnel – compartmentalisation

•

Minimise congestion and the possibility of obstructed fires

•

Improve natural ventilation (to reduce ignition probability, avoid re-circulation and external flaming)

•

Consider the use of subsea completions

•

simplification/minimisation of offshore processing

•

optimisation of module layout

•

segregation of congestion and explosion leak sources

•

grated decks

•

open sided modules

•

blow-out panels/louvres

•

optimisation of module layout

•

minimisation of confinement

•

platform orientation to make maximum use of prevailing wind direction

•

equipment layout to avoid ‘dead spots’

•

platform aspect ratio to maximise ventilation

May 2007

Page 54 of 493

FIRE AND EXPLOSION GUIDANCE Safety goal Limitation of potential flame front length

Monitoring and maintenance of SCE integrity/functionality

Maintain effective management of residual risk


limit module size

•

minimise offshore processing

•

add partitions to limit maximum dimensions

•

review of aspect ratio of module dimensions

•

implement an effective inspection programme

•

introduce effective maintenance procedures

•

minimise the exposure of the TR and SCEs to smoke and heat

•

improve SCEs resistance to thermal effects

•

protect SCEs from severe vibration effects

•

protect SCEs from structural displacement effects

•

separate process areas from critical non-hazardous areas

•

safety leadership and focus

•

implement an effective safety management system

•

pursue prevention rather than protection

•

use passive systems of control and mitigation in preference to active systems

The above table details inherent safety and control features that either minimise the potential for fire and/or explosions to occur, or if they occur, to minimise the consequences and subsequent risk to personnel. These features should ideally be built into the early design of the installation, rather than being included as mitigation measures at a later date. Inherent safety practices must be maintained throughout the life of the installation continuing through the operational phase by adherence to effective inspection and maintenance regimes and by ensuring that management systems and related procedures are followed. The benefits of the inherently safer design approach are that hazards and risks are tackled at source. There is an opportunity for cost effective risk reduction (at an early project phase). The approach will normally result in easier and more reliable plant and often results in reduced through life costs. There may be some conflict between the various features of inherent safety. For example, increased compartmentalisation will reduce the size of a potential explosive gas cloud however this will also decrease the potential for natural ventilation and increase confinement. The balance between such features is discussed later in this Guidance.

Issue 1

May 2007

Page 55 of 493


Effective management of residual risk

The risk which cannot be eliminated or prevented by the application of inherent safety methods is referred to as residual risk. Inherent safety methods can also be applied to the management of the residual risk by consideration of the general principles indicated below: CONTROL is better than MITIGATION is better than EMERGENCY RESPONSE. As regards systems to reduce risk; PASSIVE systems are more reliable than ACTIVE systems are more reliable than OPERATIONAL systems are more dependable than EXTERNAL systems

This indicates that the use of passive rather than active control and mitigation systems is preferred and that reliance should not be placed on personnel to prevent, control or mitigate hazards if avoidable. This process is illustrated in Figure 2.3 below.

Issue 1

May 2007

Page 56 of 493

FIRE AND EXPLOSION GUIDANCE Understand Hazards hazards

Cause & Likelihood

Severity

Escalation

Exposure

Minimise each at source

Strategy ?

Prevent Control Mitigate Evacuate

System choice? Choice?

Passive Active Operational External

System performance? Performance?

Role, Functionality, Criticality, Survivability

Risk

No

Is it good enough?

Yes Proceed with Detailed Design

Figure 2.3 - Risk reduction flowchart Table 2.2 below defines and expands upon some of the terms used above [2.18].

Issue 1

May 2007

Page 57 of 493

FIRE AND EXPLOSION GUIDANCE Table 2.2 - Systems to minimise the consequences of accidental events Type

Description

Passive

Systems that act upon the hazard simply by their presence. They do not need to react to the hazard or need operator input at the time of occurrence in order to be effective. Modes of failure are long-term deterioration, physical damage or removal. Preferred because they are inherently the most reliable, requiring only inspection and maintenance, reducing the need for people to be in hazardous locations. Typical examples are corrosion allowances, layout, welded connections, relief panels, natural ventilation, separate accommodation platforms, fully rated pipework/vessels/primary structure/barriers and subsea completions.

Active

Systems that may require mechanical or electrical facility, or control signals in order to work. Susceptible to mechanical/electrical/software failures and downtime. Less reliable, particularly where their failures may not be visible. Inspection, testing and maintenance required, and thus susceptible to human error or omission. Can cause increased numbers of personnel and activity on the facility. Typical examples are, depressurization systems, fire and gas detection and active fire and blast suppression systems.

Operational

Systems that depend primarily upon people to initiate the system or to carry out the whole function. Can be less reliable and requires sufficient procedures and trained people on the facility to ensure their operation. Effectiveness is wholly dependent upon the operator, who should agree to be dependent on these measures. Typical examples are maintenance, inspection and condition monitoring.

External

Systems that depend on the correct reaction of people beyond the company/asset/installation and its direct workforce. Potential for error due to the longer communication lines and frequent changes of the people involved. May be dependent upon effective contracts and audit. Examples are the competence of a supply boat master to avoid riser impact, and isolation of a third party feeder pipelines.

2.7.4

Processes for achievement of inherently safer design goals

Table 2.3 below details some of the processes which should be used to achieve the goals of inherently safer design. The project phases at which these processes are most appropriate are also identified

Issue 1

May 2007

Page 58 of 493

FIRE AND EXPLOSION GUIDANCE Table 2.3 - Achievement of goals Goal

Fewer hazards giving rise to fire and explosions

Means of achievement

Key processes

Minimise offshore processing

Conceptual

Concept analysis, risk ranking. Selection of lowest risk option unless cost is grossly disproportional to risk gain.

Simplify the process employed

Conceptual

Concept selection

FEED

Process review, HAZOP, HAZID

Conceptual

Concept selection

FEED

Process review, HAZOP

Less piping joints

FEED

Piping philosophy to promote welded connections

Less small bore piping

FEED

Piping philosophy, instrument philosophy

Less maintenance

Conceptual

Concept selection, minimisation of process

FEED

HAZOP, corrosion policy (piping specification), maintenance philosophy (replacement vs. maintenance)

Less intrusive instrumentation

FEED

Instrumentation philosophy stating preference for non-intrusive instrumentation

Less corrosion

FEED / Detailed Design

Corrosion philosophy, choice of materials/piping specification

Less vibration

Detailed Design

Process design, piping supports, resilient mountings for mechanical plant.

Fewer ignition sources

Conceptual

Minimisation of process complexity

FEED/Detailed Design

Area classification (hazardous area) designation.

Less maintenance burden

Fewer causes of fires and explosions

Phase

Safety Philosophy - no naked flames Insulation specification (hot surfaces)

Issue 1

All

Replacement of light fittings with flood lights [2.19]

Operation

Operation/Maintenance philosophies. Elimination or minimisation of hot work at live plant. No welding/gas cutting at live plant

May 2007

Page 59 of 493

FIRE AND EXPLOSION GUIDANCE Goal

Reduced severity of fires and explosions

Fewer consequences resulting from fires and explosions

Means of achievement

Key processes

Less congestion

FEED / Detailed Design

Layout – minimise piping and small diameter items. Layout of small bore items

Less confinement

FEED

Layout – grated decks, fewer walls/partitions

Lower process pressures

FEED

Design Basis/Process Philosophy. Seek to minimise process operating pressures

Smaller inventories

Conceptual / FEED

Choice of separation options, location of isolation and other barrier valves

Smaller potential explosion zones

FEED

Layout (may conflict with confinement)

Shorter flame path length

FEED

Layout – avoid long narrow modules

More ventilation (explosions) or less ventilation (fires)

FEED

Orientation Study, Ventilation Study. Reduce confinement, installation orientation. Aim to achieve greater than ‘adequate’ level (> 12 air changes per hour (ach))

Unmanned installation

Conceptual

Concept selection - minimisation of offshore processing

Lower manning levels

Conceptual

Concept selection - minimisation of offshore processing, minimise Normally Unattended Installation (NUI) visit frequency, remote operation, minimise maintenance

Lower exposure of personnel to the explosion hazard and escalating events

Conceptual / FEED

Concept selection - minimise manning levels, minimise maintenance, maximise separation of control and quarters areas from process areas

No missile generation

Detailed Design

Layout & fixing details - fix small items to robust equipment away from high blast wind areas.

Operation

Housekeeping - removal of lose items from module, no storage of equipment

Conceptual/FEED

Segregation of explosion risks and major fire escalation

Escalation

Issue 1

Phase

May 2007

Page 60 of 493

FIRE AND EXPLOSION GUIDANCE Means of achievement

Goal

More effective management of residual fire and explosion risk

2.7.5

Phase

Key processes

Prevention rather than protection

All

HAZID/HAZOP - identify hazards then use hazard management hierarchy – elimination of hazard being first goal

Passive systems rather than active

All

Aim for inherent safety rather than use control systems which have failure modes

No reliance on personnel to prevent, control or mitigate hazards

FEED/Detailed Design

Control/Process/ESD Philosophies - use control systems to make decisions in structured manner according to ESD hierarchy.

Minimise number of safety critical systems

All

Minimise process complexity and manning levels so that quantity of safety critical elements are reduced in number

No exposure of safety critical systems to hazards

All

Minimise the process, maximise separation of control and quarters areas from process areas

Constraints and limitations of inherent safety

Ideally the inherently safer design approach should be applied throughout the project duration and continue throughout the life of the installation. At the concept choice stage the selection of a safer concept should be paramount. At the preliminary engineering phase layout should be designed with the intention of reducing the severity and consequences of major hazards. At the detailed engineering stage systems should be designed to reduce the likelihood and severity of the hazard. If the method is not applied from the start then it may not be possible, cost effective or effective in risk reduction terms to modify the plant to conform to the ideals of inherently safer design. Intervention may give rise to an additional hazard which must be assessed and should not compromise the gains to be achieved by the modifications. It may not be reasonably practicable to apply retrospectively to existing plant, what may be demanded by reducing risks to ALARP for a new plant and what may have become good practice for every new plant. The overall individual risk and the TR impairment frequency (TRIF) from all hazards must still be less than 10-3 per year. If risks are in this intolerable region then risk reduction measures must be implemented, irrespective of cost. There may be some conflict between the various approaches employed to improve inherent safety. For example, increased compartmentalisation will generally reduce the size of a potential ignitable gas cloud and the number of potential ignition sources, however this may decrease the potential for natural ventilation, increase confinement and give rise to obstructed or ventilation limited fires. The balance between such features needs to be considered.

Issue 1

May 2007

Page 61 of 493

FIRE AND EXPLOSION GUIDANCE Corrosion under insulation is a major cause of line failure and high operational cost; hence insulation may be inappropriate as an ignition source reduction measure and as a process protection measure. Insulation may actually increase the temperature of enclosed inventory or the surfaces being protected. There will also be a balance to be struck between reduced complexity and redundancy/duplication of systems. Economic requirements may make such duplication necessary and may actually reduce the required intervention. Whilst it is generally beneficial to reduce in-line instrumentation, instrumentation associated with autonomous systems such as deluge and leak detection systems should not contribute to the likelihood of a release and hence this instrumentation is bound to be beneficial, unless the maintenance requirements and instrumentation failure consequences increase the risk. A strict adherence to the principles of inherently safer design may, in some circumstances, increase the overall risk.

2.8

Risk screening

2.8.1

General

The higher the life safety risk (or risk to life) on an installation or within a compartment/module the greater should be the rigor that is employed to understand and reduce that risk. Where the risk associated with an outcome is low, any inaccuracies in determining that risk will also be low in absolute terms. The effort expended should be proportional to the risk. It is important therefore to have a means of early estimation of the risk level of an installation to determine the appropriate approach to be used in installation fire assessment. The approach to fire assessment needs to be decided early in the design process when absolute values for release frequency and detailed consequence analysis are not available. Risk is the product of consequence and frequency of occurrence. This risk can be calculated as a numerical value expressed as individual risk (IR) or in terms of a value for the installation such as Potential Loss of Life (PLL). Where quantitative values are not available a qualitative measure of risk can be estimated to a degree of accuracy sufficient to make a decision on the assessment approach to be adopted. Likelihood is a more appropriate term in this context where a qualitative assessment is being performed, the terms probability and frequency imply that numerical values are available. At a later stage in a design project a 5 x 5 risk matrix may be appropriate for risk acceptance. However at an early project phase the increased number of boundaries between consequence and likelihood classes may be difficult to identify and assign. A simple approach which is frequently adopted for qualitative risk assessment uses a 3 x 3 matrix of potential consequence versus likelihood of a fire event is described in this section.

2.8.2

Applying the risk matrix

It is recommended that a screening of an installation or compartment is performed giving a low, medium or high risk classification for the facility. This may be achieved by using information gained from previous fire and explosion assessments or by following a prescribed methodology. This will enable the efficient targeting of resources according to the risk level of the installation and identify the important safety issues at an early stage of the assessment. Issue 1

May 2007

Page 62 of 493

FIRE AND EXPLOSION GUIDANCE Installations are subject to different levels of risk, based on the severity of the event, its potential duration and the installation’s vulnerability. The severity, duration and location of the fire or explosion will be functions of process flow rates, pressures and inventory. The potential vulnerability of the installation will be a function of layout, manning levels, location and age etc. For existing installations, the individual risk (IR) per annum from fire and explosion events will have been used in the demonstration of ALARP in the existing Safety Case for the installation. The total IR will be a good indicator of the appropriate level of sophistication of analysis and whether the installation is in the low, medium or high risk category. Proposed modifications to the facility may result in changes to these IR values. A low potential of loss of life (PLL) for the installation may not be a good indicator for normally unmanned installations and ageing platforms with extended life, because of low occupancy. However, assuming the risks to any group of individuals is acceptable, the effort and cost involved in assessing risks and incorporating risk reduction measures should largely be justified on the basis of the potential for reducing the overall PLL. It should be borne in mind that the methods considered adequate for hazard mitigation during preparation of a previous Safety Case may no longer be adequate or correct, as a consequence of improved understanding of technical integrity behaviour and loading, or new research. Details of the existing Safety Critical Elements should be available enabling their classification into categories 1, 2 or 3. The high level performance standards for the facility should be defined or confirmed at this stage. The general approach should be to bring the SCEs up to the same level of integrity taking into account the criticality or consequences of failure and the difficulty in achieving the level of performance desired. The number or proportion of existing SCEs vulnerable to explosion loads is also an indicator of the risk category for the installation. The risk associated with TR impairment under direct and indirect explosion loads combined with impairment of means of escape is Key. A simple approach which is frequently adopted for qualitative risk analysis uses a 3 x 3 matrix of potential consequence versus frequency or likelihood of an accident or event, and such a matrix is illustrated below (see Table 2.4). The overall categories of 3 published documents are shown; the documents are issued by UKOOA, API and ISO [2.20, 2.21 and 2.21], the notation differs between the three documents and has been adjusted for comparison purposes. Other practitioners make use of a 5 X 5 matrix; the choice of preferred level of refinement should be dependent on the Duty Holder’s corporate background and their experience with the use of qualitative risk assessment. A 5 X 5 matrix will obviously offer a greater degree of refinement, the choice of refinement should be governed by the motive for the analysis, for example, a ranking exercise for a number of competing feasibility options could easily make use of a 3 X 3 matrix, whereas, making a decision on a protection option would benefit from the use of a 5 X 5 matrix. The higher the risk (likelihood x consequence) in an installation or compartment the greater should be the rigour that is employed to understand and reduce that risk, this may entail choosing more comprehensive methods and analysis tools. The solutions and protective measures for the installation with greater risk should be able to bear greater scrutiny, from both the Duty Holder and the regulator’s point of view. All three documents use risk matrices for risk screening. Issue 1

May 2007

Page 63 of 493

FIRE AND EXPLOSION GUIDANCE Table 2.4 - Risk matrices from the three documents

Likelihood/ probability

UKOOA

API

ISO

Consequence

Consequence

Exposure level

H

M

L

H

M

L

L1

L2

L3

H

H

H

M

H

H

M

H

H

M

M

H

M

L

H

M

L

H

M

L

L

M

L

L

M

L

L

M

L

L

There is a large degree of similarity between the three documents, the differences in notation and the differing treatment of the outcomes (risk) are summarised in Table 2.5 below. Table 2.5 - Notation and treatment of outcome of risk matrix by document Notation

UKOOA

API

ISO

Likelihood/Probability

Likelihood

Probability of occurrence

Probability of exceedance

H

High

Higher

Risk level 1 (L1)

M

Medium

Medium

Risk level 2 (L2)

L

Low

Low Risk

Risk level 3 (L3)

Outcome

UKOOA

API

ISO

Requires high sophistication analysis

(Higher risk) Risk level must be reduced. Assess structure by considering scenario/event based approach

Significant risks which are likely to require prevention, control, mitigation

M

If nominal loads apply, use them otherwise high sophistication analysis

If nominal loads apply, use them otherwise high sophistication analysis

Risks require further study to define probability, consequences, cost

L

Use low sophistication analysis, elastic analysis (nominal loads)

Low risk need not be considered further

Insignificant or minimal risk which can be eliminated from further consideration

H

It is appropriate to note that uncertainties and/or sensitivities should be considered part of the level of rigour of analysis chosen (based on the risk ranking). The uncertainties and sensitivities should also dictate the approach to the ensuing analyses. For example, a precautionary approach may be adopted where data are limited, the design is novel or manning levels are higher, (more than say 50, one TEMPSC load). Issue 1

May 2007

Page 64 of 493


Risk screening acceptance criteria

2.8.3.1

General

The objective of a fire and blast hazard management process is to reduce risks associated with potential hazards to a level that is ALARP, that is, to a level that is tolerable. Tolerability can be related to specific quantitative targets as is the case in some legislative regimes, it can be related in part to cost (risks being reduced to a level that do not incur disproportionate costs) and an array of other criteria defined by legislation and/or corporate goals as part of internal safety management systems. One simple approach to defining risk [2.23] and hence identifying whether risk is tolerable is the use of risk matrices. These come in a wide variety of forms but provide a simple and effective means for design teams to assess the likelihood (probability of and event) and the severity (consequence). Generic definitions for likelihood and consequence can be easily established. This enables the risks to be semi-quantitatively defined (positioned) and offers a mechanism for mitigating measures to be evaluated (i.e. is likelihood or outcome reduced, by how much and what is the residual risk level). The method reviewed here utilises logarithmic frequency and severity ratings which are added together to give a risk rating. These are added rather than multiplied because they are logarithmic representations of the actual frequency and severity. Risk rating = Frequency rating + Severity rating A simple example of the use of risk acceptance matrices is presented here. Risk may be set at three levels by the matrix: A - risk is not normally tolerable – additional controls/design changes required B - risk is tolerable with controls – evaluate additional controls/design changes C - risk is tolerable. Table 2.6 - Risk acceptance matrix – Frequency vs. Severity

Severity

Frequency

Issue 1

Frequent

Occasional

Infrequent

Unlikely

Rare

Severe

A

A

A

B

B

Critical

A

A

B

B

C

Substantial

A

B

B

C

C

Marginal

B

B

C

C

C

Negligible

B

C

C

C

C

May 2007

Page 65 of 493

FIRE AND EXPLOSION GUIDANCE FREQUENCY RATING (FR) or Likelihood: Each generalised hazard scenario, taking into account existing controls and including releases in all directions under all environmental conditions, ignition times and ignition location, may be ranked using a coarse system based on the frequency of the cause. It is necessary to consider a generalised frequency in this calculation as the frequency associated with a particular release direction under particular ventilation (wind) conditions is likely to be very small. This scenario specific frequency will not be representative of the general frequency of a late ignited release giving rise to a significant overpressure and will grossly underestimate the frequency rating and hence the risk. The frequency rating may be categorised using the following as a guide: Table 2.7 - Frequency Rating (FR) criteria Category

Annual probability of occurrence per year -1

Frequent

> 10

Occasional

10-1 – 10-2

Infrequent

Frequency Score

Rating

More than once every 10 yrs

0

5

Once every 10 to 100 yrs

-1

4

-2

-3

Once every 100 to 1,000 yrs

-2

3

-3

-4

10 – 10

Unlikely

10 – 10

Once every 1,000 to 10,000 yrs

-3

2

Rare

< 10-4

Less than once every 10,000 yrs

-4

1

The frequency ‘score’ is effectively the logarithm of the annual probability of occurrence. The frequency rating is a normalized representation of the frequency ‘score’ for use in semiquantitative hazard assessment. SEVERITY RATING (SR) or Consequence: Each existing controls, the variability from ignition time and conditions may be ranked using a coarse system assessment must consider the risk profile from requirements in particular relating to TR impairment.

release scenario, taking into account position under a range of environmental based on severity of the cause. The all causes to satisfy the legislative

Severity is assessed using the following guide.

Issue 1

May 2007

Page 66 of 493

FIRE AND EXPLOSION GUIDANCE Table 2.8 - Severity Rating (SR) criteria Severity Category

Severity (safety, environment, asset) Score

Rating

Severe

Large scale loss of life Large scale environmental impact Large scale loss of asset

+2

5

Critical

Loss of life of several persons Extensive environmental impact Major loss of asset

+1

4

Substantial

Loss of single life or serious injury to several persons Significant environmental impact Significant loss of asset

0

3

Marginal

Single serious injury or minor injuries to several persons Minor environmental impact Minor loss of asset

-1

2

Negligible

Single minor injury Little environmental impact Little loss of asset

-2

1

2.8.4

Low explosion risk installations

Where the explosion risk category for the installation is low, the low risk methodology may be used. It applies not only to the definition of the explosion hazard but also to methodologies in handling the response of structures, piping, and other SCEs. A suitable low sophistication means of defining the explosion hazard is the use of valid nominal overpressures derived from previous assessments of similar structures. They may be used as the ductility level blast overpressures (DLB). Another acceptable means of overpressure derivation for low risk installations is comparison with a specific past cases. Such comparisons should be supported by evidence that a structured assessment has been undertaken to identify areas of difference and that the original means of calculation were sound. Extrapolation of data for the relevant parameters is not generally recommended but may be valid if a sound basis exists. The comparison process would incorporate consideration of the following factors: •

the validity of the model used in the initial assessment;

•

the version of the explosion modelling software used;

•

the resolution and precision of the grids used in the calculation;

•

substantial physical differences between this and previous cases.

Issue 1

May 2007

Page 67 of 493

FIRE AND EXPLOSION GUIDANCE A comparative assessment method may be used drawing on experience from demonstrably similar structure geometry and scenarios. The nomination of a typical installation to represent a fleet of platforms is acceptable.

2.8.5

Medium explosion risk installations

Where valid nominal overpressures are available or past cases exist that are relevant, these values may be employed. However the premise is that the variables listed would be more closely analysed than might be the case for a low explosion risk installations or compartments, and no extrapolation of data allowed unless published data exists. Where no nominal overpressure has been defined for the installation and there are no suitable past cases for comparison, then the level of analysis appropriate for high risk installations should be used for explosion hazard assessment. Medium risk methods are described in this Guidance which substitute for some of the tasks defined in the Higher risk methodology. The philosophy recommended in this Guidance is that for medium risk installations the choice of methodology for any particular task must be justified where it deviates from the higher risk methodology.

2.8.6

High explosion risk installations

Where the potential risk level on an installation or within a compartment is high, this will warrant a commensurately high level of analysis. The ability of the installation and the safety critical systems on it to withstand explosion need to be accurately determined as any error could have a significant risk impact. This level of analysis would involve; •

A complete set of explosion scenario investigations

•

A combination of CFD and phenomenological dispersion, fire and explosion simulations with knowledge of the frequencies of release and ignition (this may include CFD simulations of gas dispersion, zonal models, the Shell DICE model or the workbook approach [2.24] as justified).

•

Determination of equivalent stoichiometric cloud size [2.3].

•

A combination of CFD and phenomenological explosion simulation with generation of exceedance curves representing frequency of overpressure exceedance.

•

Determination and assessment of the structure and SCEs against the SLB and DLB design explosion loads including blast wind dynamic pressures.

•

Time dependent and possibly non-linear dynamic modelling of the installation and systems response.

•

Explicit consideration of escalation and interaction between fire and explosion scenarios including the collapse of tall structures and the external explosion.

•

Consideration of strong shock and missile generation by the explosion.

Annex G gives by way of checklists the issues which should be considered for low medium and high risk installations. These checklists are taken from reference [2.25] the Genesis ‘Explosion assessment guidelines’. Issue 1

May 2007

Page 68 of 493

FIRE AND EXPLOSION GUIDANCE Table 2.9 over the following pages, indicates a range of methods sorted by task but which are appropriate to Low, Medium or High risk installations. Table 2.9 - Appropriate methods of analysis by risk category Task 1. Installation screening

2. Scenario definition

Low risk

Medium risk

High risk

This task determines the risk level of the installation Consider worst case scenarios apply practical limiting factors to arrive at design credible event.

Consider a number of release scenarios with their associated frequencies.

Consider ingress of gas from neighbouring modules and dispersion/ventilation characteristics.

Consider and justify use of previous or similar assessments by use of design basis checks & assessments, complete if satisfactory.

Consider a number of ignition source positions.

Consider external explosions.

Calculate release rates and durations. 3. Preventcontrolmitigate

Consider the options of hazard elimination, control and mitigation primarily by reduction of the frequency of an ignited release then by limitation of immediate and escalation consequences. Categorise SCE’s determine criticality 1 and 2 SCE’s

4. Explosion load determination

4. Explosion load determination (continued)

Issue 1

Consider design credible event. Use appropriate nominal overpressures and durations.

Consider design credible event. Use appropriate nominal overpressures and durations

Consider representative leak directions.

Calculate equivalent stoichiometric cloud size.

Calculate equivalent cloud sizes from dispersion handbook approach.

Calculate cloud evolution using CFD dispersion simulation for representative wind speeds and directions.

Determine overpressure peak and duration – DLB only

Determine overpressure peaks and durations.

Calculate ignition probability time history.

Calculate dynamic overpressures on Criticality 1 SCE’s. Use 1/3 local peak overpressure if values not available.

Calculate dynamic overpressures on Criticality 1 & 2 SCE’s. Use 1/3 of local peak overpressures for DLB Criticality 1 and SLB if values not available.

Consider intermittent ignition sources and time history of cloud geometry giving worst ignition time at maximum equivalent stoichiometric cloud size.

Calculate exceedance diagrams for overpressure and dynamic pressures. (Simplified 1 point method acceptable).

Calculate exceedance diagrams for overpressure and dynamic pressures.

Determine SLB and DLB overpressures and dynamic pressures.

Determine SLB and DLB overpressures and dynamic pressures from exceedance curves.

May 2007

Page 69 of 493

FIRE AND EXPLOSION GUIDANCE Task

Low risk

Medium risk

High risk

Determine far field, blast wave effects

5. Assess integrity of structure and other SCE’s

Identify and assess escalation targets.

Identify and assess escalation targets.

Idealise load time histories non-triangular idealisations possible.

Idealise load time histories non-triangular idealisations possible.

Use full load-time histories.

Check primary and secondary structure response to DLB using modified code checks. Check deflection and rotation limits for DLB. Equivalent static loads allowed if justified.

Check primary and secondary structure response to DLB and SLB loads using modified code checks. Check deflection and rotation limits for DLB. Equivalent static loads allowed if justified.

Check primary and secondary structure response to DLB and SLB loads using modified code checks. Check deflection and rotation limits for DLB. Dynamic analysis required.

Check SCE’s barriers and connections to DLB.

If required check primary and secondary structure to DLB using non-linear dynamic analysis.

If required check primary and secondary structure to DLB using non-linear dynamic analysis.

Non-load bearing barriers and cladding may be checked for DLB using simplified methods (Biggs).

Non-load bearing barriers, cladding and their connections may be checked for DLB using simplified methods (Biggs) if ductilities less than 5 are expected. Check integrity of penetrations.

Non-load bearing barriers, cladding and their connections and supporting structure may be checked for DLB using simplified methods (Biggs) if ductilities less than 5 are expected. Otherwise use NLFEA.

Check SCE’s criticality 1 to DLB and SLB using dynamic pressure loads. Check SCE’s criticality 2 to SLB using dynamic pressure loads.

6. Evaluation

Issue 1

Verify that life safety risk is acceptable.



Verify that the installation satisfies high level performance standards.



Determine if the SCE’s satisfy element specific performance standards.



Determine if ALARP has been satisfied.



May 2007

Page 70 of 493

FIRE AND EXPLOSION GUIDANCE Task

Low risk

Medium risk

High risk

Notes

1. Medium risk methods which substitute for some of the tasks defined in the Higher risk methodology. The philosophy recommended in this Guidance is that for medium risk installations the choice of methodology for any particular task must be justified where it deviates from the higher risk methodology. 2. For high risk installations, all the tasks from low and medium risk methodologies should be considered in principle in addition to those listed.

2.9

Risk reduction

Risk management and reduction is an integral part of the Health, Safety and Environmental Management System (HSEMS) of any organisation or project. The HSEMS provides the overall framework within which all risks (not just fire related) should be managed. To assess and manage the risks arising from a specific operation especially with respect to a specific hazard category it is necessary to recognise the requirements of the HSEMS on the risk management process (e.g. in determining acceptable levels of risk) and to implement the processes that contribute to the risk management. As part of the processes contributing to risk management, an assessment and implementation programme for dealing with risk reduction measures should be in place. The risk reduction measures include preventative measures (i.e. likelihood reducing) and mitigation measures (i.e. consequence reducing). The detailed definition and specification of these measures form significant components of design codes and standards. Where appropriate, risks can also be significantly reduced by the adoption of inherently safe designs as discussed in Section 2.8. In identifying candidate risk reduction measures, consideration should be given to the full range of measures involving inherently safer design, prevention, detection, control and mitigation. The risk reduction measures considered may range from items of equipment and physical systems through to operational procedures, managerial structures and planning. It is worth emphasising that the UK regulator will expect to see the following demonstrations for risks lying below the maximum tolerable, but above the broadly acceptable level: •

That the nature and level of the risks are properly assessed and the results used to determine control measures;

•

That residual risks are not unduly high and have been kept ALARP;

•

That the risks are periodically reviewed to ensure that they still meet the ALARP criteria.

Duty holders should not assume that if risks are below the maximum tolerable level, they are also ALARP. This should be demonstrated through the application of relevant good practice and sound engineering judgement; and the consideration of further measures that can be adopted to reduce risks to ALARP. The degree of rigour of the ALARP demonstration should also be proportionate to the level of risk associated with that hazard category on that installation.

Issue 1

May 2007

Page 71 of 493

FIRE AND EXPLOSION GUIDANCE A number of example risk reduction measures that have been used in submitted safety cases (data collected up to 2001) has been tabulated in the HSE publication, “Fire, Explosion and Risk Assessment Topic Guidance”, Issue 1, February 2003. This table is reproduced below. For full document see http://www.hse.gov.uk/foi/internalops/hid/manuals/pmtech12.pdf Table 2.10 - Examples of risk reduction measures implemented on existing installations Type of measure

Description of measure Leak prevention

Prevention (i.e. reduction of likelihood)

•

Removal or strengthening of small bore pipework connections

•

Isolation of disused wells at production header as well as Xmas tree and venting of flow lines back to tree

•

Decommissioning of redundant equipment

•

Improvements to systems of work

•

Implementation of competence management and assurance system

•

Improvements to PTW system

•

Improvements in integrity assurance

Ventilation •

Removal of wind walls

•

Enhancement of HVAC in process modules

Ignition control •

Monitoring of gas turbine exhaust system temperature

Gas detection Detection (i.e. transmission of information to control point)

•

Installation of ultrasonic leak detectors

•

Installation of additional IR beam detectors

Fire detection •

Installation of additional fire detectors

Emergency shutdown (ESD) systems • Control (i.e. limitation of scale, intensity and duration)

Issue 1

Installation of high integrity check valve on gas re-injection header

Blowdown and flare systems 8.

Installation of additional blowdown valves

Explosion control •

Initiation of water deluge on detection of gas

•

Removal of redundant equipment

May 2007

Page 72 of 493

FIRE AND EXPLOSION GUIDANCE Type of measure

Description of measure Active fire protection •

Replacement of deluge system piping

Passive fire protection •

Uprating of fire walls

Blast protection •

Uprating of blast walls

Temporary Refuge Mitigation (i.e. protection from effects)

•

Re-location of Main Control Room to TR

•

Re-definition of TR

•

Enhancement of mustering facilities

•

Protection of external staircase

•

Provision of airlock doors

•

Provision of dedicated HVAC system for TR

Evacuation and escape

Mitigation (i.e. protection from effects) contd.

2.10

•

Installation of additional emergency lighting on escape route

•

Provision and maintenance of proper training in the use of evacuation and escape facilities

•

Provision of alternative escape routes

Fire-fighting equipment •

Installation of new foam monitors

Manning •

Reduction of POB

The lifecycle approach to fire and explosion hazard management

This Guidance has adopted a lifecycle approach to implement hazard management. In this Guidance, the lifecycle approach has been broadened in scope so that it both highlights opportunities for enhancing inherent safety and also addresses all safety systems. It summarises those activities which need to be carried out, the decisions which need to be taken and the optimum timing in the lifecycle. It can also be used to integrate the work of all contributors to the risk management process including; the different design disciplines, risk assessors, fire and explosion specialists, operators and auditors. Some main feedback loops are shown but other stages also require feedback.

Issue 1

May 2007

Page 73 of 493


Fire and explosion assessment during the installation lifecycle

FEHM is an integral part of the SMS throughout the installation lifecycle. The lifecycle is made up of the general stages of concept selection, detail design, construction and commissioning, operation, modifications and decommissioning. These are described in more detail in the next section indicating approximate timing and sequencing of particular activities. FEHM is a continuous process rather than a series of discrete steps. There will be overlaps and iterations between the various stages of the design, commissioning and operation phases with earlier decisions reviewed and revised as necessary. Each numbered step of the assessment process for fires and explosions as outlined in Section 4 is linked with the relevant stage of the lifecycle. These steps are shown in Figure 2.4 shaded in boxes 1, 5, 6, 7, 8 and 11 with the associated activity alongside. The need to revise the assessment and repeat elements of the lifecycle is identified in boxes 19 and 20. At each step of the lifecycle where critical decisions are taken, particularly box 11, these should be reviewed to ensure that all reasonably practicable risk reduction options have been considered, that the high level performance standards have been achieved and risks are ALARP. The lifecycle approach can be applied at any stage of the installation life. With an operating field or a partially completed design, many or all of the systems will already be specified or in place and the relevant lifecycle activities will have been completed. In these cases, the steps of the assessment shown in boxes 5 to 8 and 11 should be carried out as a discrete activity so that a full picture of the fire and explosion hazardous events can be developed, before the need for any changes can be determined.

Issue 1

May 2007

Page 74 of 493


E xi stin g In stal lati ons

New I nstall atio ns

1

I dent i f y f i re and explosion hazards on di f f erent concepts

A ppl y i nherent safe desi gn principles

3

S el ect concept t aki ng i nt o account risks from all possi bl e hazards i ncl udi ng fires and explosions

4

Def i ne t he desi gn and operat ional regime - codes, st andards and s af et y m anagement systems

Conf i rm al l hazards are i dentified

5

Opt i m i se desi gn to improve t he i nherent safety

I dent i f y t he causes of t he hazardous events

V eri f y t hat t he design codes are sui t abl e f or t he haz ardous events and sel ect speci f i c prevention methods

7

Det erm i ne fire and expl os i on loadings

S el ect / opti mi se control systems to l i m i t t he escal at ion of hazardous events

I dent i f y vul nerable plant, equi pm ent , pers onnel and rout es t o escalation

S el ect mi ti gati on systems

Def i ne t he rol es and functionality, 9 rel iabi li ty, avai labi li ty and survi vability param et ers f or engi neered systems

Devel op escalation 11 anal y si s and risk ass essment

15

16

12

Def i ne rol es, manning and c om pet ence requi rements for procedural systems

V eri f y t hat al l haz ardous events are addressed, syst em s are suitable, and t he overal l perf orm ance is achieved

Desi gn hardware to meet param eters

14

Const ruct i on and Com mi ssining

P l an f ut ure verification

10

Concept ual and detail design

6

8

13

Concept selection

S et t he high level perf orm ance standard

2

Devel op procedural saf et y systems

P rovi de / i dent i f y procedures and schedules for operat i on, m ai nt enence and testing

V eri f y t hat sys t em s are effective and rel i abl e duri ng commissioning and t hroughout t he i nstallation life

17

I dent i f y and assess any change / m odification / det eri oration

21

Updat e assessm ent and safety syst em provi si on to address decom m i ssi oning hazards

22

Decom mi ssion pl ant using ef f ec t i ve safety systems

F i re and Explosion A ssessm ent Process

20

Revi se as sessment and syst em provision

A bandonment

19

Figure 2.4 - Hazard management life cycle

Issue 1

May 2007

Page 75 of 493

M odif icat ion

Operat e and maintain systems t o achi eve cont i nued ef f ectiveness

Operation

18

E nsure personnel are trained and com pet ent t o i m pl ement / operate


Stages of the installation lifecycle

The lifecycle of any oil or gas asset comprises a number of stages: 1. block bidding and license application; 2. exploration and drilling; 3. feasibility studies; 4. concept design; 5. front-end engineering; 6. detail design; 7. construction and installation; 8. hook-up and commissioning; 9. operation; 10. modifications and change (maintenance and repair); 11. decommissioning and removal. Whenever an installation is modified or changes take place, the hazard management process should be repeated to a level of detail commensurate with the change. The hazards associated with decommissioning should, so far as reasonably practicable, be taken into account during detail design. For the purposes of this guidance the stages from 3 onwards are more important and are discussed in more detail in the following section.

2.10.2.1

Descriptions of individual steps in Figure 2.4 1

Identify fire and explosion hazards different concepts

Apply inherent safe design principles

During the review of the alternative development concepts, an identification and coarse quantification of the risks from the hazardous events should be carried out. This information should be used as part of the overall consideration for concept selection and also to optimise the layout and guide the selection of hydrocarbon processing methods for each concept. 2

Set high level performance standard

This is the statement of the standards of the installation as a whole for the safety of personnel. At this stage, Performance Standards may also be defined for major systems such as Temporary Refuge (TR) impairment frequencies, environmental standards and targets for reducing damage to the platform. These would be relevant if the reduction of fire and explosion risks contributes to meeting these targets.

Issue 1

May 2007

Page 76 of 493


Select the concept taking into account risks from all possible hazards including fires and explosions

The selection process should include consideration of the risks of major accidents of the different concepts and the particular contribution from fires and explosions. Attention should be paid to the primary risk contributors and the practicality and cost of preventing, controlling or mitigating tern. 4

Define the design and operational regime - codes, standards and safety management systems

This is the definition of which codes and standards will be used to design the structure, plant and equipment These include the primary prevention measures which ensure the technical integrity of the plant The appointment of the designer and operator/owner management systems including structure and responsibilities should also be defined. 5

Confirm all fire and explosion hazards are identified

Optimise the design to improve the inherent safety

This is the start of the formal assessment of the fire and explosion hazardous events. It may use the output from the conceptual selection studies as a start point. For a new design, the identification of possible hazardous events should be used to review the layout and process design so as to eliminate or reduce all hazards to meet the high level performance standards, concentrating particularly on those hazards which make the predominant contribution to the overall risks. On an existing installation, it may be possible to identity ways of reducing the risks through changes in operational practices.

6

Identify the causes of hazardous events

Verify that the design codes are suitable for the hazardous events and select specific prevention methods

The assessment requires that initiating events are identified. This allows the causes to be identified and a check of the design codes and standards and SMS and operating parameters to ensure that they are suitable to address the causes and adequate to deal with their severity. Where they are found to have shortfalls, the codes and standards may be changed or enhanced. Procedural systems or operating parameters may be changed and, if necessary, new specific prevention measures may be added. This may lead to a further review of previous lifecycle steps, follow feedback loop to Step 4 as shown in Figure 2.4. 7

Determine fire and explosion loadings

Select / optimise control systems to limit the escalation of hazardous events

The characterisation of the hazardous events identifies the size, intensity and duration of representative hazardous events and the contribution of control measures. This enables the most severe events to be identified and their control measures to be enhanced or augmented to reduce their severity. At this point those events to be used as the basis of design for mitigation systems are chosen.

Issue 1

May 2007

Page 77 of 493


Identify vulnerable plant, equipment, personnel and routes to escalation

Select mitigation systems

The plant and equipment which could fail when exposed to fire and explosion in the characterised events should be identified. An assessment of the likelihood and consequence of these failures determines the need for protection and, in the case of existing installations, its provision and adequacy. 9

Define the role and functionality, reliability, availability and survivability parameters for engineered systems

This applies to hardware (engineered) systems and is the definition of the overall purpose of the systems and the essential parameters to be met by the system so that it fulfils its role. The reliability and availability may need some iteration with the escalation and risk assessment in Step 11. For existing installations this may be a formalisation of the original design standards and objectives. 10

Define the role, manning and competence requirements for procedural systems

This defines the role and the essential parameters required to be met by procedural systems. It requires confirmation that the manning and competence levels are or will be available to the extent necessary.

11

Develop fire and explosion escalation analysis and risk assessment

Verify that all hazardous events are addressed, systems are suitable and the high level performance is achieved

This is the overall review of the fire and explosion risks and their acceptability. It formalises the escalation analysis which will have been developing as part of the assessment process. On new designs it is carried out prior to proceeding to detail design to ensure that the proposed systems are suitable for the hazardous event and will be sufficient to reduce, as far as is reasonably practicable, the risks from each hazardous event. On existing installations it is the determination of the adequacy and contribution of the safety systems provided. The cumulative risks from all major accident hazardous events should be within the high level performance standard and ALARP. This information is essential to determining if remedial measures or improvements are needed to the existing or proposed system provision. These results may lead to a review of other lifecycle steps - follow feedback look to Steps 4, 7 or 9 as applicable, as shown in Figure 2.4. 12

Design hardware to meet the requirements

The design contractor and suppliers should co-operate in designing the systems and components to meet the functional parameters and the availability and reliability requirements and ensure that any interactions and also limitations are addressed.

Issue 1

May 2007

Page 78 of 493


Plan future verification

The verification process provides assurance that the design was appropriate and has been properly executed and identifies the schemes by which systems can be fully inspected and tested at appropriate intervals during their life. There is no point in specifying a performance standard which cannot be verified. 14

Develop procedural safety systems

This includes the provision of specific procedures to complement the generic procedures and practices associated with the SMS. On an existing installation, the existence and quality of these procedures should be assessed. 15

Provide/identify procedures and schedules for operation, maintenance and testing

This is to ensure that the systems can be properly operated and maintained and that they achieve the functional parameters. On an existing installation, it is necessary to ensure that these facilities are in place. The tasks may include: •

provision of access;

•

provision of specialist test and maintenance equipment;

•

preparation of effective operation, maintenance and test procedures;

•

setting of maintenance and test frequencies;

•

identification of training and competence requirements. 16

Verify that systems are effective and reliable during commissioning and throughout the installation life

This is function testing which should be carried out prior to installation (at supplier’s works), during commissioning, prior to-start-up, and at predetermined intervals during the system life. The function testing during commissioning will normally cover the full range of expected operational demands, to provide a base line for trouble shooting throughout the remainder of the lifecycle. 17

Ensure personnel are trained and competent to implement, operate, maintain and test systems

This applies both to personnel training and competence for procedural systems and for the operation, maintenance and testing of engineered systems. It may be necessary to prepare training courses and schedules and to have sufficient personnel trained prior to start-up. This applies not only to regular installation personnel but also to individuals who may visit the installation to operate, maintain or test the plant. On an existing installation it may be appropriate to review the training and competence of existing personnel.

Issue 1

May 2007

Page 79 of 493


Operate and maintain systems to achieve continued effectiveness

This requires the continued maintenance and operation of the plant so that the engineered and procedural systems continue to meet their original intent as developed during the design and initial assessment process. 19

Identify and assess any change, modification or deterioration

During the life of the installation, changes may be considered or arise naturally through, for example changes in the produced fluids from the reservoir. Alternatively a safety system may deteriorate so that it is unlikely to continue to achieve its intended functional performance, reliability and availability. All changes should be assessed to determine the effects on the high level performance standards and, where necessary, improvements should be considered to the systems provision. 20

Revise the assessment and system provision

This is the update of the assessment required by a relevant significant change identified in Step 19. It may also lead to a review of the other lifecycle steps affected by the change including the hardware, procedures and documentation and to a revision of the Safety Case. Follow feedback loop to Steps 4, 7 or 9 as applicable, as shown in Figure 2.4. 21

Update assessment and safety system provision to address decommissioning hazards

The design process should have considered likely decommissioning hazards and identified the relevant procedures or systems. These should be formally reviewed prior to decommissioning of either part or all the plant to ensure that all hazards are identified and adequately addressed. Where the existing systems or procedures are deficient, these should be addressed by following the relevant steps in the lifecycle. 22

Decommission the plant using effective safety systems

The safe decommissioning of the plant and eventual abandonment of the installation may be dependent on special hardware or particular procedures. These should be in place and sufficient competent persons should be available to operate and implement them.

Issue 1

May 2007

Page 80 of 493


3 Assessment of and protection from fires and explosions 3.1

Introduction

The assessment of fire and explosion hazardous events is the process whereby these events are identified, probabilities and consequences are determined and a judgement is made on the adequacy of the risk reduction measures. It is an iterative process which, if the arrangements to manage the hazardous events are judged to be inadequate, involves modifying them and revising the assessment. It provides critical information which should be the basis for effective FEHM. The assessment process should be used as a design and operational tool to understand the hazards and hazardous events and to identify when prevention, control and mitigation measures can be applied to reduce the risks. The flowchart Figure 2.4 showed where and when the assessment should provide information into the lifecycle and management process. The timing and detail of the assessment will depend on the stage in the lifecycle, the level of information available at that time, and the frequency and severity of the hazardous events. Those events which result in the major risks to life will deserve the greatest attention, particularly in terms of analysing initiating frequency and consequence.

3.1.1

Constraints on hazard identification

The identification of fire and explosion hazardous events is the start point for the rest of the assessment and of the whole hazard management process. It should use a structured, systematic and auditable approach which addresses both process and non-process fires and explosions and cover all parts of the installation including pipelines, risers and wells. The method employed should be a structured process, which involves a suitable combination of operations personnel, design engineers and safety specialists. The hazard identification process should address all foreseeable fires and explosions and, in particular, those involving releases of hydrocarbons. This process should be fully documented including all of the foreseeable causes of initial release as these should be addressed when identifying the need for specific prevention measures. To structure the process, the installation may be divided into discrete areas in which hazards are identified by considering the process or utilities systems, plant, fixtures, combustible inventory, etc. within each. Potential external initiators of fires and explosions such as a helicopter crash are also important and should be considered. The information required to carry out the initial hazard identification may include the following (as available): •

Operating and maintenance philosophy;

•

Plot plans and plant layouts;

•

Piping and Instrumentation Diagrams (P&IDs);

•

Process Flow Diagrams (PFDs);

•

Equipment lists;

• Process data sheets. •

Other information such as incident statistics or records may also be useful.

Issue 1

May 2007

Page 81 of 493


•

The materials considered during the fire and explosion hazardous event identification phase are likely to include: •

Process oil/gas/condensate;

•

Process additives (e.g. methanol and tri-ethylene glycol);

•

Fuels (diesel, aviation fuel, etc.) and lubricants;

•

Bottled gas (e.g. propane, acetylene);

•

Industrial explosives and detonators;

•

Combustible material (e.g. wood, furnishings, paper, plastics);

•

Laboratory and process chemicals.

In identifying hazards the parameters which define the type of hazardous event should be identified and documented. These may include: •

System pressure;

•

Isolated and non-isolated inventory;

•

Temperature;

•

Density;

•

Composition of material;

•

Likely release points and their size;

•

Flash point;

•

Ignition sources;

•

Combustible load;

•

Oxidising agents.

The fire or explosion events identified will vary depending on the hazardous material involved and the conditions relevant to the particular system or inventory being considered. Typical events are: •

Pool fire

•

Jet fire (combustion of high pressure gas or liquid);

•

Spray fire (combustion of a pressurised liquid release);

•

Blowout

(combustion of a flammable liquid pool);

(wellhead spray or jet fire);

o

Flash fire (combustion of a flammable gas where the flame propagates at a speed insufficient to result in damaging overpressures);

o

Explosion (combustion of flammable gas/vapour in which confinement and/or flame velocities are sufficient to result in damaging overpressure);

o

BLEVE (rapid ignited release of flammable pressurised contents of a heated vessel resulting in blast overpressure, missile fragments and fireball);

•

Cellulosic fire (fire involving material, such as wood, paper, etc.);

•

Electrical equipment fire.

Users of this guidance should decide what information is relevant to their particular needs. Issue 1

May 2007

Page 82 of 493


Selection of the representative design accident events

One of the most important decisions taken in the hazard management process is the selection of hazardous events from which the concept of an upper bound, or envelope, of conditions on which the design of control and mitigating systems are based. The analysis of these events will give the loading parameters for fires and for explosions as listed in Sections 5 and 6. Alternatively the design could be based on standard criteria with the loads from the actual design events being checked at a later stage and compared to the design load. The characteristics of these loadings need to be defined in sufficient detail so that protection systems can be designed to match them. With a new design, the escalation analysis is also important in the selection of the design accident events, together with the perception of the extent and severity of the escalation. As the analysis proceeds, a picture of the range of initiating scenarios and escalating events throughout the platform will emerge. From this overview, it should be possible to select the design events based on the practicality of preventing larger initial events and stopping the escalation of smaller events to those of an extreme magnitude. In particular, a designer would need to consider the following when identifying a design event: •

the scale of the incident relative to the installation size;

•

the options for reducing the frequency of an incident so that the resulting risk is ALARP;

•

the practicality of controlling and mitigating the event.

3.1.3

Consideration of escalation

In addition to the effects of an initial fire or explosion it is important that a structured approach is taken to determine whether and how an event can escalate to endanger personnel. It is also the means to identify all the subsequent failures which would have to occur before personnel are put at risk. The primary objectives of the escalation analysis are to: •

identify mechanisms whereby an initial event may escalate to impinge on key systems or facilities, e.g. the TR and/or evacuation and escape facilities;

•

identify where control or mitigating measures could be used to prevent, delay or reduce escalation or protect life;

•

identify the combination of measures needed to deal with each major hazardous event and to provide an input to the development of associated performance standards;

•

evaluate the effects on the installation safety systems at each stage of escalation and how this may affect subsequent escalation;

•

evaluate the probability and hence the frequency of each escalation path which affects the key facilities or systems such as the TR and Escape, Evacuation and Rescue (EER) facilities and the time duration from the initial event.

This may be carried out as an event tree analysis. This can show the sequence of failures which need to occur to result in a particular level of consequence and give designers and Operator/Owner the opportunity to add, to or enhance the safety systems to break the sequence of events.

Issue 1

May 2007

Page 83 of 493

FIRE AND EXPLOSION GUIDANCE Experience has shown that often only a relatively small number of escalating scenarios contribute significantly to the major accident risk on an installation. Therefore the escalation analysis is an important aspect of hazard assessment and risk management. It is important that the location, frequency, timing and duration of different scenarios previously established are fully considered so that mechanisms and routes by which a fire or explosion could escalate to cause ‘critical failure’ can be identified. This involves identifying those critical components or systems which, if they fail, have significant consequences regarding: •

threat to life;

•

environmental damage;

•

loss of assets (plant/production).

Input data from the previous steps of the assessment include: •

the location and description of the initial event especially its size, severity, duration and frequency;

•

the means by which the initial event may escalate and, at each escalation stage, the corresponding probability and time to escalation;

•

the effects of the events on the installation including the safety systems at each stage of escalation and how this affects subsequent event progression;

•

the contribution of safety systems to reducing the consequences and the probability of their successful operation;

•

the effects on the key facilities or systems such as the TR and EER facilities in terms of impairment, time to impairment and impairment frequency;

•

the fatality levels associated with each scenario.

In assessing the contribution of safety systems, the characteristics of each stage of the event should be considered if it is possible that systems may fail to operate successfully or could be damaged. Such systems may include: •

emergency shutdown;

•

blowdown;

•

active/passive fire protection;

•

detection systems;

•

communications (internal and external);

•

essential control and instrumentation;

•

essential power supplies;

•

drainage;

•

overpressure protection;

•

active/passive explosion protection.

It may also be necessary to consider the actions and decisions of key personnel, in particular the OIM, in responding to an escalating situation. The decision to move personnel to different parts of the installation, to abandon the installation, to fight the fire, etc. and the time at which these decisions are made can have major implications. Issue 1

May 2007

Page 84 of 493

FIRE AND EXPLOSION GUIDANCE The need to take particular decisions should be reflected in the preparation of the Emergency Response Plan and in the provision of communication and evacuation systems. The ability to take decisions may be affected by smoke, heat and the scale of the incident. This should be taken into account, particularly if the TR and control centre are affected. Likelihood is a more appropriate term in this context where a qualitative assessment is being performed, the terms probability and frequency imply that numerical values are available. Therefore, successful installation screening is achieved by early consideration of the vulnerability of the installation and the likelihood of an explosion event.

3.2

Fires on offshore installations

3.2.1

Fire types and scenarios

In order to successfully implement the appropriate protective mechanisms for fire hazards, it is essential (and obvious) to understand what element or area is being protected and what event the designer is protecting against. Therefore, the protective measures can only ever be effective when an assessment is carried out of the potential fire hazards. This step is required by the fire and explosion risk analyses (FERA).

3.2.2

Release events

To establish which fire scenarios should be considered as part of a QRA of an installation, it is first necessary to consider the range of incidents that may lead to an uncontrolled release of flammable material which, if ignited, would give rise to a fire. In this context, relevant questions concerning potential release scenarios are: WHY did the release occur? WHAT is released? WHERE did it occur? The answers to these questions combine to determine the type of fire that may result, the likely size of the fire and its potential impact on people and the installation. Considering each in turn: WHY: The answer to this question will establish the size of the leak and influence the likelihood of ignition. For example, has the leak occurred due to a leaking flange joint or as a result of a preceding explosion event? A range of sizes should be considered from small leaks at flanges and fittings up to major failures of vessels and risers which result in very high release rates. The leak rate may also change with time and may have a limited duration. Failure frequencies for different sizes of event should be taken into account; generally small leaks will be the most common. Release failures should be based on platform specific information where possible, and Duty Holders are encouraged to collect, analyse and use failure rate data based on their own maintenance systems and practices. The reason why a failure is being considered may also influence the likelihood of ignition, for example, if a vessel failure is being considered as a result of a preceding explosion or fire attack then ignition is almost certain, whereas a small leak of high pressure gas generated as a result of a leaking flange may not interact with a potential ignition source. Ignition probabilities also depend on fuel type, for example, a spillage of diesel onto a cold surface is not readily ignited. Issue 1

May 2007

Page 85 of 493

FIRE AND EXPLOSION GUIDANCE WHAT: The nature of substance being released will also influence the type of fire that results. A non-volatile liquid spillage may result in a pool fire whereas a high pressure gas release may produce a jet fire. Apart from process fluids, other flammable substances are likely to be stored and used on an installation for use in service roles. Potential fluids to be considered are: •

Natural Gas – dry or containing condensate and/or water;

•

Condensate – unstable or stabilized;

•

Live crude –possible including a significant amount of water;

•

Transport fuels - Aviation fuel, Diesel;

•

Process fluids – Methanol, Ethylene Glycol;

•

Lubricants and hydraulic fluids.

In addition, some of the gas and oil streams may include hydrogen sulphide, which may require special consideration because of its potential to produce toxic products or be toxic if unignited. WHERE: Where the leak occurs will also influence the type of fire that results. In particular, is the fire likely to be in an open or confined area and what is the potential for the fire to impact onto pipework or vessels that may also contain flammable material, or indeed other critical targets (e.g. other safety critical elements, control systems etc.)? The latter question is important with regard to the potential for incident escalation. Some fires may occur at a location away from the source of the leak, for example, liquid spills which may spread to other areas or even spill onto the sea. The location of the fire will also influence its likely consequences; hence fire scenarios at a range of key locations should be addressed in the QRA. In particular, fires close to where people work which could affect escape routes, Safety Critical Equipment, the Temporary Refuge or key structural components. Having selected and defined a release event giving rise to a fire, this fire and its effects may well change and develop with time depending on the prevailing circumstances. The following factors may affect fire behaviour and/or the consequences: •

ESD: Assuming the ESD operates the volume of the isolatable volumes will affect the duration of the larger leak scenarios and result in a transient fire size, reducing with time.

•

Blow-down: Similar to ESD operation, this could result in a transient release rate. Additionally, blow-down may reduce the consequences of the fire scenario by depressurising a vessel or pipework onto which a fire is impacting, thereby preventing escalation.

•

Confinement: Fires in confined areas with limited ventilation may change over time, for example, become progressively more severe as ‘external flaming’ occurs, when the fire moves through the ventilation openings.

•

PFP: The use of passive fire protection may not affect the nature of the fire but will affect the response of objects subjected to fire attack and delay or prevent incident escalation.

•

Deluge: Depending on the fire type, active water deluge systems (area and dedicated) may affect both the nature of fire and the thermal loading to engulfed objects and in most cases will be beneficial to escaping personnel.

Issue 1

May 2007

Page 86 of 493


Ignition

The likelihood of ignition is clearly an important factor to consider for any QRA and will also be dependent on the answers to the WHY, WHAT, WHERE questions above. Some fuels are more easily ignited than others and the manner of spillage may affect its flammability (for example oil spills onto the sea are often not readily ignitable and additionally are likely to be distant from common ignition sources on an offshore installation. Ignition sources such as electrical fault, electrical arcs (for example across switch contacts), sparks, high temperature surfaces, flames and electrostatic discharge should be considered and the proximity of such sources will vary at different locations on an installation (see Section 3.2.6.8 for a discussion of ignition sources)

3.2.4

Fire scenarios

Given that ignition has occurred, the answers to the WHY, WHAT, WHERE questions above also determine the nature of the initial fire and how the fire may subsequently develop. Typical answers to these questions include: WHY 1.

2.

WHAT

Leaking flange, small fitting or valve Pipework failure from impact or corrosion or preceding event

3.

Equipment failure

4.

Vessel rupture or collapse following explosion, structural collapse or fire event

WHERE •

In open module in open area or congested region

•

High pressure gas

•

Pressurised volatile liquid

•

In confined area

Pressurised gas/liquid mixture

•

Spillage onto sea

•

•

Non pressurised, non volatile liquid

•

From subsea source

By considering combinations of these answers the fire type can be determined. Three examples are as follows: WHY

WHAT

WHERE

FIRE TYPE

1

Leaking flange joint

High pressure natural gas

In an open sided module

Jet fire with potential impact onto pipework and vessels

2

Fire attack on pressurised vessel leading to failure

Gas and volatile liquids

On the installation

BLEVE - fireball

3

Storage vessel failure

Non-volatile liquid

On the installation but liquid spills onto sea

Potential pool fire on the sea

Issue 1

May 2007

Page 87 of 493

FIRE AND EXPLOSION GUIDANCE Considering a range of generic cases, such as those above, the following six fire types are proposed: • Gas Jet Fire – originating from a pressurised gas release on the installation. • Two-Phase Jet Fire – originating from a pressurised release of a flashing liquid or a gas/liquid mixture on the installation. • Pool Fire on the Installation – originating from a liquid spillage. May be static or running depending on the drainage paths or bunding around the source. • Pool Fires on the Sea – originating from a spillage on the installation falling onto the sea, or failure of a sub-sea liquid pipeline. • Gas Fires on the Sea – originating from failure of a sub-sea gas pipeline. •

BLEVE – originating as a result of catastrophic failure of a pressurised vessel containing a volatile liquid.

It should be noted that the behaviour of these fires may change with time as noted in Section 3.2.1, for example, due to the effect of ESD, confinement or deluge. The nature of these fires and their behaviour when interacting with confinement and/or deluge is considered in further detail in Section 5.2. The fire and smoke loadings, issues concerning heat transfer and other details of the fire types are discussed in Sections 5.3, 5.4and 5.5.

3.2.5

Transition between fire scenarios

As discussed above, some fire scenarios may change with time, for example, a fire occurring in a confined space may lead to increasing fire severity with time and the movement of the flame through the vent may produce external flaming. Similarly, some fire scenarios may lead to incident escalation and result in a different fire event occurring as a direct consequence, for example, a jet fire impacting onto a pressurised vessel may lead to vessel failure and a BLEVE fireball event. A liquid spillage may start as a pool fire on the installation but drainage of the spill may ultimately lead to a pool fire on the sea. Therefore, it is important that a QRA considers the potential sequence of fire events and that a fully representative set of events is analysed. The QRA should be supported by a thorough HAZID with input from people with experience of the existing or similar plant or processes.

3.2.6

Fire prevention methods

3.2.6.1

General

The principals of Fire Hazard Management promote a four-part strategy for dealing with the fire hazard, when that hazard cannot be eliminated by inherent safety approaches (see Section 2.7). In order of priority, the remaining steps of the strategy seek to: 1. Prevent or minimise fires at source 2. Detect fires early 3. Control fires 4. Mitigate against effect of fires

Issue 1

May 2007

Page 88 of 493

FIRE AND EXPLOSION GUIDANCE Sections 3.2.6 to 3.2.8 give an outline of the methods available in each of these four categories. In reality almost every offshore installation employs a mixture of all four methods. Good design seeks out the best mix of prevention, detection, control and mitigation methodologies for the specific fire scenarios associated with an installation. There are opportunities throughout the design of any installation to minimise the fire hazard using the four strategies above. Every engineering discipline involved in the design process should be aware of the interaction between their specific discipline input and the fire hazard management for the installation. It is the responsibility of the safety engineer in conjunction with the project manager to engage all the engineers in discussion of fire hazards from an early stage so that no cost-effective opportunities for improvement are missed. This section outlines the options available for preventing or minimising the fire event at source. Sections 3.2.7 and 3.2.8 cover the various options for detection, control and mitigation of fire events once they have already occurred.

3.2.6.2

Methods of fire prevention or minimisation at source

Given that the principal role of oil and gas installations is to produce large quantities of hydrocarbons, complete removal of the fuel source not an option. However there are opportunities for the designers to minimise the potential for large releases of fuel. These are described in the following sections.

3.2.6.3

Minimise inventories

The biggest inventories are in the reservoir, the pipelines attached to the installations and the process vessels. Engineers need to be briefed to consider minimisation of release potential in addition to consideration of production maximisation and cost. They should aim to: •

Minimise inventories between the wellhead and downhole valves;

•

Provide suitably located topsides and subsea isolation valves on all import and export pipelines. Any non-provision of subsea isolation must be thoroughly justified. Justifications must consider all lifecycle phases (especially for NUIs);

•

Size pipelines, vessels and other process equipment to minimise inventory loss in a leak situation as well as meet process requirements;

•

Provide adequate automatic isolation throughout the process system, backed up where necessary with accessible manual isolation valves;

•

Minimise on-platform storage wherever feasible.

3.2.6.4

Optimise layout

Good layout is essential to the overall safety of the installation. Where separation of people from hazardous areas is not possible, provide protection by segregation behind firewalls and attention to escape/egress routes. Key points are: •

Keep living quarters and evacuation facilities away from the process;

•

Provide diverse egress routes from modules and access platforms/decks back to the TR or provide a suitable protected muster point (PMP);

•

Provide grated deck in process areas to reduce pool fire risks;

Issue 1

May 2007

Page 89 of 493


Wherever possible hydrocarbon containing vessels should be bunded and connected to hazardous drains or vents or flare systems designed to remove flammable liquids from the vessel;

•

Ensure that the hazardous drain arrangements are capable of handling releases from the single largest vessel or source based on the range of reasonably foreseeable events;

•

Locate risers as far as possible from the TR & evacuation point;

•

Locate risers and riser valves where other fires or fire escalation cannot affect them;

•

Review the locations and orientations of flanged joints to minimise the location of targets (SCEs or other flammable inventories) within the range of small and escalating jet fires;

•

Small platforms such as Southern North Sea gas platforms cannot provide separation by distance therefore immediate safe egress/escape provision plus sheltered evacuation points are crucial for safety of personnel.

3.2.6.5

Minimise the potential for loss of containment events

•

Minimise the number of potential leak points in the design, particularly flanges and instrumentation connections. However enough valves need to be left to provide for safe isolation for intrusive maintenance. Use of newer design of equipment such as high integrity flanges, valves with integral block and bleed and inherently safer wellheads should be considered.

•

Design for future sand erosion and corrosion by providing for ease of detection, monitoring and replacement.

•

Where facilities and access for routine test and maintenance are not provided on the understanding that such work will only be done during shutdowns, this should be highlighted on drawings and in manuals.

•

Where emergency manual isolation is provided, make sure it is documented in emergency response plans, unambiguously labelled in the field and accessible in the relevant fire scenarios.

3.2.6.6 •

Providing an inert or non-flammable environment

Determine the degree of containment to confirm whether an inert atmosphere is achievable in the specific application, for example: o o •

Issue 1

Completely contained within a pressurised vessel; Completely contained but within an open vented atmospheric vessel/tank.

Determine the required supply of inerting medium, e.g. the degree of inflow and outflow required for all operating conditions, for example offloading requirements or inerting an area with opening/closing doors (such as filling a Temporary Refuge with lower oxygen content media, see next bullet point).

May 2007

Page 90 of 493


Review the non-flammable media available for application, considering the use of the areas and volumetric flow rate requirements, the media may include: o o o o

o

Nitrogen; Over-rich (i.e. above Upper Flammable Limit) fuel gas; Cleaned combustion gas; Low oxygen content media (such as Inergen, a proprietary product with insufficient oxygen to support combustion but adequate oxygen content to maintain life); Carbon dioxide.

•

Consider the preferred delivery option, whether the media can be generated on the installation (e.g. Nitrogen Generator) or whether it is desirable to be brought on board.

•

Review the media for their own hazardous effects in the context of the potential applications. Avoid all but the lower oxygen content media in areas where personnel without breathing apparatus may be, ensuring that the lower oxygen content media are suitable for occupied areas. Identify any time limits on occupancy or minimum health and fitness criteria with the media supplier.

•

Confirm that the layout does not contribute to or exacerbate migration of the media to sensitive areas, for example carbon dioxide being heavier than air will flow down hill, therefore, recessed areas for valve or equipment access could capture the CO2, especially where personnel could access as part of recovery work after the emergency.

3.2.6.7

Minimise the time to ESD and blowdown

•

ESD should be designed to occur immediately on detection of a release event. ESD should move the plant to a safer state. Designers need to check whether the ESDV locations minimise ignited release consequences rather than just reducing leak size.

•

Rapid blowdown or draining of topsides process inventories in order to prevent escalation of a fire situation should be provided unless there are specific good reasons for not doing so (e.g. very small topsides process).

•

The code-based design approach of providing blowdown to 7 barg or half design pressure in 15 minutes should no longer be automatically assumed adequate. Blowdown should be designed in the light of the specific escalation times for each fire scenario and generally be as fast as feasible once activated, (see Sections 7.7.4 and 7.7.5 for more details on blowdown systems).

•

Where only a manual blowdown capability has been used – the designer and Duty Holder must justify the choice of system with respect to the identified major accident hazards, the design and operating philosophy must be clearly recorded for the intended user and all operational and maintenance details must be documented or referred to in the emergency response instructions for the installation.

•

Blowdown must be to a safe location with respect to personnel, bearing in mind the likelihood of spurious blowdown events as well as real emergency events, and designed such that the heat radiation for maximum foreseeable flaring (or ignited venting) rate does not pose a hazard to escape and evacuation.

Issue 1

May 2007

Page 91 of 493


Minimise ignition sources

•

All electrical equipment in hazardous areas shall be certified. This is to cater for ‘fugitive’ leaks in accordance with hazardous area design codes.

•

The dispersion distances for such leaks, from which the hazardous zones are calculated, do not cater for major accident releases.

•

A gas cloud from a medium or large leak can, and will, drift outside hazardous area limits. Therefore caution must be exercised in locating unclassified equipment such as generator sets, temporary pump skids, heating equipment etc in ‘safe’ open locations around the installation.

•

The ignition-prevention philosophy for the platform should explain how the ignition risk is minimised.

•

Plant should be suitably earthed and all operators trained in awareness of offshore static spark risks (a recurring cause of fires).

•

Equipment which provides an ignition source and is unacceptably close to release sources should either be located inside an enclosure with ventilation ducts that close off automatically on detection of gas, or be provided with some alternative form of protection.

•

Certified electro-mechanical equipment (e.g. diesel generators) requires careful maintenance in order to retain its certification and is a significant operating expense.

3.2.7

Gas and fire detection and control methods

3.2.7.1

Detection of loss of containment events

Early detection of loss of containment events is crucial. Detection should always trigger limitation of the leak by rapid automatic isolation it should simultaneously alert personnel to the danger. Since it is difficult to automatically detect liquid oil leaks (although oil mist detectors can detect higher pressure liquid leaks), historically reliance has been placed on detection of the associated gas. Most installations have hundreds of sensitive detectors in place. In order to prevent spurious shutdowns and un-necessary platform alerts, most installations have a two-tier alert system. Typically, under this system, a single low-gas-level alarm alerts staff in the control room to a potential problem, which is immediately investigated but no shutdown or general alarm is initiated. One single low level gas detection is more likely to be a false alarm than a real gas release. If a second alarm in the same area then occurs or if a high-gas-level alarm goes off, then this is indicative of a real release rather than a false alarm. The fire and gas system voting interprets 2 or more low-level or 1 or more high-level alarms as ‘confirmed’ gas releases. This automatically initiates platform alarms and shutdowns. Confirmed gas detection should always initiate immediate, appropriate executive action in the form of shutdowns and, where applicable, blowdown. Most platforms have between 2 and 5 levels of shutdown, depending on the extent of the detected release. A system which requires operations personnel to walk into a gas-release scenario in order to investigate before initiating shut down of the process system is potentially dangerous and no longer acceptable. Personnel should never be asked to enter a gas-cloud for the purposes of investigation or manual action – they may be rendered unconscious by the un-ignited gas or be engulfed in flame if the cloud suddenly ignites. Where one person is missing, more people are exposed Issue 1

May 2007

Page 92 of 493

FIRE AND EXPLOSION GUIDANCE through search and rescues attempts and the evacuation process becomes delayed. The detection system should instead be designed to give remote indication of the development and/or migration of the release thus allowing personnel to stay well away from danger. Once the fire and gas panel shows the situation is sufficiently under control then cautious, upwind approach from a position of safety can be attempted. There are many different types of gas detector available. All have their strengths and weaknesses which are explored in the table below. All installations, modern and old, use a combination of different methods in order to cover the range of duties necessary. The approach to the detection of flammable gas has moved away from trying to detect all leaks and now concentrates mostly on the following three distinct criteria:1. The detection of gas clouds of a specific size and LEL (i.e. 5 metres, 50% LEL cloud) 2. The detection of gas leaks also of a specific size (i.e. 0.1kg s-1 to 2.5 kg s-1) 3. The detection of gas at the HVAC intakes to areas containing potential sources of ignition (TR, turbine enclosures, etc.) The basis for the specific cloud size and gas leak size are established by specialist analysis/modelling of the areas. The systems are generally not concerned with the detection of fugitive gas leaks, except in some special cases. Performance Standards are used to set the initial design conditions to be met by the various detectors (see Section 2.3). Table 3.1 - Summary of methods of gas detection Method of gas detection

Strengths

Weaknesses

Single point Pellistors These detect the presence of gas when it reaches a detector head. They are good at detecting accumulations of gas.

Well-understood item. Good designs should allow gas clouds to be tracked, as they drift through areas of plant, from the safety of the control room.

Susceptible to ‘poisoning’ of the catalyst by oil-spray and contact with other chemicals. Always check proposed site and contamination issues with manufacturer. They generally require a high level of maintenance due to drift, and recalibration due to poisoning, as these detectors do not automatically provide indication of a faulty pellistor. Very large numbers are required to adequately cover a typical fire zone. Not preferred on new or upgraded installations.

Have historically been used for detection of gas in air supply ducts to enclosed areas containing unclassified electrical equipment or other potential sources of ignition but not recommended now IR, beam detectors available.

Location in an air intake duct is an arduous duty for this type of detector Executive action occurs on 2oo3 voting. Access for frequent maintenance and testing is essential. I/R point detector with duct probe or I/R open path detector are now available, and better, for this service.

Issue 1

May 2007

Page 93 of 493

FIRE AND EXPLOSION GUIDANCE Method of gas detection

Strengths

Weaknesses Not very effective for small leaks in open areas. In this situation use in conjunction with acoustic detectors. Susceptible to drifting if not regularly checked and maintained, leading to unnecessary shut-downs. Unless the gas comes into direct contact with the detector head it will not operate so numerous detectors, suitably located are required. Vapours heavier than air require detector location at floor level. For natural gas releases, detectors need a high level location. Must be calibrated and located appropriately for the vapours they are designed to detect. Calibration settings for LNG (methane), LPG (propane), condensate and hydrogen are all different. Heavier or lighter than air gases require increased numbers of detectors and present difficulties positioning to avoid damage at low level and maintenance access at high level.

Note: On older installations where there is heavy reliance on pellistor type detectors, consideration should be given to setting the devices to give initial (low level) alarm at a levels just above the anticipated drift range of the device and high level alarm slightly above that. Operators have found that alarm at 10 to 20% LEL and executive action at 25 to 40% is feasible for a well maintained system. This gives an added margin of safety while avoiding nuisance alarms. Different set points will be necessary for different applications. The suitability of the set point each application should be documented, and not automatically assumed to be 20 % LEL for low level and 60 % for high level alarm. IR point detectors

Issue 1

Very good at detecting flammable gases at potentially known locations. Very little maintenance or calibration required during the life of the detector (in excess of 5 years). These detectors are least sensitive to methane, so when calibrated for methane will also detect other gases i.e. propane, butane etc more readily. This type of detector is good for confined areas, ducts etc (with a duct probe unit).

May 2007

Not good as the prime detector type for open process areas as large numbers of detectors would be required.

Page 94 of 493


Strengths

Weaknesses

IR Beam (open path) detectors. These detect the presence of a cloud of hydrocarbon gas between a detector head and its reflector

Very good at detecting gas clouds in open process areas, effectively taking the place of numerous point detectors. Very little maintenance necessary, but this can be achieved by one man with an interrogator tool. Not susceptible to poisoning. Detectors can be sited at the boundaries of modules of fire zones to provide economic coverage of large areas, providing good information on gas migration. Care should be taken when subsequent work is being carried out on the installation, when there might be the potential for blocking beams by scaffolding, sheeting for weather protection or painting.

Some early versions could be activated by adverse weather, especially rain and fog and vibration

Leak detectors (acoustic) These detect the noise made by any significant leakage from a high pressure gas (whether flammable, toxic or inert) system.

Will detect any significant leak in vicinity without contact with gas therefore large numbers of detectors not necessary. Usually only two or three detectors are required in a typical process area.

Area mapping of background noise is necessary to enable the correct alarm setting to be established. These detectors need to be located with easy access for routine testing. These detectors will detect a high pressure leak of any gas, whether hydrocarbon, air, N2, CO2 etc. Hence caution is necessary when arranging the shutdown logic and when placing the detectors, with respect to any regular discharges of air (such as near air compressors). Discussions with equipment vendors should be initiated to understand the frequency range over which the detectors will work.

Note: There has been reluctance by the industry to embrace acoustic detection. It is still regarded with suspicion as ‘new technology’ despite nearly ten years of successful use in the Southern North Sea.

Concerns about spurious activations by background noise can be averted by designing in recognition of other noise signature in vicinity and possible use of pre-set time delays before alarm initiation. Initial calibration of detectors in their designated location is essential.

Manual

Personnel should always be vigilant and report small leaks for Investigation, repair and monitoring. Most small leaks are still detected manually especially on open design platforms

Issue 1

May 2007

Page 95 of 493


Strengths

Weaknesses

CCTV (see under CCTV in Table 3.2)

Cheaper and readily fitted especially on large installations or on extensive process areas. Allows operator judgement on how to deal with the situation.

Visibility of large gas releases depends on numerous process, release and atmospheric variables. Small gas releases would not generally be picked up.

3.2.7.2

Additional notes on detector types

Infrared detectors An infrared gas detector consists of an infrared source and an infrared detector. When flammable gas passes between the source and detector, the gas absorbs infrared radiation and lower radiation intensity is registered at the detector. Specific gases are detected by measuring the amount of absorbed infrared radiation at specific wavelengths; the difference is related to the concentration of gas present. Infrared detectors will not “poison” and can operate in inert atmospheres. They can be used in confined spaces where oxygen depletion might have otherwise limited the effectiveness of a pellistor detector. Infrared detectors are fail-safe, a detector that is obscured or has failed registers zero infrared radiation and the alarm signal is activated. IR detectors are available in either a fixed-point format, in which the gas diffuses into the detector or in an open-path format where the source and detector are separated (thus a line of sight detector). Pellistor detectors A pellistor detector consists of a matched pair of elements, one of which is an active catalytic detector and the other an inactive compensating element. Flammable gas contacting the catalytic surface of the detecting element is oxidised causing a rise in temperature of the active element, this rising temperature increases the resistance of the active element. There is no such change in the compensating element and the output signal of the detector is based on the imbalance between the two resistances. Pellistor sensors can give accurate readings under adverse environmental conditions as changes in ambient temperature, humidity or pressure will impact both elements. Pellistors can be poisoned or inhibited by silicones, sulphides, chlorine, lead and halogenated hydrocarbons. The detectors require regular cleaning and calibration, (with an impact on maintenance costs). Pellistor sensors also require the presence of oxygen in order to operate. Detection of fire events Early detection of fire is crucial. The earlier a fire can be detected the earlier personnel can be warned and steps taken, both automatic and manual for containment and control. There are many types of fire detection device available on the market. No one device covers every fire situation. The uses, locations, strengths and weaknesses of the most common types are outlined below

Issue 1

May 2007

Page 96 of 493

FIRE AND EXPLOSION GUIDANCE Table 3.2 -Summary of methods of fire detection Methods of Fire Detection

Strengths

Weaknesses

Ionisation Smoke detectors detect the visible and invisible products of combustion as they come into contact with the detector.

Widespread use in enclosed areas such as accommodation ceiling voids, electrical equipment and control rooms. The detectors can be wired in series with up to 20 detectors on one loop. These detectors have a high resistance to contamination and corrosion. They are available in a wide range of versions to suit different needs.

Not effective in open modules, as the smoke is usually dispersed before reaching detector. Not advised for use in areas where some smoke is expected in normal operation e.g. above cookers. Care is needed with disposal since they contain a minute radioactive source

Optical Smoke detectors detect only visible smoke and rely on the ‘light scatter’ principle

Widespread use in enclosed areas such as accommodation modules. The detectors can be wired in series with up to 20 detectors on one loop. These detectors have a high resistance to contamination and corrosion and are available in a wide range of versions to suit different needs.

Not advised for use in areas where some smoke is expected in normal operation e.g. above cookers.

Alert personnel to the incipient development of a fire situation e.g. behind instrument panels, especially in unmanned control rooms or in cable routes. These detectors are particularly suitable in areas with high air flow ventilation. The very early warning allows personnel to enter the room to investigate and/or isolate power supplies without undue exposure to risk.

These are being widely used to replace Halon systems removed from control rooms, MCC or switch-rooms. They can be alarm only, or wired to the F&G control panel for executive actions and/or shutdowns. These systems are relatively high unit cost and there are additional maintenance requirements for checking and keeping air-sampling tubes clear.

Smoke Detection:

VESDA (Very Early Smoke Detection Alarm) or HSSD (High Sensitivity Smoke Detection) These pull air samples from areas susceptible to electrical fires to a small analyser and check for smoke or pre-combustion vapours.

Issue 1

May 2007

Page 97 of 493

FIRE AND EXPLOSION GUIDANCE Methods of Fire Detection

Strengths

Weaknesses

IR flame detection

Widely used and well understood. Used to detect the infra-red wavelengths of hydrocarbon flames. Typically 4 to 16 detectors would be needed to cover a module depending on module congestion and dimension.

Detect ‘yellow’ flames, but weak on bluer flames (e.g. methanol fires). Vision of units can be obscured by smoke or equipment (especially forgotten ‘temporary’ items). Often used in combination with UV detectors where several types of fire can occur in one module. Generally specialist mapping techniques are used to optimise detection and ensure adequate coverage is achieved. To avoid spurious alarms higher numbers of detectors are required to provide voted logic. Spurious alarms may occur from other, non-fire IR sources, so not suitable in areas where ‘black body radiation’ occurs.

UV flame detection

Widely used and well understood. Used to detect the Ultra-violet wavelength of a flame spectrum. Typically installed under turbine/compressor hoods.

Detect the bluer flame types. As for the infra red detectors, solid objects or smoke will obscure the cone of vision, reducing the effectiveness of the detector. The lens of each detection unit needs regular checking for dirt build-up which prevents effective operations of the device.

Video flame detector (makes use of specialist flame imaging technology)

Very good at detecting flaming fires. Sophisticated versions can be set up to mask out known flame sources e.g. platform flare. These can provide conventional alarm signals plus a video image if required. Possibly the way forward for ‘Green field’ projects.

Unit cost may be high but fewer units required to cover a typical process area.

Fusible bulbs

These bulbs break at a pre-defined temperature and raise an alarm/ESD. They also usually either release water directly or release air to activate deluge systems. This system does not rely on electrical power for satisfactory operation and deluge release.

A these devices require a heating effect that causes failure, dependent upon their relative location with respect to the fire, they may take significant time to detect a fire (for example compared with optical (IR/UV) detectors). By the time the bulbs operate, significant damage may have been done. The bulbs may also subject to physical damage and corrosion which could lead to false alarms. An extensive pipe network is required (linking the bulbs to the detection system) to provide coverage of full module.

Flame Detection

Issue 1

May 2007

Page 98 of 493


Strengths

Weaknesses

Fusible links

These melt at pre-defined temperatures to raise an alarm/ESD by breaking a circuit. Some directly initiate release of hydraulic fluids to close safety valves on wells or risers.

As above for fusible bulbs.

Fusible plugs

These melt in fire situations to send an alarm signal and release hydraulic fluids thus closing well and riser safety valves.


Rate of heat rise

Detects rapid temperature change. Useful in areas with temperature fluctuations. Highly reliable as a single detector, confirmed fire signal.

Rate of heat rise - Rate Compensated

Detects temperature change. Highly reliable as a single detector, confirmed fire signal

Fixed

Detects a pre-set high temperature. Based on thermocouple design. Highly reliable as a single detector, confirmed fire signal. Gaining in popularity and reducing in price with time.

Conventional CCTV used to supplement traditional fire and gas detection devices

Not as fast reacting as the rate-ofrise detectors.

Systems with good coverage can be expensive to install and maintain.

Particularly good for checking alarms in remote areas such as column bases on semi-subs. Allows escape routes from TR to evacuation points to be checked and state of fire development in process areas without exposing emergency response personnel to danger.

The reliability of the fire and gas detection system needs to be designed in at the outset of design and then maintained at a high level of reliability and availability throughout the platform’s operational phase. Best practice for new designs relies on good levels of redundancy in the electronic system architecture (usually dual or triple redundancy) and will include the following characteristics: •

Electrical fault monitoring to detect any electrical discontinuity faults which have occurred in the system. Fault alarms should not be cleared until the fault is investigated and removed;

•

Significant redundancy in field devices;

•

Fire and explosion survivability for detectors and cabling;

•

Uninterruptible power supply.

Issue 1

May 2007

Page 99 of 493

FIRE AND EXPLOSION GUIDANCE The required target reliability of the Fire and Gas detection system must be specified by the Project team to the manufacturer at the outset of the system design (if not already specified in the invitations to tender). It will be difficult (and extremely expensive) for anyone but the manufacturer to produce the reliability figures once the system is already built. As part of the current application of IEC 61508 [3.1] or IEC 61511 [3.2] (the latter being the requirements and assessments of safety instrumented systems in the process industries sector), the reliability and failure modes of instrumented safety systems must be considered along with hazard probabilities and demand rates. Guidance on assessment techniques and avoidance of failure modes can be found in this document.

3.2.7.3

Control methods

Fires that have not been prevented should be detected and then controlled to reduce the size, duration, and escalation potential of the fire. The following control methods are commonly in use offshore. All platforms are different, but many of these control methods will be relevant to most installations. Note that extinguishants and manual firefighting are considered below as control methods. Deluge systems and passive fire protection methods are classed as mitigation methods because they generally protect against the impact of an existing fire rather than working to control the fire itself. The mitigation methods are addressed in Section 3.2.8. Some typical fire related operational and design considerations are provided for each control method in Table 3.3 below. Table 3.3 - Summary of methods of controlling fire Control method

Control mechanism

Fire related design considerations

Process Emergency Shut Down Valves (ESDVs)

Automatic Reduces inventory available to leak or fire by isolating process into separate, smaller, segments.

Ease of testing and maintenance. Regular test of process ESDVs often neglected. Specify and justify test interval and acceptable leak rate as part of design. Record in performance standard documentation In fire situations several ESDVs plus adjacent pipework may be engulfed at one time, releasing several inventories to prolong fire. ESDVs are frequently used at module boundaries to prevent inventories from one module feeding a fire in another, these divisions then match the designated fire areas and their associated firewater coverage. Where no such boundary isolations are in place, it becomes possible for hydrocarbon which is stored in one module to be released into another module and fuel escalation of further fires..

Riser ESDVs – (Topsides and subsea)

Automatic - Isolates platform from pipeline inventories at the topsides. Note that riser ESDVs are a requirement in the UK Continental Shelf under the Pipeline Safety Regulations.

Topsides valves to fail close Locate away from process fire areas wherever possible. Protect valve and exposed riser sections against foreseeable fire scenarios Always consider benefits of subsea pipeline isolation, even a simple NRV may provide significant risk reduction. Justify and record basis of decision.

Issue 1

May 2007

Page 100 of 493

FIRE AND EXPLOSION GUIDANCE Control method

Control mechanism


Sub-sea Isolation Valves (SSIVs)

Automatic - Isolates platform from pipeline inventories at a defined distance.

Topsides valves to fail close Locate away from supply vessel routes, incoming jack-ups and other potential sources of dropped objects or dragging anchors. Locate the valve such that uncontrolled events just the far side of the SSIV will not pose a radiation problem for the installation, distances are often of the order of about 250-350m.

Well head and downhole isolation valves

Automatic - Isolates platform from reservoir inventories

Surface and downhole valves to fail close on confirmed fire or gas release event.

General Platform Alarm (GPA)

Automatic - Removes people to place of relative safety

Any prolonged fire necessitates evacuation as a precaution OIM and deputies must understand escalation mechanisms and timeframes for all emergency scenarios in order to be able to make competent decisions.

Blowdown and blowdown valves (BDVs)

Automatic or manual Removes gases to flare or cold vent See also Section 7.7 for a general review of Process Responses See also Sections 5.5.1.9 to 5.5.1.12 and 7.7.2 to 7.7.5 for details on how the approach described in ISO 23251:2006 [3.3] impacts blow down rates and subsequent consequences.

BDVs to be fail-open, unless this endangers helicopter operations and pre-warning not feasible. Automatic facility recommended. Any manual arrangements need clear and detailed instructions for operation to offshore staff. Appropriate blowdown time to be developed from escalation scenarios

Process facility

drain

Automatic or Manual Removes main liquid inventories from vicinity of fire to a safer location (e.g. cellar deck surge tanks)

Usually manual facility Consider vulnerability of dump line route Consider time required for draining

fire

Manual fire intervention with hydrants, fire hoses, foam monitors, extinguishers etc

Appropriate for very small fires - Immediate intervention on discovery of small fire can prevent fire taking hold. All personnel trained for small fire intervention. Fire fighting, equipment cooling and helideck fire control only possible where trained fire teams available. Effectiveness depends on understanding of installation-specific fire and escalation scenarios and plus realistic offshore exercises. Note that even with training, fire fighting teams that remain to fight a fire will be at greater risk. Comparative risk issues must be understood and precise criteria defined to limit fire fighting team’s exposure.

Manual fighting

Issue 1

May 2007

Page 101 of 493

FIRE AND EXPLOSION GUIDANCE Control method

Control mechanism


Remote manual fire fighting

Initiation of fixed or oscillating fire monitors, with or without foam.

Often used on helideck or open upper or weather decks. May be affected by strong winds.

Inerting agents

Prevents fire from starting/taking holds by rendering the atmosphere inert – Inergen ©, CO2 etc.

Useful in enclosed, remote spaces difficult to access in fire situations (e.g. pump rooms in semi sub or ship hulls) Static discharge may ignite atmosphere, causing explosion – check potential with vendor. Inerted atmosphere may not be breathable so warnings and pre-discharge alarms required.

Extinguishants

Stops fire burning by preventing oxygen reaching fuel, removing heat, or otherwise interfering with combustion process – watermists, foams, some types of deluge etc

Useful in enclosed spaces such as machinery enclosures Deluge and fuel/water wash-off needs weightcontrol consideration, particularly on floating installation.

Foam application

Reduces evaporation of vapours. Creates film/foam to prevent oxygen reaching liquid fuel thus reducing, or extinguishing pool fire.

Suitable for contained liquid fires. Less effective on running pool fires, not effective on jet fires

Dirivent systems

Disperses very small leaks to prevent flammable cloud build-up.

Only effective for fugitive (very tiny) leak scenarios System shuts down on in major release scenarios as may spread leak and mix release to flammable concentrations.

Other systems

Provides air exchange within an enclosed area to prevent or slow flammable cloud buildup.

System needs special attention to be able to provide adequate air flow rates and be safe, i.e. to not introduce any ignition sources and also not move the fuel/air mixture to other areas hitherto safe within the context of the originating accident.

Bunds

Control spread releases

liquid

While bunds can contain a liquid release/fire, they can also concentrate a fire around the equipment in the bund and should be used in conjunction with foam. Design must ensure deluge does not cause bund overflow by being sized for maximum foreseeable liquid volume release.

Drains

Remove liquid and deluge releases to drain system.

Small releases are usually within drain system capacity. The drain capacity needs to be capable of removing maximum foreseeable liquid volume release although the effects of burning liquids in the drain system must be checked. Sea-fire possibilities and consequences need checking In emergency scenarios environmental issues become secondary to preservation of life.

Issue 1

HVAC

of

May 2007

Page 102 of 493


Methods for mitigating the effects of fires

3.2.8.1

Firewalls

Dedicated firewalls are often used to physically separate fire areas. The basis of the separation and the specification of the firewall are dependent upon both the fire types and severities identified in the “fire hazard” area and the vulnerabilities of the equipment, systems or personnel in the area being protected. There are several grades of pre-defined firewalls and a fire risk analysis will generally choose an acceptable defined standard rather than develop a bespoke standard (unlike designing a blast wall for explosion hazards). Some of the general terms for firewall specifications are described below. Firewalls’ continued performance is highly dependent upon the preceding and succeeding events, not least how their integrity is maintained following an explosion event. These and other interaction issues with explosion hazard management are discussed in more detail in the section on Interactions between fire and explosion hazard management.

3.2.8.2

Class A-0 division

A division formed by a bulkhead or deck that is constructed of steel or an equivalent material and suitably stiffened. It should prevent the passage of smoke and flame after 60 minutes of exposure to a standard fire test.

3.2.8.3

Class A-60 division

A division similarly constructed as A-0 and is additionally insulated with non-combustible materials so that, if either side is exposed to a standard fire test, after 60 minutes the average temperature on the unexposed face will not increase by more than 139 °C above the initial temperature and also that the temperature at any point on the unexposed face, including any joint, will not increase by more than 180 °C above the initial temperature.

3.2.8.4

Class B-15 division

A division formed by a bulkhead, ceiling or lining that is constructed and erected entirely from non-combustible materials and prevents the passage of flame after exposure to a standard fire test for 30 minutes. It is insulated so that if either face is exposed to the first 30 minute period of a standard fire test, the average temperature on the unexposed face will not increase at any time during the first 15 minutes (of that test) by more than 139 °C above that initial temperature. The temperature at any point on the unexposed face, including any joint, will not increase by more than 225 °C above the initial temperature after exposure for 15 minutes.

3.2.8.5

Class H-120 division

A division similarly constructed as A-0 and is additionally constructed to prevent the passage of smoke and flame after exposure to a “hydrocarbon fire test” for 120 minutes. It is insulated with non-combustible material so that, if either face is exposed to a hydrocarbon fire test, after 120 minutes the average temperature on the unexposed face will not increase by more than 139 °C above the initial temperature and also that the temperature at any point on the unexposed face, including any joint, will not increase by more than 180 °C above the initial temperature.

3.2.8.6

The “standard fire test”

The "standard fire test" is a test conducted in accordance with Regulation 3.2 of Chapter II-2 of International Maritime Organization International Conference on Safety of Life at Sea [3.4]. Issue 1

May 2007

Page 103 of 493


The “hydrocarbon fire test”

The "hydrocarbon fire test" is a test in which a specimen division which resembles as closely as possible the intended construction and includes (where appropriate) at least one joint and has an exposed surface of not less than 4.65 m2 and a height or length not less than 2.44 m, and is exposed in a test furnace to temperatures corresponding approximately to a timetemperature relationship defined by a smooth curve drawn through the exposed test temperatures (indicated below), measured above the initial furnace temperature.

3.2.8.8

Temperature point

Time interval (N minutes after start of test)

Exposed test temperature (increases in °Celsius)

1

3

880

2

5

945

3

10

1032

4

15

1071

5

30

1098

6

60

1100

7

120

1100

Penetrations and closures in firewalls

Where a firewall of any class is pierced for the passage of electric cables, pipes, trunks or structural elements or for other purposes, the “penetration” must be arranged so that fire resistance standard of the division is not impaired. Similarly, any openings such as doors or other access hatches must match the integrity of the division when closed and in the case of doors be self-closing.

3.2.8.9

Passive fire protection methods

Passive methods are preferred where specific protection of critical process or structural items is needed in order to prevent escalation. Widespread application to process and structural items is not generally feasible due to weight, inspection and maintenance/replacement issues. Modern design philosophy is to identify specific areas or items of concern (usually structure or piping which on failure would escalate the initial event) and target these items for PFP application. PFP is preferred over deluge in such situations since it is immediately available and has no moving parts to fail and prevent operation. If properly applied/installed it is highly reliable in service. However it has also been the cause of problems in the past so current best practice concerning the design and application of such systems, is discussed below. Passive fire protection (PFP) comes in many forms, but the object is always to provide some sort of heat insulating barrier between the fire and the item to be protected. PFP can be designed for use on vessels, pipework, structural members, boundary walls or individual items of safety critical equipment. The objective is to prevent the protected item heating up and either losing strength, losing function, distorting or producing noxious fumes. Previously the design emphasis was on application of codes and rules. For example, accommodation block were given A60 walls regardless of the fire risk to the accommodation. Issue 1

May 2007

Page 104 of 493

FIRE AND EXPLOSION GUIDANCE Now, best design is to design all PFP systems to be appropriate to the specific fire scenario for which the PFP is required. PFP can be effective in protecting against high pressure jet fires whereas deluge is not The system is usually designed by the PFP supplier’s engineers to the scenario-based specification of the relevant discipline engineer (process, structural, mechanical or instrument as appropriate for the item being protected) and the safety engineer. For any of the systems outlined below it is up to the designer to demonstrate initial suitability of the PFP system to the IVB and HSE, and the duty holder to maintain the protection throughout the lifecycle. For some of the common systems initial suitability is easy to demonstrate since the manufacturer will have a standard fire test certificate (such as A60, B15, or H120) for the proposed system. However for some of the newer products, or existing products in severe or novel applications such classification is not easy to obtain and the demonstration of suitability will have to be via specially devised fire tests or research. Some considerations around standard fire tests are discussed in Sections 7.2.1 and 7.3.2 of this Guidance. The following types of PFP are in current use and their uses and drawbacks are discussed in the paragraphs below and further in Section 4.4.2.

3.2.8.10

Cementitious or vermiculite type

These are heavy mineral-based based coatings which can be applied to walls, structure or pipework in a wide variety of ways from spraying or trowelling to bolting-on of pre-formed sections. They have been used extensively offshore since the 1970s. There are many different types available. The thickness of the coating principally determines the time it takes to transfer the heat through the coating and the mechanical strength of the compound or sometimes an extra outer shell, determines whether the coating will withstand the physical impact of the fire, for example erosion from jet fire impingement or pressure waves from explosions. Since the properties of cementitious or vermiculite coatings are well researched and many applications have been extensively tested, classification of the protection is relatively easy to obtain. Some systems have been tested and found capable of withstanding the impact of high pressure jet fires. In the 1980s and early 1990s the biggest problem with use of these coatings was that the offshore installation process was carried out poorly. Many poorly applied coatings fell off after a few years. Deluge water found its way beneath coatings and the fixing pins or protected items (particularly where they were warm) corroded rapidly. Some coatings just disintegrated with time. Products have improved significantly since the early 1990s and recent experience has demonstrated that provided these systems are installed in full compliance with the manufacturers’ instructions, there are few problems. However it is difficult to exercise control over application in the offshore environment, especially in exposed areas and below main deck levels. Therefore, wherever possible for new designs, coatings should be installed onshore under controlled conditions before float out. Removable PFP, in the form of enclosures or blanket wraps can be removed to allow corrosion checks and inspection/maintenance of protected equipment. However, removable systems are not practical in many places, being generally heavy, costly and requiring space.

Issue 1

May 2007

Page 105 of 493


Intumescent coatings:

Intumescent paints and coatings work by expanding to many times their original thickness on exposure to high heat or flame to produce a fire resisting, thermally insulating coating or ‘char’. Like the mineral-based coatings discussed above they are available in a variety of forms to suit a wide variety of applications from protection of deck undersides to sealing of piping or cable transits. The possibility of corrosion under PFP coatings is a major concern for designers. For new builds it is possible to plan for future inspection through the coating, out as explained below. Retrofitted systems remain problematic. Although intumescent coatings can now be applied in fairly thin layers, use in underdeck or other exposed areas and particularly in the splash zone usually requires a thin neoprene layer under the coating and another on top to prevent external corrosion and protect the coating. Any such thick or composite coating makes subsequent NDT inspection results extremely difficult to interpret. It would be possible to plan for such NDT inspection if the designer specified at the outset that sample pieces of steel were taken and kept, coated and uncoated, for calibration purposes. This would allow results to be interpreted with more confidence. For retrofitted systems, without these calibration aids, effective NDT through PFP coating systems is not practically achievable at present. Research continues but no viable methods exist at present. Wet-applied intumescent coatings often shrink slightly as they dry out, and they usually give off toxic gases when they intumesce. The effects on adherence to substrate plus the migration of toxic gases to affect personnel need taking into account during design. As for the cementitious PFP, proper preparation of surfaces to be coated with intumescent PFP is essential for long-term performance. Intumescent systems can be specified to provide fire protection for anything from minutes to hour, and many systems have been through fully documented testing. Both cementitious and intumescent coating systems are continually changing and developing so details are best obtained directly from the manufacturer. Further discussion of common types of PFP application, such as PFP in firewalls, enclosures, flexible wrap systems etc is provided in Section 10.3.2.2 on passive fire protection systems.

3.2.8.12

Weathered and cracked PFP

Since much of the PFP in existence on offshore installations at the current time is suffering from ageing, 2 separate projects have been initiated. HSE and HSL are continuing a programme started by Shell which will report on the effects of 10 years of weathering (and ageing) on the fire resistance of PFP. A joint industry research project is underway by MMI to determine which types of damage to PFP are most critical and what are the most effective repair methods. At the time of issue of this Guidance, both projects were still set to publish. In addition, ageing, weathering or other damage to PFP can cause a loss of water-tightness and thus lead to water penetration and potential corrosion. This in turn creates difficulties for the maintenance teams to inspect and monitor potential corrosion points under PFP.

Issue 1

May 2007

Page 106 of 493


Active fire protection methods

3.2.9.1

Mitigation by deluge water application

Deluge works mitigates the effects of fires principally by providing cooling both to the fire and to equipment exposed to radiant heat from the fire. In addition it can wash away liquid fuel fires to drain systems or overboard. Protection of all the equipment in a module by application of PFP is rarely practical, so the alternative is to deluge a whole module or section of structure with large quantities of water. The water acts to: •

Cool the general area by evaporation of the smaller water droplets (see also various subsections within Section 5.2 where the effects of deluge on different fire types are described);

•

Provide a running film of water onto equipment in the area in order to cool it;

•

Provide a screen of water droplets as a barrier to radiant heat, thus reducing the heat load on structures and equipment;

•

Provide a screen of water droplets as a barrier to radiant heat exposure of people;

•

Retard the movement of the flame front through a module and consequently reduce explosion overpressures to some degree.

For general area cooling the key factors are application rate and water droplet size. If the water droplets are too small, they evaporate rapidly in a severe fire or can be blown away if the area is exposed. If the droplets are too large there is less evaporation from fewer droplets and the cooling is inefficient for the amount of water used. The droplets however are less affected by wind, will reach the floor, cool and wash liquid spills away and can provide a running film of water over equipment to keep it cool. Larger droplets however require bigger pumps, more power, and more AFFF so the cost of the system has to be balanced against its effectiveness. The deluge rate depends on both the fire scenario and the escalation potential, but the general rules are: •

General deluge only protects equipment exposed to flame or/and radiant heat from pool fires or radiant heat from jet fires providing there is a sufficient deluge rate to provide a film of running water over the equipment. Where a jet-flame actually engulfs equipment, however, much of the film is likely to be displaced by the jet flame and the cooling effect lost. Directed water deluge using high velocity nozzles may be used as trials have indicated an increased effectiveness against jet fires; Section 5.2.2.2 discuss deluge protection options in the context of jet fires.

•

Areas shielded from deluge but exposed to the fire will receive some limited protection from the heat attenuation of the deluge droplets falling between the location of the fire and the location of the equipment. Objects subject to thermal radiation from fires (but not direct fire impact) receive benefit from attenuation of the water sprays active between the location of the fire and the object.

•

Suppression of combustion and cooling of the high heat layer in the roof of a burning module (where the module is partially enclosed) is known to be achievable by spraying of very fine droplets at roof beam height. At the present time there is no method for calculating the protection provided by this mechanism,

Issue 1

May 2007

Page 107 of 493


The deluge rate and droplet size must be suitable for the cooling mechanism appropriate to the type of fire. Where there are several different scenarios, the deluge rate for the worst-case scenario, should be used as this should cover all lesser cases. Therefore in the case of enclosed modules with potential for serious, pressurised oil, gas or condensate fires deluge rates of 20 to 24 l min-1 m-2 would be needed, with rapid activation and water coverage especially at roof-level where the high heat will concentrate, However, deluge of high pressure gas jet fires within enclosed spaces will very likely result in extinction of the fire and could lead to an explosion hazard.

3.2.9.2

Vessel deluge

Further details on appropriate flow rates and other design issue for deluge systems are provided in Section 10.3.2.4.

3.2.9.3

Mitigation by sprinkler systems

These are usually potable water filled systems and provided in areas where the fire-risk is nonprocess related and therefore less severe, for example inside accommodation modules. They are activated by frangible bulbs, which release water directly from the sprinkler piping as soon as the bulb is broken by the heat of the fire in the area. Design is straightforward by comparison with deluge systems and is usually in accordance with the applicable NFPA standards.

3.2.9.4

Watermist systems

Water-mist systems are now commonly being used in turbine, generator or pump enclosures to replace Halon protection systems which are no longer permitted for use. The fine mist is injected intermittently from pressurised water reservoirs/ cylinders, in roughly 15 second bursts. The mist provides cooling and suppresses the combustion, which will be also be controlled by lack of air into the enclosure (provided there is no explosion on ignition). In enclosed spaces, protection systems need to take account of manning regimes and hence should include warning systems to evacuate personnel as the mist systems are being armed. Enclosure type fires tend to be non installation-threatening (but always need due consideration within the fire and explosion review process for the installation) The protection is usually automatic and provides immediate control, however there are a limited number of mistinjection cycles available from the water reservoir and instruction/training for follow-up action by the platform personnel e.g. fire team action and/or evacuation needs to be covered in platform emergency response plans.

3.2.9.5

Gaseous systems

Gaseous systems have been a common replacement to Halon systems, but it should be noted that Halon systems actually disrupted the combustion process; not all replacement media have the same effect. Replacement gaseous systems are: •

Carbon Dioxide (CO2);

•

Replacement low oxygen alternatives (e.g. Inergen ©);

•

Replacement Halon alternatives;

Issue 1

May 2007

Page 108 of 493

FIRE AND EXPLOSION GUIDANCE These alternatives function primarily by displacing the oxygen from the fire, although in addition, the CO2 option generates a low temperature upon release which has a cooling effect on the fire. The fire extinguishing media can themselves present hazards, most notably CO2 which is a powerful asphyxiant which causes hyper-ventilation exacerbating the hazard. Inergen © has specifically been design to provide a “safer” fire-fighting medium within which personnel can survive, providing only just oxygen to sustain breathing (with some difficulty) but not enough to sustain a fire.

3.3

Appropriate performance standards

3.3.1

Application of performance standards

The fire and gas detection and protection systems on an installation are generally categorised as safety critical systems, or ‘safety critical elements’ (SCEs) for the installation. In order to pass on the understanding of the design and operation of each system to those who operate and maintain the installation, the key features of the systems are recorded for all to see and understand in the form of ‘Performance Standards’. The Performance standards for SCEs should contain precise information relating to the functionality, availability, reliability and survivability of the system in question It is rare for platforms to have only one type of device within such systems. The ‘Fire and Gas Detection’ or the ‘Active Fire Protection’ SCEs for example will have many different aspects, parts or subsystems. While the ‘goal’ of the overall system will be the same, the Performance Standards for each part of the SCE will probably be different and needs to be specified separately within the documentation.

3.3.2

Functionality issues

As can be seen from Section 3.2.7, there are many different types of equipment available for the purposes of detecting fires and gas releases, and for protecting against fire. The principals of operation of the various sub-systems vary widely, as do the availability and reliability requirements of the equipment involved. It is important that the Performance Standard captures all the key information, not just part of it. In addition it should provide cross references to the various codes, standards, analyses and guidance documents which have a bearing on the performance. Some examples of different functionalities within the same SCE Performance Standard are shown in Table 3.4 below:

Issue 1

May 2007

Page 109 of 493

FIRE AND EXPLOSION GUIDANCE Table 3.4 - Typical safety critical element functionality descriptions Typical derivation/ supporting documents

SCE

Sub-item

Functionality

Gas detection system Goal: Detect loss of containment events.

1. Gas detection at inlets to enclosed areas containing non-certified electrical equipment

Detect low-level gas at 10 % (alarm) and high-level at 25 % (ESD 1, close dampers, S/D fan). 3 IR Point detectors in each duct on 2oo3 voting

Fire and Detection Philosophy

2. Gas detection in open hazardous areas

Detect 50 % LEL gas cloud of radius 5m or more using paired IR beam detection in process modules. Confirmed beam-pair detection initiates ESD 2.

Fire and Gas Cause and Effect Drawings

leak

Detect gas leaks of 0.1 kg s-1 and above in process modules. Executive action only on coincident gas detection (by beam detectors) in same area.

In-house Vendor Design Code for Acoustic Detection

1.Water deluge with AFFF in Process Modules including communicating mezzanine and deck levels

12 l min-1 m-2 general area coverage in LP separator and oil metering modules with at least 3 % AFFF to cool equipment in vicinity of oil pool fires and prevent consequent leakage from other inventories. Activated on confirmed Flame detection (2ooN) voting.

2. Water mist application in Generator Rooms A and B

Water mist injection to generator rooms to provide suppression and cooling. Activated on confirmed smoke or heat detection in generator room.

Firewater design philosophy Installation Fire and Explosion Analysis and Assessment In-house vendor design code for Water Mist Systems

1.H120 firewalls

Firewall at gridline 2, process area boundary, providing protection to TR and TEMPSC embarkation areas

2. J15 passive fire protection on First Stage Separator

Fire protection of gas space of First Stage Separator to protect against jet fire impingement from gas export system and potential BLEVE.

3. Acoustic detection

Active Fire Protection

Passive Fire Protection

Note that a jet fire rating has been proposed in the latest draft version of the ISO (22899-1) on the jet fire test. This is specified as: Type of application / Critical temperature rise ( °C) / Type of fire / Period of resistance (minutes).

3.3.3

Gas

Installation Safety Case

Safety Case Passive Fire Protection strategy Document. Installation Fire and Explosion Analysis and Assessment Vendor design Code for PFP suitable for Jet Fire impingement

Availability issues

These are often given limited consideration in Performance Standards. It is important to understand the availability issues for any Performance Standard. A significant factor in generating a systems’ availability is obtaining an estimate of the level of unrevealed failure modes to which the system may be subject. Issue 1

May 2007

Page 110 of 493

FIRE AND EXPLOSION GUIDANCE Just as there are different functionalities there are differing availabilities associated with different methods or types of protection equipment. Availability is not the same as reliability. The availability is the fraction of time the equipment is available to perform its intended function. A passive coating for example is available 100 % of the time (assuming it has not been damaged or degraded in service). A passive fire protection enclosure or removable cladding on a vessel however may be removed for several weeks in the year to allow inspection of a valve or NDT of a significant part of a vessel. Similarly, automatic Fire and Gas detection systems might be keyed out, making them only partially available during maintenance or project related activities. It is important that the person responsible for devising the Performance Standard also documents the assumptions made regarding availability, so that the design intent is correctly understood and upheld throughout the life cycle of the installation by the operations and maintenance personnel. Some example maintenance arrangements for safety critical equipment are given below. •

F&G detection system – During period of unavailability of fire and gas detection in an area due to essential maintenance, local manual surveillance for fire/gas events would be provided at all times.

•

Evacuation Systems on NUIs – During unavailability (e.g. testing) of escape and evacuation equipment, a standby vessel would be on close stand-by to assist rapid evacuation. Manning for the purposes of testing should only be allowed within documented weather operating limits of the available (remaining) evacuation systems.

3.3.4

Reliability issues

Reliability and availability are two technical terms that are often confused. Availability has been explained above. Reliability is the probability that the system or item of equipment will perform its intended function when required to do so. The reliability details for each system or subsystem listed within a performance standard should be clearly stared, with reference back to the reliability studies carried out during the design of the equipment. Changing the frequency of inspection and maintenance will have a direct bearing on its stated reliability. For this reason the maintenance or the inspection period used as key input to the frequency figure quoted must also be quoted in order for the reliability figure to be meaningful. As noted above for availability, it is important to obtain an estimate of the level of un-revealed failure modes the system may be subject to, preferably from gathered “own experience”. It is also important to understand that reliability figures theoretically derived from calculations involving manufacturer’s data on ‘mean time to failure’ may be over optimistic. It is strongly advised that platform specific information is used in evaluating equipment and plant reliability. The manufacturer’s data may have been gained under laboratory conditions and produces times-to-failure information that may not be reproducible in the real offshore environment or otherwise represents an amalgam of accumulated data from a range of applications and maintenance regimes. For example, theoretical calculations for a pellistor gas detection head, using the manufacturer’s data may imply that an adequate reliability is achieved by a 6 monthly test and inspection frequency. In reality, if the detector is then placed in an air inlet duct, exposed to salt, spray, temperature and pressure cycling and vibration, the time to failure in actual service may be significantly shorter. Where un-revealed faults in safety equipment could occur, test/ maintenance history must be monitored. If every time the gas detector is tested it fails to operate there must be immediate feedback to the responsible engineer, that the high reliability indicated in the Performance Standard is not being achieved. The test frequency should then be adjusted (for example to a 3 monthly interval) until it can be demonstrated that an appropriate level of reliability is restored. Issue 1

May 2007

Page 111 of 493

FIRE AND EXPLOSION GUIDANCE Voting arrangements for heat, smoke, flame or gas detectors also have a direct bearing on the proposed frequency of maintenance interventions. For example, a detection voting system that requires 1 detection element to be activated out of a total 2 (known as 1 out of 2 and indicated as 1oo2), has only one other item by way of redundancy plus a spurious indication from either item will cause unit or platform shutdown. It should be remembered that reliability requirements encompass unnecessary activation as well as failure to activate. The “built-in” redundancy is unavailable during maintenance of any one item. Industry good practice has converged on 2 out of 3 voting systems (2oo3) which offer a “good” compromise of high reliability of having 3 items available and still leaving a working arrangement in the event of a single item failure plus the demand rate for spurious indications is lower as a confirmed signal is always required. During maintenance this arrangement becomes a 2oo2 system. The voting arrangements should always be stated in the Performance Standards. Where reliance is placed on just one or two detectors to take executive action a review of the failure modes and the consequences of failure should always be undertaken and the consequences of maintenance changes need to be evaluated to ensure there are no knock-on effects to the platforms overall risk profile.

3.3.5

Survivability

The Performance Standard must state the survivability requirements for each SCE and each of its component parts where there are different requirements to those for the overall system. This makes it clear to all concerned exactly how long the item will need to continue to function in a major emergency in order to fulfil its safety role. For example one or more of the communications systems and the place of temporary refuge (TR) will be required to function as long as there are any personnel left on the installation. This may be anything from 10 minutes on a small NUI to 2 hours on a large installation. Individual fire or gas detectors however may only need to survive for long enough to detect the release or fire and initiate the necessary alarms, shut-downs and blowdowns. This may be only a few seconds. Valve actuation systems may need around a minute. Whatever the specified survivability, the information provided in the Performance Standard must be clear and unambiguous to the reader. Experience from major disasters both on and offshore indicates that failure to examine, understand and then communicate the survivability requirements of the provided safety systems to the right personnel has been a major contributor to the disaster.

3.3.6

Written schemes of examination (WSEs) or verification

Detailed schemes of examination or verification are required under the PFEER and DCR regulations to provide an independent check that: • the initial design of the safety critical system/element is appropriate for the hazard; • the SCEs procured; installed and commissioned still achieve their required function; • the maintenance being carried out is compatible with the reliability and availability specified in the Performance Standard; •

the maintenance considers the likely failure modes (especially un-revealed failures) of the components.

The written schemes must be thorough; any essential information omitted from these documents is in danger of being left out of either the maintenance scheme or the written schemes of the independent Competent Person, leading to gaps in the platform safety management system. Such gaps may only come to light in the aftermath of a major incident. The written scheme is required to be “live” through the platform’s lifetime and may be reaffirmed at any time. Issue 1

May 2007

Page 112 of 493


Methods and approaches to structural analysis

3.4.1

General

The risk level for the installation as defined by the risk matrix given in Section 2.8.2 determines the level of sophistication required for the fire assessment. If the conservatism of simplified methods of analysis can be guaranteed, then these could be used at an early project phase or as a first step in a sequence of analyses of increasing sophistication. For High or Medium risk installations, a ‘Structural Assessment’ should be performed for a representative range of fire scenarios. The process and Safety disciplines will generally define these Scenarios. A Structural Assessment may be performed at three levels of increasing complexity starting with a ‘Screening Analysis’. Should a structure fail the ‘Screening analysis’ then a ‘Strength level analysis’ will be required. If it fails the Strength level analysis then ‘Ductility level analyses must be performed. If the Ductility level analysis indicates failure then mitigation measures are required. These could involve measures for elimination or reduction of the frequency of exceedance of the initiating event, reduction of the severity of the consequences of the event or structural modification. ‘Failure’ in the context of fires means failure to satisfy the performance standards for the installation. High-level performance standards for the installation and safety critical components are defined in terms of allowable peak temperature, strain or time to collapse depending on the method of analysis used. Screening Analysis, Strength level or Ductility level performance characteristics from an assessment of one installation may be used to infer the fitness for purpose of other similar installations, provided the framing, foundation support, service history, structural condition, blast and fire barriers and payload levels are not significantly different. In cases where one platform’s detailed performance characteristics are used to infer those of another similar platform, documentation should be developed to substantiate the use of such generic data. The required initial level of analysis depends on the Risk level assigned to the installation or the risk level associated with a representative set of fire scenarios. The risk category of the installation does not preclude the use of more sophisticated methods of assessment which may result in reductions in conservatism and hence cost, if they are considered more appropriate.

Issue 1

May 2007

Page 113 of 493

FIRE AND EXPLOSION GUIDANCE Table 3.5 - Appropriate method of analysis – fires Risk level Low

Analysis method Screening analysis

Medium or High

Response calculation

Load calculation bases Allowable temperature reduction to 60 %

(yield

strength

Design

basis

checks.

Past experience.

Past experience for demonstrably similar platforms.

Strength analysis

level

Calculate peak temperature member by member, from nominal fire loads and fire extent.

Strength level analysis, Redundancy analysis

Ductility analysis

level

Calculate temperature - time history of primary members from fire loads time history and flame extent.

Redundancy analysis, Ductility level analysis

A structural ‘Redundancy Analysis’ of a topside structure will indicate which members can be removed without collapse of the structure. In addition those members not supporting the TR, muster areas, escape routes or safety critical equipment must survive during and after the fire event for sufficient time to allow personnel on board to escape, allowing for the possible need to assist injured colleagues. The results of a fire response analysis will then indicate which structural members and SCEs must be protected to achieve the fire performance standards for the installation. •

Simple fire response analyses are usually performed based on the following assumptions [3.5].

•

Unprotected structural members and panels have no variation of temperature through thickness or along their length. In practice the critical sections of the member are considered from the point of view of resistance.

•

Fire protected structural members and panels have a constant steel temperature, the thermal insulation has a linear variation of temperature through thickness.

•

Each member may be considered to have reached a steady-state variations of temperature are due entirely to changes in boundary conditions and incident heat fluxes.

•

Conduction between members need not be considered (except when considering coatback requirements).

•

Thermal stresses due to restraint may generally be neglected as supports also soften during fire loading.

The methods of analysis identified above are discussed in the following sections.

Issue 1

May 2007

Page 114 of 493


Screening analysis

A screening analysis for an existing installation consists of a condition assessment which may involve a survey followed by design basis checks. Design basis checks consist of checking the basis of the existing design for the installation and determining if the methods used for the design are currently acceptable in the context of fire events. For a Screening Analysis, the Zone method may be used. The Zone method assigns a maximum allowable temperature that a steel member can sustain. This method does not take into account the stresses present in the member before the fire. The maximum allowable temperature may be read from Table 3.6. These temperature values correspond to a yield strength reduction to 0.6 of the ambient temperature values. The fact that a fire is an accidental load will mean that the allowable stress is the full yield stress value as opposed to about 60 % of the yield stress allowed for in the conventional design load cases. The yield stress corresponding to 0.6 of the ambient yield stress will then give an allowable stress the same as that for the structure before the fire. Higher strain levels than 0.2 % may give a proportionately higher decrease in Young’s Modulus giving an unmatched reduction in yield strength with the reduction in Young’s modulus exceeding the reduction in yield strength. The Zone method may then not be applicable [3.6]. Fire barriers must perform according to their required rating. A blanket critical temperature for all members may be postulated as in the Zone method. This critical temperature is chosen typically to be 400 °C as this requires no modification to the normal code checks if strains are limited to 0.2 % in an elastic Design Level analysis. This approach may result in unnecessary protection and may be unconservative locally to areas of high strain. It will not usually be necessary to protect every vulnerable member unless the scenario performance standards demand that the installation is required to re-start after a few days. The above method will indicate the protection of non-essential members from the point of view survival of the installation. The temperature calculation for each member is performed and measures are taken to restrict the temperatures to values below the critical temperature usually by the application of PFP (Passive Fire Protection). It will also be necessary to check that radiation levels on escape ways remain at acceptable levels (i.e. below 2.5 Kw m-2), to allow for personnel on board to escape.

3.4.3

Strength level analysis

Strength level analyses are conventional linear elastic analyses as used in design against environmental, operating and gravity loads. The loads used in such an analysis should be in a form which could be interpreted as a load case as used in the design process. In investigating the effect of a fire the ‘live’ loads such as contained liquids and storage may be taken as 75 % of their maximum values as is the case for the consideration of Earthquakes. Alternatively, live loads may be taken as the values used in the fatigue analysis performed for the installation if these have been properly derived. Issue 1

May 2007

Page 115 of 493

FIRE AND EXPLOSION GUIDANCE The transfer of conclusions and load characteristics from the analysis of a geometrically similar platform with similar structural and process characteristics is acceptable for strength level analyses. In a strength level analysis a maximum allowable temperature in a steel member is assigned based on the stress level of the member prior to the fire such that the utilization ratio remains less that the corresponding value given in Table 3.6 below. The maximum allowable temperature in a steel member as a function of utilization ratio is given in Table 3.6 below. Table 3.6 - Maximum allowable steel temperature as a function of Utilisation Ratio [3.5]

Maximum member temperature Yield strength reduction factor

Member UR at 20 °C to give UR = 1 at max. temperature

°C

°F

400

752

0.60

1.00

450

842

0.53

0.88

500

932

0.47

0.78

550

1022

0.37

0.62

600

1112

0.27

0.45

If the primary structure on the installation have been designed for all credible fire scenarios to then the primary structure will be acceptable from a fire resistance point of view. Higher strain levels than 0.2% may give a proportionately higher decrease in Young’s Modulus giving an unmatched reduction in yield strength and Young’s modulus. Strength level checks may then give utilization ratios above unity. A Ductility level or ‘elastic-plastic’ method of analysis may be required. Table 3.7 gives the maximum allowable steel temperature as a function of strain. The peak temperature of each member needs to be determined for the fire event to check if the structural response remains elastic. Table 3.7 -Maximum allowable temperature of steel Maximum Allowable Temperature of Steel Strain % °Celsius

°Fahrenheit

0.2

400

752

0.5

508

946

1.5

554

1029

2.0

559

1038

Fire barriers must perform according to their required rating. Issue 1

May 2007

Page 116 of 493


Scenario or performance based strength level analysis

In a performance or scenario based approach, the first task involves the definition of credible fire scenarios from the failure probabilities of vessels and piping, the inventory pressures local to the release point, the material released, the emergency shut down systems available and the ventilation conditions. This information will normally be supplied by the Safety and Process disciplines. A scenario based Strength level analysis is performed in the following general stages: 1. Definition of a fire scenario. (See Section 3.2.1. 2. The time history of the rate of release is calculated. 3. If required, the probability of occurrence of the release can be estimated from published failure statistics and the numbers of past failures which are available for most types of vessels, flanges and process equipment generally [3.7, 3.8, 3.9, 3.10, 3.11 and 3.12]. 4. Calculation of the burning rate for the fire geometry enables the extent and duration of the fire to be determined. 5. The heat output from the fire in terms of radiation and the convection of hot air and gases may then be determined (see also Sections 5.3, 5.4 and 5.5). 6. The heat incident on structural members and panels may then be used to calculate the temperature/time history of the member. 7. For load bearing members, the temperature determines the appropriate values for the yield stress and Young’s modulus of the material of the member to be used in the structural analysis performed. 8. For panels and firewalls, which are usually non load bearing, the important parameters are the temperature of the cold face and the time to reach certain limiting temperatures which determine the walls’ rating. 9. It will also be necessary to check that radiation levels on escape ways remain at acceptable levels where immediate injury will not caused (i.e. below 2.5 kW m-2). 10. A utilization ratio of up to 1.7 will be acceptable for members loaded in bending if a small amount of plastic deformation is acceptable. A different utilization ratio will be appropriate for detection of buckling. Shear stresses should be kept within the yield stress for the material at that temperature. Alternatively the yield stress may be enhanced by a factor of 1.5 to take account of the fact that fire is an accidental load. 11. Modified code checks may be made on the structural members and if load redistribution is neglected then the material effects and isolated plasticity may also be taken into account in the analysis. 12. The occurrence of plastic hinging may be taken into account by factoring the acceptable utilization ratio by the ratio of the plastic ‘Zx’ to elastic section modulus ‘Sx’. This factor is generally greater than 1.12 and will be in the range 1.1 to 1.5. The member must be able to sustain the formation of a plastic hinge before buckling, i.e. be in tension or be a ‘plastic’ section.

Issue 1

May 2007

Page 117 of 493

FIRE AND EXPLOSION GUIDANCE 13. Use of the critical temperature approach may give an efficient scheme for the application of PFP in combination with a full non-linear elastic-plastic (progressive collapse) structural analysis. This type of analysis is referred to as a ductility level analysis for fire or explosion response calculations.

3.4.5

Redundancy analysis

An elastic linear analysis is performed to determine the minimal structure which will fulfil the requirement that escape ways will remain available for sufficient time to allow escape and that the TR integrity is maintained during and after a fire event. A structural redundancy analysis will determine which members are essential for the above. Protection of these members with PFP will complete the assessment on the basis of a redundancy analysis. The determination of the critical structural members may be performed using an elastic structural frame model as follows: 1. Eliminate all non-critical structural elements by inspection, with due regard to escalation potential; 2. Remove all members identified in step 1; 3. Modify the static loading to represent the probable load at the time of the fire 75% of the loads associated with process contents and storage may be used as suggested for Earthquake analysis [3.6]; 4. Remove safety factors in the code check, enhance the yield stress by a 1.5 factor, or allow a correspondingly higher utilization; 5. Identify those members with the highest utilization ratios - particularly relating to stability using the frame model; 6. Remove these members from the geometry; 7. Repeat step 6 and assess the remaining structure at each stage.

3.4.6

Ductility level analysis

A ductility level analysis may be required for Medium or High Risk installations. This method of analysis can take into account the load re-distribution which takes place when structural components fail and the time to failure of the structure considered. A number of options for the linearization of stress/strain relationships at elevated temperatures exist. If the software used for the ductility level analysis allows temperature dependent stress/strain curves to be input then the linearization will not be necessary. 1. The levels of heat radiation and convection from the selected fire scenarios are calculated. 2. The time history of the increase of temperature of the structural components is derived. 3. Conduction of heat from neighbouring structural components will also occur but may generally be ignored in the primary framing analysis.

Issue 1

May 2007

Page 118 of 493

FIRE AND EXPLOSION GUIDANCE 4. Once the steel temperature at a given time is known, the reductions in yield stress and Young’s modulus may be calculated. 5. Failure of a structural member is defined as collapse (where increasing displacement results in no net increase of capacity) under the imposed static gravity and operating loads. 6. In investigating the effect of a fire the ‘live’ loads such as contained liquids and storage may be taken as 75 % of their maximum values as is the case for the consideration of Earthquakes. Alternatively, live loads may be taken as the values used in the fatigue analysis performed for the installation if these have been properly derived. 7. Optimization of PFP (passive fire protection) thickness is rarely worthwhile as application of PFP to a given thickness is not sufficiently controllable. The thickness of PFP is controllable at best to within about 3 mm. 8. The scenario based strength level analysis method will not detect failures at intermediate or later times caused by thermal restraint from cold members. This is, in any case, an unlikely event in the context of offshore topside structures. Imperfections or deflections for example due to a previous explosion will not be taken into account. It will be necessary to use a ductility level analysis to take these effects into account. 9. In view of the fact that a single scenario is only one among many, the spatial variation of thermal loading is not generally meaningful. It is unlikely that this level of analysis will be necessary unless a single extreme event such as a riser failure or blow-out which puts the whole installation at risk is being considered. 10. It will also be necessary to check that radiation levels on escape ways remain at acceptable levels (i.e. below 2.5 kW m-2).

3.4.7

Assessment of fire barriers

Fire barriers are given a ‘rating’ derived from the SOLAS (Safety of Life at Sea) [3.4] classification system for use on ships. Originally they were developed for cellulosic fires as opposed to hydrocarbon fires, which are more severe. The type of fire is represented in a furnace test where the firewall is in contact with a furnace with a well-defined temperature/time relationship. The hydrocarbon fire curve has a higher rate of temperature rise and attains a higher peak temperature. The three main ratings used offshore are: B

Maintains stability and integrity for 30 minutes when exposed to a cellulosic fire. The temperature rise of the cold face is limited to 140 °C for the period in minutes specified in the rating. i.e. A30 has a 30 minute time period during which temperature rise is below 140 °C.

A

Maintains stability and integrity for a period of 60 minutes when exposed to a cellulosic fire. The temperature rise of the cold face is limited to 140 °C for the period specified in the rating.

H

Maintains stability and integrity for a period of 120 minutes when exposed to a hydrocarbon fire. The temperature rise of the cold face is limited to 140 °C for the period specified in the rating.

Issue 1

May 2007

Page 119 of 493

FIRE AND EXPLOSION GUIDANCE J

Currently proposed one in latest draft version of the ISO (22899-1) [3.13]; identifies Type of application / Critical temperature rise (°C) / Type of fire / Period of resistance (minutes) Here retaining ‘stability and integrity’ means that the passage of smoke and flame is prevented and that the load bearing components of the barrier do not reach a temperature in excess of 400 °C. Insulation failure is also deemed to occur when the average temperature rise on the unexposed face of a separating element exceeds 140 ºC or the maximum temperature rise exceeds 180 ºC, whichever occurs first. These limits are to prevent combustion of any material which may be close to the unexposed face. Their origins are unknown and, in many cases, the limits may be excessively conservative.

3.5

Explosion hazard management

3.5.1

Common issues with fire hazard management

The major measures discussed for inherent safety and prevention of fire will apply equally to explosions. This section will address those measures which are additionally effective for explosion hazards, which tend to be those measures that act as detection, control and mitigation measures.

3.5.2

Detection, control and mitigation

Aspects of inherent safety have been discussed in Section 2.7. The employment of inherently safe features is an important part of any new design or assessment of existing installations, however there will usually be residual hazards and some risk that needs to be managed. Using the safety management hierarchy these residual risks should be approached firstly by controlling the risk and then by mitigation. Control implies the detection of the initiating events and actions initiated after the detection to reduce the hazard or exposure to it. For the explosion hazard, systems will have a role in: •

detection and initiation of control measures

•

avoidance of the explosion event

•

reduction of people on board (POB) exposure

•

reduction of the severity of the explosion hazard

•

minimization of the escalation potential

•

protection of the SCEs

Where choices exist, preference should be given to passive rather than active systems of control and mitigation. Measures that can be used to fulfil the control and mitigation roles are given in Table 3.8 below.

Issue 1

May 2007

Page 120 of 493

FIRE AND EXPLOSION GUIDANCE Table 3.8 - Summary of control and mitigation options Role Detection and measures

initiation

Control/Mitigation measure of

control

• Gas detection • Acoustic leak detection • Operator/Manual alarm callpoint/Phone • Emergency Shutdown (ESD) • Isolation of electrical equipment

Avoidance of the explosion event

• Increase ventilation – start stand-by fans (in explosion zone) • Shutdown ventilation intakes (on detection in adjacent areas) • General alarm

Reduction of POB exposure

• Blast walls, TR, means of escape and evacuation

Reduction of the explosion hazard

severity

of

the

Minimization of the escalation potential

• Initiation of area deluge upon gas detection • Increase ventilation – start stand-by fans • Isolation of hazardous inventories • Blowdown/depressurisation • Blast walls

Protection of SCEs

• Blast walls/enclosures • Resilient mountings • Inherent robustness

3.5.3

Control systems and safety critical equipment

3.5.3.1

Safety integrity levels

Instrumented control systems rely the following generic loop to effect the control mechanism; •

a means of detecting an upset condition, e.g. a gas accumulation

•

an electronic data processing system to process outputs from the detection system

•

output signals to activate the controlling mechanisms.

For any control system there will be a potential for failure to operate on demand due to the inherent unreliability of the elements involved. It is essential however that control systems have a reliability that gives sufficient confidence that they will be effective. The level of reliability to function on demand should be commensurate with the level of risk being averted. This can be assured by determining the loop’s Safety Integrity Level and designing the elements of the loop to meet this level of reliability [3.1, 3.2]. The procedure should be applied to each instrumented control loop used in the management of explosion hazards. 3.5.3.2

Safety critical elements

Safety Critical Elements (SCEs) are those items or systems that prevent or reduce the impact of major accident events. They are identified as part of the detailed design of an installation as required by the ‘Safety Case Regulations’ [3.14].

Issue 1

May 2007

Page 121 of 493

FIRE AND EXPLOSION GUIDANCE In order to demonstrate that these systems remain functional and fulfill their duties, element specific performance standards defining how the SCEs will operate under normal and extreme conditions. SCEs that mitigate the effects of a major accident will have to remain functional after initiation of design accidental events, e.g. explosions. A design accidental event is one for which SCEs on the installation should perform their function as designed. Extreme events against which design is not reasonably practicable may result in loss of these systems. A typical listing of SCEs would include the items given in Table 3.9: Table 3.9 - Typical Safety Critical Elements Ref. no.

Safety Critical Element

SCE 001

Hydrocarbon Containment -Pipelines, Risers, Vent lines, firewater pipework

SCE 002

Hydrocarbon Containment -Topsides Process Facilities

SCE 003

Hydrocarbon Containment -Wells

SCE 004

Fire & Gas Detection System

SCE 005a

Riser Shutdown System

SCE 005b

Topsides Shutdown System

SCE 005c

Wellhead Shutdown System

SCE 006

Ignition Prevention

SCE 007

Platform Sub-Structure

SCE 008

Topsides Structure

SCE 009

Uninterrupted Power Supply

SCE 010

Emergency Lighting

SCE 011

Evacuation & Escape Systems

SCE 012

Rescue & Recovery

SCE 013

Telecommunications

SCE 014

Navigational Aids

SCE 015

Personal Protective Equipment

SCE 016

Helideck

SCE 017

Escape Routes

SCE 018

Temporary Refuge

The above SCEs should remain functional during and after a fire or explosion event, and other items should not fail so as to create a hazard, e.g. catastrophically collapse. The performance of each SCE is defined in element specific performance standards against which its performance is assessed. The element specific performance standard defines the item’s Functionality, Reliability or Availability, Survivability and some measure of interaction with other safety systems.

Issue 1

May 2007

Page 122 of 493

FIRE AND EXPLOSION GUIDANCE Survivability includes its endurance under explosion loads. The design of the system must therefore match its stated survivability so that its functionality is maintained in an explosion event. The specific explosion effects which it may need to withstand are: •

overpressure;

•

dynamic pressure;

•

displacement effects;

•

strong vibration;

•

exposure to missiles.

3.5.4

Equipment specific performance standards

The term Performance Standard has become interpreted as having a very specific meaning when related to the DCR which amends the SCR. One of the aspects of DCR is the identification of Safety-Critical Elements and the preparation of a Written Scheme of Verification for assurance of continued integrity. A Performance Standard can be described as a series of statements which can be expressed in qualitative or quantitative terms the performance required of an SCE can be compliant with DCR. The equipment specific performance standards or low level performance standards define the requirements in terms of functionality, availability and survivability. The Performance Standard is a means of condensing the Design Specification and Operating Procedures into a requirement related to a particular system in a particular mode of operation in the face of an identified hazard. The justification for the requirement and the degree to which it is achieved is contained within the Written Scheme of Verification or Examination.

3.5.5

Levels of criticality of equipment items

The DCR states: “Any structure, plant, equipment, system (including computer software) or component part whose failure could cause or contribute substantially to a major accident is safety-critical, as is any which is intended to prevent or limit the effect of a major accident.” So for our purposes, the following equipment and systems at least need to be addressed when considering the response to explosions: •

Those necessary for the safe shut down of the installation.

•

Those necessary for personnel protection and escape.

•

Those necessary for fire detection, suppression and control.

•

Those necessary for communications.

•

Those necessary for hydrocarbon processing, transport and storage.

Safety-Critical Equipment may require a blast protection structure to enable satisfactory operation within the full range of design explosion events. Protection against fire is a further consideration, both before and after the effects of an explosion. A practicable limiting explosion needs to be identified in the specification of these equipment specific performance standards, such that the risks to personnel, the environment and the commercial viability of the asset are as low as reasonably practicable (ALARP). This Ductility Level Blast (DLB) is an achievable design event with a realistic frequency of occurrence.

Issue 1

May 2007

Page 123 of 493

FIRE AND EXPLOSION GUIDANCE It will be paramount in this Guidance Document to achieve consistent terminology to identify those events with: •

The maximum credible peak overpressure, but very low frequency of occurrence;

•

The practicable limiting overpressure for design purposes, giving ALARP risk levels;

•

Overpressures giving elastic response levels in components, for early design and robustness checks.

With systems such as gas detection, the ability to withstand a major explosion may not be warranted, so long as the presence of the gas build up is identified. The element specific performance standards thus need to be realistic and fit-for-purpose, taken on a element by element basis. The performance standards need to take into account initial design and manufacturing cost, practicability of construction, maintenance, accessibility for inspection, reliability, robustness and redundancy. To this end OTO 1999 046 and 1999 047 [3.15, 3.16], detailed the use of a criticality rating system similar to the one given below: Criticality 1

Equipment and pipes designed to withstand the same explosion severity as the main structure.

Criticality 2

Equipment and pipes designed for a less severe but non-the-less substantial explosion event.

Criticality 3

Equipment not designed or assessed for explosion.

The difference between Criticality 1 and 2 items would be associated with the consequence of fire escalation and escape from the facility. It was recognised in the paper that the assessment of Criticality 1 items would be very much constrained by project schedules and costs under current design project philosophies. The key question though must be whether current design practice delivers equipment and their supports which, if designed primarily for in-service loading, provide safe and fit-for-purpose details when subjected to extreme explosion events. Based on the limited amount of strengthening or modification to existing equipment required for operators to delivery satisfactory Safety Cases upon their most recent submission, it must be presumed that past designs are reasonably robust and a significant increase in design effort would not therefore be warranted or necessary. Criticality 1

Items whose failure would lead direct impairment of the TR or emergency escape and rescue (EER) systems including the associated supporting structure. Performance Standard – These items must not fail during the DLB or SLB, ductile response of the support structure is allowed during the DLB.

Criticality 2

Items whose failure could lead to major hydrocarbon release and escalation affecting more than one module or compartment. Performance Standard – These items must have no functional significance in an explosion event and these items and their supports must respond elastically under the strength level blast (SLB)

Issue 1

May 2007

Page 124 of 493

FIRE AND EXPLOSION GUIDANCE Criticality 3

Items whose failure in an explosion may result in module wide escalation, with potential for inventories outside the module contributing to a fire due to blowdown and or pipework damage. Performance Standard – These items have no functional significance in an explosion event and must not become or generate projectiles.

The Strength Level Blast (SLB) and the Ductility Level Blast (DLB) are defined in the Glossary, Annex B and Sections 8.6.3 and 8.6.4.

3.5.6

Mitigation and consequence minimization

The severity of explosion consequences may be mitigated by the introduction of:•

Lower inventory pressures

•

More ventilation

•

Judicious ignition source location

•

Smaller potential explosion zones

•

Optimised layout resulting in less congestion and less confinement

•

The use of blast relief panels

•

Robust design of SCEs and minimisation of escalation potential

•

Segregation of explosion release sources from congestion and major escalation targets

•

Early use of deluge.

3.5.6.1

Inventory pressure

Flammable cloud size is determined by the leak dimension and the pressure of the inventory. The mass rate at which gas is released from a hole is directly proportional to pressure. Reduced inventory pressure will reduce explosive cloud dimensions and the severity of the explosion event. A reduction in pressure will also result in a lower inventory mass within the system which will give the potential for more rapid blowdown and reduced escalation consequence

3.5.6.2

Ventilation

Artificial ventilation is defined as that ventilation which is not supplied from the action of the environmental wind alone. Artificial ventilation may be either induced or forced. Induced ventilation means that the air is drawn into the space by fans located on the ‘extract’ side of the room, the room is then under negative pressure compared with areas around it. Forced ventilation means that air is forced into the room by fans in the intake ducting resulting in the ventilated space being at positive pressure relative to adjacent areas. Assuming that some loss of inventory from a hazardous process will occur at some time, ventilation is critical in ensuring that a significant flammable gas cloud does not form or that the cloud is reduced in size, particularly for small leaks which are the most frequent.

Issue 1

May 2007

Page 125 of 493

FIRE AND EXPLOSION GUIDANCE Rooms containing hazardous gas inventories are generally operated at negative pressure compared with adjacent non-hazardous areas to prevent leakage of potentially explosive gas clouds to those adjacent areas. Upon detection of flammable gas, the standby fan(s) should be started to give maximum possible ventilation in order to aid dilution of the leak to prevent or limit the generation of an explosive cloud. Non-hazardous rooms adjacent or close to hazardous areas are normally operated at a positive pressure to prevent ingress of explosive gas clouds. Upon gas detection, which would normally occur at the fresh air intake, all fans should be stopped and the intake and discharge isolated by (nominally) gas tight dampers. Industry guidance [3.17] defines ‘adequate ventilation’ as ventilation achieving at least 12 air changes per hour for at least 95 % of the time, with no dead spots. The term ‘adequate ventilation’ is not meant to imply an optimum level of leak dilution; it should be regarded as minimum target. Increased ventilation rates will ensure dilution of larger hazardous leaks and reduce the potential for explosions to occur or reduce its severity. In the case of natural ventilation adequate ventilation needs to be confirmed. For small wellhead platforms and NUIs this can generally be demonstrated qualitatively since confinement is low. For more complex installations the only way of demonstrating adequate ventilation will be either by CFD modelling of the ventilation regime, or wind tunnel testing. Where there is inadequate ventilation the options are to re-orientate the installation to make more use of prevailing winds, to remove confinement, to relocate equipment to provide a freer air flow through the module and to add some fan assistance at dead spots. A special case which typifies the various considerations that arise in the ventilation of a hazardous area, is that of turbine enclosure ventilation. The means of managing this risk is detailed in the HSE guidance [3.18]. This relies on fast dilution of the leak at source to prevent significant flammable clouds forming.

3.5.6.3

Installation orientation

If a module is open on all four sides, orientation of the installation is relatively unimportant. If, as is often the case, one side forms a solid partition then orientation will affect the ventilation air change rate within the module. The installation is often aligned such that the TR is directly upwind of the process areas. This minimises potential for smoke logging or toxic gas ingress into the TR. Apart from smoke logging and natural ventilation, operational factors also enter into the orientation assessment as supply vessels and helicopter approaches tend to be towards the flow of current or wind respectively. The preliminary QRA is likely to give an indication as to the relative risks of fire, toxic gas or explosion. It is probable that explosion risk (including escalation from an explosion event) will be well below that from process fires and that operational constraints of supply vessels, at least on the larger installations, will tend to set the orientation, with natural ventilation being a secondary consideration. FPSOs are unique in that they orientate themselves according to the relative forces of the current, wave and wind, called weather-vaning. Frequently the vessel will be positioned with the wind blowing lengthways from bow to stern. This is not the preferred arrangement from an explosion point of view as a gas cloud will extend along the deck within congested areas rather than being blow out to the sides. Issue 1

May 2007

Page 126 of 493

FIRE AND EXPLOSION GUIDANCE With fan assisted ventilation, for instance in a closed module, it is relatively easy to show that ‘adequate ventilation’ has been provided. The provision of 12 air changes per hour as an absolute minimum [3.17] with a qualitative demonstration that there are no dead spots by the suitable location of supply grilles should suffice.

3.5.6.4

Ignition source location

Highest overpressures in congested modules tend to arise when the ignition point is at the furthest point from a main vent. There is potential for ignition to occur at practically any point within the module (e.g. from hot work activities), however removing other ignition sources away from such extremities will, to some extent, lower the potential for high explosion overpressures to occur.

3.5.6.5

Layout optimisation

The layout of a module should be optimised in order to; •

Minimise confinement

•

Minimise congestion

•

Minimise flame front path length

•

Reduce potential gas cloud size

•

Reduce unfavourable ignition source locations

Generally, layouts that result in maximum potential for venting and minimise the potential for turbulent flow generation, particularly in the early stages of flame travel, will reduce the final overpressure.

3.5.6.6

Reduction in explosion zone size

For a congestion dominated explosion event the strength of explosion is dependent on the flame path length from a main vent or from a target. For this explosion type, the largest overpressures for a given configuration tend to arise when the ignition point is furthest from a main vent. Keeping the dimensions of an explosion zone small will limit the potential for overpressure generation. This also means that for a given deck area the minimum potential overpressure occurs for a square plan area, as opposed to a long narrow plan. To achieve this for a large complex process suggests that there will need to be a number of partitions to limit the size of each zone. This will however tend to increase confinement and reduce the effect of natural ventilation. A balance needs to be sought in reaching an optimum solution.

3.5.6.7

Congestion minimisation and layout

Congestion is not necessarily related to blockage ratio, more the type of blockage. The volume blockage ratio is defined as the ratio of the volume occupied by the obstacles to the total volume. A large, correctly aligned, vessel may have little effect on overpressure but a number of small bore pipes of similar volume will have a significant effect since the turbulence generated will be greater. Since smaller items tend to give rise to the greater level of turbulence critical for overpressure generation a suitable measure of overpressure generation potential may be the mean diameter of equipment. This does not however take into account the amount of equipment present. The Volume blockage ratio is a suitable measure of this. To judge the degree of congestion in a given arrangement the volume blockage divided by mean diameter may give a measure of congestion. These measures currently require further investigation. Issue 1

May 2007

Page 127 of 493

FIRE AND EXPLOSION GUIDANCE The effect on overpressure of the above recommendations can be variable and in some cases conflicting. It is necessary to optimise the overpressure management techniques by reference to a calculation model to confirm the downward trend. Phenomenological models may suffice for this purpose. The intention is to identify trends in overpressure, not absolute values, it is not then the accuracy of the model in predicting overpressure values that is required, rather its ability to identify trends; its speed and ease of use. The area around vents should be kept as clear as possible. Any blockage of these will result, not only in increase in overpressure, but also in the velocity of the gases being vented. Installations tend to have escape routes around the periphery of modules so that minimisation of explosion consequences at vents will have less impact on escaping personnel and prevent damage that may affect escape routes. Additionally, pipework located near vent areas will be subjected to drag forces proportional to the square of the exit velocity. It is therefore preferable to locate pipework away from vent areas so that they do not block the vent path but also because the forces exerted on them may be difficult to accommodate. Careful layout at an early stage in a design project by orientating major vessels parallel to the expected gas flow during an explosion and avoiding the blockage of vents can reduce the peak overpressures by a considerable amount. Figure 3.1 shows comparisons of good and bad layout options from the point of view of explosion overpressure.

Issue 1

May 2007

Page 128 of 493


Figure 3.1 - Relative merits of layouts The following observations may also be noted for the mitigation of the effects of explosions. •

Effective venting reduces the magnitude of the peak overpressure

•

When gas is allowed to expand freely the resulting overpressure is much lower than when the gas is confined

•

For the same blockage ratio several small obstacles create a higher overpressure than a smaller number of big obstacles.

Issue 1

May 2007

Page 129 of 493


Blow-out panels take a finite time to move out of the way of the expanding gas and may not prevent further overpressure increases.

•

Normal louvres create sufficient obstruction to cause increased overpressures.

•

Sharp cornered objects generate higher peak pressures than rounded obstacles.

3.5.6.8

Blast relief panels

Blast relief panels, which open quickly during an explosion in order to reduce peak overpressures, must be carefully designed. It is unlikely that loosening of cladding panels will have the desired effect. A typical blast relief panel will have the following properties: •

It will be light – probably of aluminium construction

•

It will start to open at about 50 millibar or 0.05 bar differential pressure (wind loads are usually a factor of ten lower)

•

It must open quickly (within about 50 milliseconds) and stay open

•

It must be located to open a clear vent path to prevent further flame acceleration occurring due to venting through a congested area.

These requirements will probably result in panels of a mass per unit area of less than 0.5 kgm-2 depending on the method of attachment. These issues are discussed further [3.19, 3.20 and 3.21]. Panels may be retained (e.g. hinged) if there is significant risk posed by them becoming missiles, otherwise they can be free of restraint.

3.5.6.9

Damage to safety critical elements and escalation potential

Overview Most SCEs should be designed to operate after the explosion event (e.g. escape routes, the TR and evacuation systems). The intention should be that these items survive an explosion event and maintain their functionality to prevent escalation. The specific explosion effects which an item may need to withstand are; •

static overpressure

•

dynamic overpressure

•

displacement effects

•

strong shock (strong vibration) effects

Heat effects tend to be transitory and the thermal inertia of most items should ensure that thermal effects of the explosion event are negligible. Equipment on anti-vibration mounts may be displaced if the mount topples. If this is considered possible restrained mountings should be specified or sea fixings retained during operation. Issue 1

May 2007

Page 130 of 493

FIRE AND EXPLOSION GUIDANCE The smaller safety critical elements can either have enhanced support to withstand blast wind effects or be located near a bulkhead or structure where the wind effect will be low. This may be appropriate for fire and gas detection devices. Flare/vent and firewater piping can be especially susceptible to blast forces since they are generally of low pressure design and therefore light-weight. Damage to flare/vent lines can result in large quantities of gas entering the module, especially as the installation will probably be being blown down at the time. This would lead to jet fires and possibly secondary explosions. Damage to firewater lines would result in the loss of fire control measures within the explosion zone. Means of protecting these lines will include and or all of the following: •

not running these lines near vent areas where blast wind forces will be high

•

increasing the schedule of the lines to increase inherent robustness

•

increasing pipework supports

•

running these lines in the shelter of structural elements

Strong shock response In an explosion event the forces acting on the structure will result in movement of decks and members. This displacement absorbs energy plastic by deformation and if it did not occur the structure could not survive [3.22, 3.23]. The result of this displacement is that initially; •

roofs/ceilings will move upwards

•

decks will move downwards

•

walls will move outwards

Subsequent to this will be the rebound effects as the structure then oscillates. These phenomena may occur in a wave as the overpressure moves through the module in a congestion dominated explosion. These displacements will have significant impacts on any items fixed to structural elements that are moving differentially to each other, for example, pipes that run from floor to ceiling, or run from a floor mounted vessel to the ceiling. Relative displacements can be considerable, 10’s of centimetres, so that forces potentially acting upon items spanning structural elements can be large. As with all potential hazards the aim should be to avoid the situation occurring, that is, by avoiding arrangements where items are attached to floor and ceiling. This may not however be reasonably practicable. If this is so, sufficient resilience should be included in the design to accommodate the differential movement. This may be achieved using resilient mounts or by the building in of flexibility to the piping runs. Good design practice however should be employed to mitigate the consequences of this severe vibration, this involves; •

the location of vibration sensitive safety critical elements distant from potential explosion zones, especially not attaching them to common boundaries;

•

the use of shock or resilient mountings to absorb vibration effects;

•

additional restraints to items that may topple and cause damage or lose function, e.g. cabinets, bookcases;

•

slack in cables where displacement of control or electrical equipment is possible.

Issue 1

May 2007

Page 131 of 493

FIRE AND EXPLOSION GUIDANCE Specialist products, shock mounts, are available from companies marketing anti-vibration equipment. Their advice should be sought before any mountings are fitted since, if the wrong product is installed, enhancement of the vibration effect can occur. The natural frequency of the mount must not coincide (within a factor of 2) with the natural oscillation frequency of the loaded floor. The structural design group should be able to estimate the approximate natural frequency of the structure at the mounting point so that the correct mount can be specified. Missile prevention Secondary missiles are those picked up by the blast wind produced during an explosion. The blast winds can reach sonic speeds, therefore there is potential to move objects of a significant size. Maximum blast wind speeds are found around the edges of the module where explosion gases are venting. In most modules this is where escape routes are located so these are the areas where personnel are in most danger from impact from missiles, and being knocked over. The philosophy for minimising the potential for missile generation is to ensure general tidiness, especially in the hydrocarbon processing areas and areas adjacent to the TR. Small items such as fire extinguishers and items of safety equipment should be kept in cabinets firmly fixed to the structure preferably against a partition or structural member where blast wind will have little effect. There should be no loose items in the module, i.e. items that are not fixed to the structure or substantial equipment items. Maintenance equipment such as scaffold poles and tools should not be stored in process areas and should be removed when no longer required.

3.5.6.10

Deluge

The Phase 3a Advantica tests at Spadeadam [3.24] confirmed that deluge can significantly reduce high explosion overpressures. The benefits of deluge have now been incorporated into the major CFD and some phenomenological simulation software. Fears that the deluge would provide an ignition source through electrostatic effects have proved unfounded [3.25] although there is a residual doubt about the ignition potential due to charge accumulation on isolated conductors e.g. scaffolding. The initiation of deluge and water curtains on a quiescent gas cloud may induce turbulence in the cloud, limit ventilation and mix an inhomogeneous cloud. These effects could give rise to higher overpressures. The mechanism by which this mitigation occurs is by inhibition of the combustion process and by cooling of the products of combustion as the deluge water is converted to vapour. Deluge from standard medium velocity (MV) or high velocity (HV) nozzles has been found to be suitable for reducing overpressure in congestion generated explosions. Congestion generated explosions are characterised by a fast moving flame front. This acts on the droplet to break it up and give a greater overall surface area so that it more efficiently achieves the quenching effect on the combustion mechanism. The usual general area coverage rate of 10 l min-1 m-2 [3.26], even with 15 % added for hydraulic imbalance, falls outside the rate investigated in the JIP tests [3.24]. If explosion mitigation is considered critical a deluge flowrate of at least 13-15 l min-1 m-2 is recommended for general area coverage. This will have a significant effect on lowering peak overpressures. Greater flows up to about 20 l min-1 m-2 will have a marginally increased benefit. Where the overpressure is generated by confinement, for example in completely enclosed modules, there is insufficient kinetic energy in the flame to break up the deluge droplets in order for them to be effective. In enclosed modules deluge will be ineffective in lowering explosion overpressures and may even result in an increase due to turbulence caused by the water spray.

Issue 1

May 2007

Page 132 of 493

FIRE AND EXPLOSION GUIDANCE It is important that the deluge is employed as area coverage rather than equipment specific protection. Equipment specific protection only applies deluge to small discrete areas and this is not sufficient to give any meaningful control of overpressure. For large open deck areas, such as F(P)SOs, the process area is generally divided into fire zones in order to limit the size of the firewater pumps. On large open decks firewalls are not generally practicable so the deck is divided into fire zones where fire events may be expected to be confined; these may be discrete process blocks or pre-assembled units. Firewater pumps are sized to deluge the zone in which fire detection takes place, and immediately adjacent zones. Large gas clouds can, however, cover a number of such fire zones. This means that there is insufficient water supply to cover the whole flammable cloud. For these applications and where equipment specific deluge only is installed, water curtains may be used to arrest the flame velocity and prevent runaway flame acceleration. A double curtain of MV nozzles supplying water at a rate of about 15 l min-1 m-2 for the area covered by the curtain and spaced at 10 m intervals should be effective in arresting runaway flame acceleration and prevent excessive overpressures. Other devices such as fan sprays have also been tested and may give coverage more suited for curtain use. Deluge would then be applied to the fire zone where initial gas detection takes place with water curtains supplied simultaneously from a separate deluge valve. Some CFD overpressure modelling programs can accommodate the effect of water curtains so an optimisation of frequency and coverage of curtains within the practicalities of firewater demand can be undertaken. A major problem in determining risk levels for an installation with explosion mitigation by deluge is determining the level of risk reduction that can be assumed. This is due to at least two factors; •

the delay between leak initiation and deluge being applied to the module;

•

the reliability of the deluge system, from detector device through to deluge nozzle.

For the majority of low explosion over-pressure events there is no benefit particularly if the coverage is incomplete These factors can be however estimated from knowledge of the equipment and systems within the module. The benefits of explosion mitigation by general area may deluge may only be considered only if a time dependent ignition probability is used and the deluge can be applied within the reliability constraints of the system.

Issue 1

May 2007

Page 133 of 493


Further explosion mitigation systems

Other mitigation systems that have been proposed include; •

inert gas

•

barriers

•

soft barriers

•

micromist

Inert gas Inert gas can be used to dilute the flammable mixture by flooding the volume within which the gas has been detected, with for example CO2, N2. The explosive gas can then be taken below its lower explosive limit. This is most appropriate for enclosed volumes where the environment can be controlled. Care should be taken in providing such systems as they can pose a significant asphyxiation risk to personnel and they should be discounted if the overall risk of using them is greater than the explosion/fire risk saved. This might particularly be the case for generally manned areas. Inergen © (CO2 + N2 + Ar) is an alternative inerting material but it has a volume 30 times that of Halon systems for which it is a possible replacement. Barriers Barriers can be used for four purposes; 1. protecting areas behind the barrier from the overpressure effects generated in the explosion zone; 2. limiting the size of the explosion zone and thus the largest dimension over which the flame can propagate; 3. limiting cloud spread to ignition sources; 4. limiting the number of people directly exposed. Blast walls have long been used to protect adjacent areas from the effects of overpressure. These walls are designed to absorb blast energy by displacement. There may be a partition wall (e.g. B15 partition) on the non-hazardous side which will move sympathetically with the blast wall, the air gap between the two acting as a spring. If the wall forms the boundary to a control area housing safety critical equipment the effects of this movement needs to be taken into account. That is, shock sensitive equipment should not be located along this wall unless it can be demonstrated that the effects will be negligible. By limiting the size of an explosive gas cloud the overpressure can be reduced. As long as confinement is controlled decreasing the size of a module by inserting barriers can result in a reduction in maximum flame path length and therefore a reduction in the overpressure generated. It is important that these barriers maintain their integrity and do not give rise to their own hazards by displacement and impacting on safety critical plant or by becoming missiles. Mitigation measures aim to protect personnel or equipment from the explosion event. Protection from the direct effects of blast can be achieved by the barrier method, that is, the intervention of a blast wall between the explosion zone and the area to be protected.

Issue 1

May 2007

Page 134 of 493


Soft barriers

Progress is being made in the manufacture of the Micro-mist device [3.27] which has been tested as part of a recent joint industry project and consists of a cylinder of superheated water which is released quickly as a fine mist in response to pressure, flame sensors during an explosion. This device suppresses the explosion and has been shown to be successful in significantly reducing overpressures. Accidental activation of these devices is not a hazard to people.

3.6

Particular considerations for floating structures, storage and offloading systems

3.6.1

Introduction

Floating structures for production, storage and offtake have been used safely and reliably throughout the oil industry for many years. Early installations were primarily floating storage and offtake vessels, “FSO”, but today the modern floating production, storage and offtake vessel, “FPSO”, includes processing equipment and a higher level of sophistication. Consequently, the FPSO becomes an offshore producing installation, storage facility, and loading terminal all rolled into one unit. The early “ship-shaped” vessels, developed in the 1980s, took advantage of a severe downturn in the tanker market and were converted from relatively new tankers. More recently, the tendency has been to use new, purpose-built, ship-shaped hulls, particularly for FPSOs associated with long lived projects. Conversions of tankers, both old and new, continue to take place. There are many different types of design, weather-vaning with internal or external turrets or spread moored that maintain a fixed orientation. The FPSO and the FSO present many of the same hazards to personnel and the environment, although the added complexity of production facilities on the FPSO increases associated risk. The guidance in this section relies heavily on the published guidance of UKOOA, [3.28] and the draft guidance being prepared by OGP [3.29]. This Guidance will adopt the OGP nomenclature and when considering an issue applicable to both types of floating installation will use the term F(P)SO. A number of features impact fire related hazards on floating installations; for example, the geometry of the layout, compartmentalisation, operations, fire scenarios, response characteristics of marine construction to fires and the vulnerability of marine systems associated with the motion, station keeping and stability. The effects of fire on these features are discussed further in the following sections.

3.6.2

Marine life cycle considerations

F(P)SOs usually consist of a marine structure supporting process and utilities decks of a conventional offshore construction. These differing methods of construction are governed by differing regulatory regimes. For the UKCS, the application of SOLAS and MODU codes without demonstration of validation by the additional risk assessments normally required by PFEER will be insufficient for the treatment of fire events.

Issue 1

May 2007

Page 135 of 493

FIRE AND EXPLOSION GUIDANCE Some specific attributes to be considered on F(P)SOs are; •

Fire-fighting in the enclosed compartments containing marine systems (e.g. engine rooms, DP control rooms, generators); fire fighting techniques will include inerting, with the ramifications this entails for personnel access and the requisite alarms

•

As the process and utilities modules are normally located above the vessels deck (and the cargo storage), the process and utilities deck areas will be large, usually of one or two levels. Segregation to avoid escalation of a fire can be achieved by separation of modules occasionally further separated by fire barriers, (this may or may not help explosion overpressures but will impair the dispersion of released hydrocarbons). • The fire risk analysis undertaken on F(P)SOs will consider the nature of the hydrocarbon fuel source as well. Due to the nature of the storage on F(P)SOs, the fields they are generally use for tend to be crude that can be stabilised fairly readily. F(P)SOs may be required to hold stored product in their cargo tanks for typically 3 to 7 days dependent upon their geographic location. The F(P)SO solution is therefore less favoured for more volatile reservoirs.

•

The (potentially) long process and utilities decks and their orientation with respect to wind conditions will be affected by the weather-vaning of the F(P)SO. The top decks should be designed to follow a hazard gradient from the most hazardous area with respect to fires (and explosions) to the least hazardous. This will generally be from the turret outwards. Due to the weather-vaning effects (either due to wind or current and their effects on the superstructure height and hull draft) the fires can escalate downwind and at the very least, toxic products of combustion will be distributed downwind. The layout should consider these additional hazards and the design should accommodate them to maintain levels of safety. (Some designs have used DP to adjust the F(P)SO orientation in the event of a release or a fire hazard although the DP then becomes a Safety Critical Element and subject to the development of Performance Standards and integrity assessments required in the UKCS.)

•

On an F(P)SO, escape routes and piping runs may be very long and tortuous and personnel may need to pass the origin of the incident to reach the Temporary Refuge. Consideration in the design of escape over long distances during incidents and incident escalation should be a key issue.

•

Fire water mains will also be extensive and distant from the fire pumps in the process area. Correct fire-pump sizing and firewater-main hydraulic analyses will be required to ensure adequate pressure at deluge points, hoses and monitors.

•

Buoyancy, stability and station-keeping must be maintained at all times, and the systems associated with these duties must be protected from fire hazards.

F(P)SOs also require specific consideration of major fire hazard and release scenarios unique to their design and operation. •

Oil storage tanks – May present hazards in the form of either large scale storage of stabilised crude or with empty storage tanks containing potentially explosive mixtures.

•

Non-process hydrocarbon inventories – The F(P)SO is a power-hungry installation and requires substantial stores of diesel to maintain station, process and utilities power demands plus other life-support systems. The vessels are often located in difficult or remote places and will generally be designed to be “self-sufficient” for extended periods in the event that supply vessels cannot reach them.

Issue 1

May 2007

Page 136 of 493


Jet fires on main deck – The process decks on F(P)SOs are often lifted clear of the cargo storage tank roof for several reasons, (see bullet points below) a 5 m gap is not uncommon. The space provided also allows jet fires from the underside of the process to reach other process or utility modules without any impingement to reduce the effect of the flame. The gaps provide other risk reducing and operational benefits but steps can be taken to reduce the likelihood of jet fires by careful layout and orientation of the higher pressure equipment.

•

A gap will allow “green water” to flow over the main deck without placing an excessive load on the process modules supports by creating restrictions and eddy current effects.

•

A gap allows a clear and uninterrupted space for long piping runs (both process piping and storage tank vent and balancing lines)

•

A gap allows personnel access across the vessel, both for normal operational and maintenance access as well as facilitating emergency response.

•

Swivel connections, a source of releases – The turret contains a large number of swivel joints in order to function, these are often at the highest process pressure and pass the reservoir fluids prior to any cleaning or conditioning and are therefore subject to the F(P)SOs most onerous process duty.

•

Offloading and pool fires on the sea – Offloading to shuttle tankers is a regular event and poses a significant risk both on the F(P)SO and the shuttle tanker. The risks comprise the breakage or leakage of the transfer hoses and the potentially flammable mixing of hydrocarbon and air in the storage holds of F(P)SO and shuttle tanker. During the offloading operation, the shuttle tanker and F(P)SO are in relative proximity and the risks on either vessel are compounded by increased potential for escalation to another vessel.

3.6.3 Application of fire and explosion hazard management to floating structures 3.6.3.1

Topsides considerations

The storage and transfer of hydrocarbons on F(P)SOs present particular hazards to personnel and the environment and some of these have been listed above. This sections describes further measures that can be applied to the management of fire hazards in the F(P)SO topsides. There is a need to continuously vent hydrocarbon vapours during loading, it is important that the venting system be designed to accommodate the maximum volume of volatile organic compounds (VOCs) vented from storage. Allowance must be made the higher temperatures the vents will experience when venting during maximum production rates and as well as providing design allowances for possible process upsets. In some areas, local regulations or guidelines limit the amount of VOCs that may be released to the atmosphere. It is always good practice to adopt loading procedures that will minimise VOC emissions. The atmosphere in the F(P)SO tanks is to be maintained in a ‘non explosive’ condition. The normal method is to supply low oxygen content combustion products to the tanks from boiler uptakes or from an independent oil or dual fuel generator. Cargo tank purging must be carried out before introducing air to the tank to ensure that the atmosphere will at no time enter the flammability region. The guidelines given in Chapter 10.0 of ISGOTT [3.30] should be strictly adhered to during this operation. Issue 1

May 2007

Page 137 of 493

FIRE AND EXPLOSION GUIDANCE F(P)SOs need special consideration due to the potential venting of hydrocarbons either near the process plant or near the flare stack. Calculations will have to be made at the design stage to ensure that carry over of hydrocarbons from the inert gas stack will not interfere with day to day operations. It is recommended that the inert gas system comply in all respects with the requirements of SOLAS and the relevant IMO guidance notes. Prudent operators may also consider maintaining 100 % redundancy for this critical component. After purging, the tank must be gas freed in order to remove the residual inert gas from the tank and replace it with a normal atmosphere containing 21 % Oxygen. The issue of VOC return lines and their use during offloading represents a key safety issue. The operation of VOC reclamation represents a highly hazardous situation where flammable mixtures of hydrocarbons are returned to the F(P)SO. An added complication is that the offloading and reclamation systems may often be combined as a dual hose system and for F(P)SOs with stern accommodation, the offloading and reclamation point may be located close to the accommodation and TEMPSC. Due to the longer term storage (compared with most other offshore installations), water and other contaminants in the crude can accelerate corrosion of the F(P)SO storage structure and systems resulting in premature failure and, potentially, escape of hydrocarbons. Design allowances should not be based on ideal crude conditions but should consider a realistic appreciation of operational practices.

3.6.3.2

Vessel and marine considerations

The layout of surface and sub-sea facilities must be carefully considered early in the design to account for the following shipping related hazards (that may give rise to loss of integrity and fire): •

Passing ships and local community activities, such as fishing;

•

Supply and maintenance vessels in relation to anchoring or dropped objects;

•

Anchor mooring patterns of drilling rigs during locating and moving;

•

Safe access by offtake tankers, avoiding interference with other moorings, flowlines and risers as well as other field operations.

The field layout must also consider the need for offtake tankers to approach the F(P)SO, moor, load their cargo, unmoor and proceed to open waters, always in safety. The parameters for achieving this, which will include manoeuvring areas and weather limits on operations for the tankers, may be derived by means of a risk assessment study as described in OCIMF Offshore Loading Safety Guidelines: With special reference to harsh weather zones [3.31]. Additional reference material for Offshore Loading may be found in UKOOA’s guidelines for tandem off-loading from FPSOs/ FSUs to shuttle tankers [3.32]. Thrusters may also be useful in fire or platform abandonment scenarios where the vessel can be rotated to clear fire or smoke from around production areas and living quarters and to provide a lee side for survival craft launch. When designed for a safety function, it should be noted that thrusters will be considered to be Safety Critical Elements. Due to the vessels being in very close proximity, the risk of a fire or explosion on one vessel affecting the other is greatest during offloading. Issue 1

May 2007

Page 138 of 493

FIRE AND EXPLOSION GUIDANCE It is important that the F(P)SO is equipped with emergency shutdown and release equipment that will allow the vessels to part in the event of an emergency on one vessel.

3.7

Particular considerations for mobile offshore units

3.7.1

Introduction

Units that work in the North Sea will generally conform to three types of which two are more common. Ship-shape units are not often used for drilling, as their motion characteristics are often not suitable for drilling in harsh weather. A small number of construction and well intervention vessels work in the calmer weather months. Most MOUs in the North Sea are of two types, Semi-submersibles and Jack-ups. Semisubmersibles have more in common with floating structures while jack-ups have more in common with fixed structures. This specialist subset is termed Mobile Offshore Drilling Units, or MODUs. Though they are fundamentally different from each other, they do have one thing in common. They are vessels subject to the Conventions and Codes of the International Maritime Organisation, or IMO, and thus emanate from a long-standing marine tradition.

3.7.2

MODU classification

The UK Safety Case Regulations do not stipulate design safety cases for MODUs. However, MODUs are subject to Classification Society rules for design, construction, and operation. Generally, certificates are subject to renewal every five years with intermediate surveys of a less intrusive nature ranging from every year to every two and one-half years. General areas of interest with respect to fire hazards include such items as: •

Structural fire protection layout plan for decks and bulkheads;

•

Fire extinguishing systems;

•

Recommended sequence of emergency shutdowns;

•

Hazardous areas.

The ABS published Classification Guidance contains a whole chapter on Fire Safety Features, including: •

Fire control plans;

•

Fire pumps;

•

Fire main;

•

Hydrants, hoses, and nozzles;

•

Fixed fire fighting systems;

•

Extinguishing systems (CO2, foam, water spray, portable extinguishers, etc.);

•

Fire detection/alarms;

Issue 1

May 2007

Page 139 of 493


Gas detection/alarms;

•

General alarm;

•

Area or specific alarms;

•

Fireman’s outfits;

•

Other PPE;

•

Helifuel;

•

Paint lockers.

Any reader will quickly note there is a distinctly marine “feel” to the rules. This is appropriate as hydrocarbons are seldom present on MODUs as much of their time is spent in transit between locations, thus the threat of types of fires that occur on ships is given attention. In the main, Conventions and Codes of the IMO are meant to apply to vessels on international voyages, not when the vessel is undertaking its industrial function. Though these rules are prescriptive, the great number of ships in the world’s fleet lends of validity through experience. Marine tradition refers to conventional ships on long distance voyages who must cope with mishaps such as shipboard fires and explosions with faint prospects for immediate rescue. This tradition has within it the experience of thousands of ships but scant experience of live hydrocarbons. Perhaps it is best characterised as highly worthy knowledge in its own right but not directly coincident with the newer oilfield traditions. Obtaining and remaining in class is very important for a MODU. Otherwise, it would not be able to obtain hull insurance. Minimising losses is important for underwriters so MODUs are able to benefit from loss reduction strategies of the world’s fleet of ships, and the considerable reservoir of experiences thus represented.

3.7.3

Conventions, codes and regulations

3.7.3.1

Introduction

MODUs are also subject to flag-state rules for operation under the conventions (roughly equivalent to regulations) and codes (roughly equivalent to guidance) of the IMO. The flagstates are responsible for enforcing the conventions and codes of the IMO through their national legislation. The most significant IMO instruments are the international conventions for: •

Safety of Life at Sea (SOLAS) [3.3];

•

Prevention of Pollution from Ships (MARPOL) [3.33];

•

Load Lines (LL) [3.34];

•

Standards of Training, Certification and Watch-keeping (STCW) [3.35];

•

Preventing Collisions at Sea (COLREG) [3.36];

•

Tonnage Measurement (Tonnage 69) [3.37].

Issue 1

May 2007

Page 140 of 493

FIRE AND EXPLOSION GUIDANCE For the purpose of this guidance, SOLAS is the most relevant and is discussed further in the next section. The IMO MODU Code is also important, covering the construction and equipping of Mobile Offshore Drilling Units [3.38], and discussed further in the section following SOLAS.

3.7.3.2

SOLAS

SOLAS Chapter II Construction – Subdivision and stability, machinery, and electrical installations The parts of interest (within SOLAS) are: Part D – Electrical Installations: Precautions against shock, fire, and other hazards of electrical origin Part E – Additional Requirements for periodically unattended machinery spaces: Fire precautions, alarm system, safety system, and special requirements for machinery, boiler, and electrical installations SOLAS Chapter II – Fire protection, fire detection, and fire extinction The whole of Chapter II is relevant. Coverage includes: •

fire pumps;

•

fire mains;

•

hydrants/hoses;

•

fixed gas fire-extinguishing systems;

•

fire-extinguishing arrangements for machinery spaces;

•

foam systems;

•

water systems;

•

arrangements for fuel/lubricating oil/other flammable oils;

•

ventilation;

•

fire control plans, etc.

In addition, details for passenger ships, cargo ships, and tankers are given and will be of interest.

3.7.3.3

MODU code

There are two versions of the MODU Code. The 1989 Code [3.38] is meant to be applied to units constructed after 1 May 1991. The 1979 version of the Code applies to earlier units. The 1989 Code addresses fire/explosion safety in the following chapters: Chapter 4 – Machinery installations for all types of units 4.7 – Arrangements for oil fuel, lubricating oil, and other flammable oils Issue 1

May 2007

Page 141 of 493

FIRE AND EXPLOSION GUIDANCE Chapter 5 – Electrical installations for all types of units 5.5 Precautions against shock, fire, and other hazards of electrical origin Chapter 6 – Machinery and electrical installations in hazardous areas for all types of units 6.1 to 6.7 – Zoning of hazardous areas and the types of machinery in these areas Chapter 8 – Periodically unattended machinery spaces for all types of unit 8.3 – Fire safety Chapter 9 – Fire safety 1 to 13 – Structural fire protection, accommodation, means of escape, fire pumps/mains/hydrants & hoses, systems in machinery spaces, portable extinguishers, fire detection & alarms, gas detection & alarms, firemen’s outfits, helicopter facilities, storage of gas cylinders, and miscellaneous items.

3.7.3.4

Overview of MODU operations on the UKCS

MODUs operating in the North Sea area are generally prepared to drill a range of wells of different types in order to meet the needs of the client oil companies. Though there are fire risks from flammable materials on MODUs, about half the risks with the greatest consequences are presented by the hydrocarbon accumulation the MODU has been hired to exploit. The Formal Risk Assessment required in a UK or North Sea Safety Case overlays all the provisions from fire and explosion protection that Classification, the flag-State rules, and MODU Code. However, there are two main differences. 1. The rules emanating from the IMO are prescriptive. The risk reduction model is the marine industry acting on the experiences of the world’s shipping fleet. 2. The model of model of application is for ships on international voyages, not vessels undertaking industrial processes.

3.7.3.5

MODUs and the UK Safety Case

Generally, oil companies hire MODUs to pursue drilling campaigns. The campaigns can be short (one well of less than 30 days duration) or as long (3 years or longer on rare occasions). In the UK, it will be necessary to for the MODU to have an accepted safety case before drilling can begin. The main hazards a MODU faces are listed below: •

Helicopter crash;

•

Fire;

•

Explosion;

•

Major mechanical failure;

•

Blowout;

•

Toxic release;

•

Dropped object;

Issue 1

May 2007

Page 142 of 493


Structural failure;

•

Mooring failure;

•

Ship collision;

•

Loss of stability;

•

Towing incident.

The most serious of these incidents requires a PFEER Assessment [3.39] in order to be sure the personnel can escape to a place of safety. The hazard assessments generally undertaken for MODUs start from the hazard list described in Table 3.10. It is worthwhile pointing out that the MODU Owner will generally engage the crew in a compartment-by-compartment analysis for fire and explosion risk. This utilises the greatest knowledge asset on the rig, namely the crew, who are exposed to the risk. Following from this approach, the qualitative method is preferred. The quantitative assessments (QRA) that take place are generally done to meet statutory requirements for integrity of the Temporary Refuge. The QRA calculations are most often carried out by consultants outside the MODU Owner’s organisation. The crew are generally not in the habit of assimilating this level of detail of information. Table 3.10 - Typical hazard list showing preliminary PFEER assessments Item no.

Type of event

Fire & explosion consequences

Comments and description

Shallow gas blowout, subsea

Yes

MODU Owner depends on the client oil company site selection and shallow gas detection by seismic plus experience in the area (if available)

Shallow gas blowout in the cellar deck

Yes

Usually occurs when the riser is attached (semi) or drilling out the first (structural) string of pipe (jack-up). Same comments as shallow gas blowout, subsea, above, apply.

Reservoir blowout at drill floor

Yes

The client oil company’s drilling programme is required to analyse and predict reservoir content (gas or oil), pressure, and temperature, any other relevant characteristics.

Toxic release

gas

No

This scenario is meant to cover precautions against the toxic effect of H2S on personnel. MODU Owner depends on the client’s drilling programme.

Gas release/ignition in mud processing areas

Yes

Caused by gas entrained in the drilling mud. Consequences are more severe for oil-based mud. MODU Owner “works as directed” by the oil company and thus depends on oil company’s drilling programme and consultation with his site personnel to predict the likelihood of and to control this event.

6

Well test area fire/explosion

Yes

Occurs during flow testing of wells only.

7

Accommodation fire

Yes

Covered by class, flag-state rules, and MODU Code

1

2

3

4

5

Issue 1

May 2007

Page 143 of 493

FIRE AND EXPLOSION GUIDANCE Item no.

Type of event

Fire & explosion consequences

Comments and description

Machinery space fire/explosion

Yes

8

Covered by class, flag-state rules, and MODU Code

9

Helicopter crash into the sea

No

Client’s standby vessel covers this scenario

Helicopter crash on the installation

Yes

MODU helideck requirements are the same as for fixed producing installations, per ICAO rules for design, augmented by such instruments as CAP 437 [3.40] in the UK.

Collision

No

MODUs have provisions for survival in damaged conditions. They rely on the client oil company to provide information such as proximity so shipping lanes and on the clientcontracted standby vessel to warn errant vessels away.

Structural failure due to extreme weather

No

Covered by Class, flag-state rules, and MODU Code

Mooring failure

No


Loss of stability

No


15

Loss of control in transit

No

i.e. loss of towline

16

Man overboard

No

Client’s standby vessel covers this scenario.

10

11

12 13 14

Half of the events in Table 3.10 above that cause serious concerns on a MODU involve fire and explosion. This is a very significant proportion. Thus, the question occurs as to how the fire and explosion expert(s) might apply themselves to reducing the risks faced by MODUs. The information given below is meant to stimulate further consideration. Particular circumstances and personnel roles will have large roles to play. From the hazard events itemised above in Table 3.10, it can be seen that of 16 event categories, 8 consider fire (and explosion) events. Event categories in item numbers 1, 2, 3, 5 and 6 are caused by well upsets and three of the remaining hazard categories consider nonwell events such as; 1. Accommodation fire 2. Machinery space fire/explosion Which are covered by classification, flag-State and MODU Code, and: 3. Helicopter crash on the installation. Which is common to all installations and is considered by the design guidance in CAP 437. The inspection of helidecks is covered by BHAB inspection of the installation.

Issue 1

May 2007

Page 144 of 493


Pre-hire surveys

Many oil companies use 3rd party inspectors to perform pre-hire checks on the rigs they intend to contract. The items listed below cover many equipment categories that the surveyors generally cover which will have an impact on fire and explosion hazards. •

Typical items for pre-hire surveys:

•

Well testing equipment;

•

Electrical safety;

•

Automatic fire detection system;

•

Fixed fire extinguishing systems (water & foam);

•

Breathing apparatus;

•

Electric safety;

•

Blow out prevention equipment (BOPs);

•

Well control equipment;

•

Fire control system;

•

CO2 system for fire control;

•

Portable extinguishers and fire fighting equipment;

•

Gas detection system;

•

Safety.

3.7.3.7

Classification society surveys

Classification societies will carry out surveys of vessels to ensure that they continue to comply with class requirements; these will be carried out against the rules issued by the class societies referred to throughout this section. The survey reports generally stay on the unit and at the field office.

3.7.3.8

The well programme

The well programme lays out the plan for drilling the well, including predictions for formations to be encountered, along with the types of fluid in the formations (oil, water, or gas). Part of the programme will deal with site assessment, covering the prospects for encountering shallow gas. The programme should offer information regarding whether H2S is likely to be encountered. The type mud system to be used will be detailed for each hole section. If well testing is foreseen, the details of the flow rates likely to ensue will be given along with the duration of the test and the sampling foreseen. Well testing is given separate treatment below.

Issue 1

May 2007

Page 145 of 493

FIRE AND EXPLOSION GUIDANCE There is no equivalent of a design safety case for wells. However, the Safety Case Regulations require operators to apply a process termed Well Examination. This regulation requires that operators file their well programmes with the HSE a minimum of 21 days before operations are due to begin. The details to be submitted are spelled out in some detail. If there is no objection from the HSE, work can begin. However, if there are material changes in the well programme, an independent, competent person known as a Well-Examiner, must agree the change does not pose an increase in risk. For the MODU Owner, the benefit of a statutory Well Examination is that the programme is fixed in good time for the MODU operator to interpret the results and implement remedial measures. The Well Examination process also ensures there is a process for ensuring changes are subject to risk analysis. The well programme covers 5 of the 8 contingencies involving fire and explosion.

3.7.3.9

The MODU safety case safety management system

3.7.3.10

Well testing

Though the Well Programme covers the objectives of well testing, it may not provide copious detail on the well testing equipment. On many rigs, well testing equipment is not permanently installed. It is brought to the rig when well testing is foreseen. On rigs where the installation is permanent, maintenance of such equipment is not generally within the core skill and experience of the drill crew. Few drilling specialists have extensive experience testing wells. The Safety Case can only generally cover the well testing equipment and cannot be very specific as there are many different manufacturers, different layouts for this equipment, and different crews generally man the well test equipment. Therefore the constructive overview of a fire and explosion specialist should be included in these circumstances.

3.7.3.11

Recommended approach

The following is written from the perspective of an oil company contracting for the services of a MODU. Generally, the oil company will likely have staff or have access to internal or 3rd party specialists specialising in fire and explosion; MODU Owners generally do not. In this situation, it seems natural for the oil company specialist to at least have an overview. It is probably suboptimal to ask the MODU Owner to do everything; on the other hand, it is probably sub-optimal to make numerous in-depth enquiries of the MODU Owner when many aspects are covered by Classification or Flag-State rules. A co-operative, balanced, and constructive overview into all aspects of fire and explosion aspects is recommended. Any enquires should respect the culture and strength of the MODU Owner. Chief amongst these is that the MODU Owner’s greatest asset is the crew. Some of their number will have participated in or have knowledge of the rig’s treatment of fire and explosion. Rig crew use the “hands on” approach. Thus, their expertise can best be assimilated by use of qualitative information as this is the type of information with which they are most familiar. The nature of shipping rules has been that they are the accumulation of experience, derived from incidents, near-misses and other “lessons learned”. The information contained within these prescriptive rules is therefore statistically valid and represents a distillation of experience from the world’s shipping fleet.

Issue 1

May 2007

Page 146 of 493

FIRE AND EXPLOSION GUIDANCE Given the diverse character of information for fire and explosion on MODUs, the list of key application issues given in Table 3.11 below could function as a starting point for assessments. Table 3.11 - Key MODU application issues Item

Overview

MODU Classification

Be aware of the Classification Society. Look up and become familiar with their rules. The MODU Owner will have records of the ongoing surveys.

Flag-State

Be aware of who the flag-State is. Look up and become familiar with their rules. The MODU Owner will have records of the ongoing surveys.

MODU Code

Be aware if the unit has a certificate and whether it is 1989 or 1979. Be familiar with what it contains.

Safety Case

Be aware of the analyses in the safety case for fire and explosion, especially those with PFEER Assessments. They represent the risks with the most severe consequences.

Pre-hire survey

Have a look at the fire and explosion aspects of the pre-hire survey, provided, of course, such a survey was performed.

Well Programme

Have a look at the well programme from the point of view of the MODU Owner. Judge whether you would be happy with the information in the programme in terms of preventing fire and explosions? If not, it would be a service to both oil company and MODU Owner to point out where better information would be beneficial.

SMS Audits

The MODU Owner’s own audits can provide information on the standard of maintenance. It would be a good thing to be aware of the audit findings. Further delving could be undertaken if an overview gave cause for concern.

Verification Safety-critical Elements

of

Well testing

The same comments apply here as above for SMS audits.

Probably the area where the fire and explosion expert might make best input. Well testing can be infrequent and thus less familiar. An overview of the equipment, procedures, and risk analyses may well prove beneficial in terms of risk reduction.

3.8

Particular considerations for existing installations

3.8.1

General

In the UK sector of the North Sea, it is a requirement (SCR) [3.14] that significant changes in an installation or its operation will require the Safety Case to be resubmitted which should address a review of hazards including a re-assessment including those due to explosion hazards. Even if an installation has not been modified or its use has not been changed a reassessment may be required to take account of advances in methodology. Existing mobile installations entering UK waters will also require assessment. The assessment of existing structures differs from the assessment of a structure during design in three important respects. 1. There is relatively little scope for the reduction of the frequency of a release and scope for mitigation of the severity of an explosion may be limited. Issue 1

May 2007

Page 147 of 493

FIRE AND EXPLOSION GUIDANCE 2. Intervention may give rise to an additional hazard which must be assessed. 3. Information may be available relating to expected explosion loads, structural and equipment response from the detailed design stage of the design and construction project. Information should be available from the Safety Case, the original CAD and structural computer models of the facility. The Individual Risk (IR) per annum TRIF and PLL will have been used in the demonstration of ALARP in the existing Safety Case for the installation. Use may be made of experience gained from the operation of the un-modified installation and from similar installations. The computer data files and design reports should be checked to confirm that they are a faithful representation of the present state of the facility. Should modifications be necessary to improve the safety performance of the facility, then the work to be undertaken should not in itself pose such hazards and risk to personnel that this compromises the gains to be achieved by such modifications. All modification work should be accompanied by hazard identification, assessment and other controls as determined by the Safety Management system as well as method statements for their implementation. All temporary structures and equipment utilised during the modification work should be removed as soon as the work is complete. The HSE reference [3.41] clauses 51 and 52, states “It should be borne in mind that reducing the risks from an existing plant ALARP may still result in a level of residual risk which is higher than that which would be achieved by reducing risks to ALARP in a similar, new plant. Factors which could lead to this difference include the practicality of retrofitting a measure on an existing plant, the extra cost of retrofitting measures compared to designing them on the new plant, the risks involved in installation of the retrofitted measure (which must be weighed against the benefits it provides after installation) and the projected lifetime of the existing plant. All this may mean, for example, that it is not reasonably practicable to apply retrospectively to existing plant, what may be demanded by reducing risks (to) ALARP for a new plant (and what may have become good practice for every new plant).” The overall individual risk and the TR impairment frequency (TRIF) from all hazards must still be less than 10-3 per year. If risks are in this intolerable region then risk reduction measures must be implemented, irrespective of cost.

3.8.1.1

Explosion hazard review

Review of explosion risk for existing installations, poses a number of difficulties. These problems generally relate to the difficulty in retrofitting structure and equipment in modules that are operational and congested, with the usual constraints in working in a cramped offshore environment. There may also be a problem accessing design data which should include modifications that have taken place since the facility was installed. The implementation of effective change procedures is essential in these circumstances. Before investigating the ability of the systems on the installation to withstand the blast effects, the facility should be reviewed with regard to the level of inherent safety that exists and what additional control mechanisms there may be for overpressure reduction. The existing wells may be operating at a lower reservoir pressure than originally designed for, however subsequent tie-ins may have offset this possible benefit.

Issue 1

May 2007

Page 148 of 493

FIRE AND EXPLOSION GUIDANCE For an existing installation there may be potential for: •

increased venting

•

additional and/or improved gas detection (acoustic gas detection)

•

introduction of flame detection

•

lowering the level at which gas detection initiates executive actions

•

voting for executive action on a single detector

•

initiation of deluge on gas detection

•

the removal of redundant equipment

•

the relocation of equipment blocking vent paths

•

vibration reduction

•

enhanced robustness of small bore connections

•

utilisation of past operational experience

•

improved inspection/maintenance regimes

Some of these actions may not necessarily result in a reduction of calculated Individual Risk or loss of life (as shown in the QRA) but this should not be a reason for failing to undertake modifications if actual reduction in explosion risk can be foreseen. Ideally, there should be no disproportionate contribution from any one hazard to the risk associated with the installation. For example fire and explosion hazards should contribute to the total risk at levels comparable with those for a similar installation. This is referred to as the ‘balanced risk contribution principle’. The general philosophy should be to bring all SCEs up to a similar level of integrity for all accidental events. These systems include but may not be limited to: •

the TR;

•

escape routes to the TR;

•

evacuation systems;

•

systems that could threaten the integrity of the above systems, e.g. ESDVs isolating off-site inventories.

In effect the list may include all the identified safety critical elements but, with respect to the ability to muster, assess and evacuate, some Safety Critical Elements may be in Criticality Levels 1, 2 or 3 as described in Section 3.5.5.

3.8.1.2

Use of previous analyses

A review will need to be undertaken of the ability of safety critical systems to withstand overpressure/drag effects. Whilst increased knowledge of the explosion phenomenon has resulted in a general increase in the overpressure loadings that are calculated for a given configuration, it is frequently the case that the integrity of systems is greater than originally assumed. The experience of the JIP full scale tests [3.42, 3.43 and 3.24] tended to confirm this in that damage incurred was significantly less than might have been expected for the high overpressures experienced.

Issue 1

May 2007

Page 149 of 493

FIRE AND EXPLOSION GUIDANCE Where it is clear from preliminary inspection that it will be impracticable to meet maximum overpressures that may arise, there would seem to be little to be gained in determining to the last degree of accuracy what the actual overpressure characteristics will be. Simpler phenomenological models or comparison with similar installations would be adequate for the purposes of quantifying the residual risk. (Note: the requirements of the SCR [3.14] imply that some form of overpressure calculation will be necessary in order to quantify the risks involved in mustering within the TR. The need to determine potential for TR damage would then seem to be necessary). The aim should be to bring the design up to the same level of integrity for all major SCEs with the presumption that more effort should be made where the level of risk from explosions is high. Existing installations will have QRA data from which explosion risk can be determined. Where this is high for explosion events the premise should be that greater cost is justified in providing mitigation and protection than where the risk posed is relatively low. A means of determining the cut off point for additional mitigation would be to determine the costs involved with design enhancement to achieve integrity for successively increased overpressure values. Where a significant ‘cliff edge’ occurs this may indicate that design beyond the base of the cliff edge is not reasonably practicable and that design to this level is ALARP. The accepted level above which the overall risk is considered intolerable relates to an individual risk of greater than 10-3 per year or a TR impairment probability of greater than 10-3 per year. The overall individual risk from all hazards must be less than this value. If risks are in the intolerable region then risk reduction measures must be implemented, irrespective of cost. Hence the risk from other hazards may indirectly affect the acceptability of risk from explosions and these may need to be considered in setting the target risk levels for the explosion hazard. Where the original design took account of explosion overpressure, but latest knowledge indicates that this needs to be reviewed, then recalculation and re-assessment will be appropriate. The calculation of overpressure should however be reasonably straightforward if the original CAD model is available and has been updated to include changes made since the design stage.

3.8.2

Early operating phase

Vigilance is required in the early stages of field life for deviations from the original process, structural, mechanical or instrument design intent. Such changes need review for any implications for fire hazard creation or management. Such a review needs to be scheduled and chaired by the project safety engineer and attended by a mixture of design and operations personnel. It should take place after a year or two of operation. Since key project design personnel are likely to have moved to another project by that stage, an alternative would be for operations to log all variations to original design, operating or maintenance assumptions/intent for formal follow-up by the installation safety engineer in order that the implications for fire hazard management can be explored and corrective action taken if found necessary. Nowadays, plant modifications are closely scrutinised by a range of discipline engineers and onshore support staff for any detrimental effect on safety. Accumulated minor operating and maintenance changes (known as ‘creeping change’) however can go unremarked, unless vigilance is maintained.

Issue 1

May 2007

Page 150 of 493

FIRE AND EXPLOSION GUIDANCE Examples of the types of change that would not be obvious without a specific attempt to capture them are: •

Environmental data (sea level or weather pattern changes);

•

Instrumentation problems – e.g., leading to changed operator response to alarms;

•

New fire research findings;

•

Change in production composition or phases, leading to changed fire scenarios or release frequencies.

3.8.3

Midlife operating phase

Some typical considerations for fire hazard management of existing installations at the mid-life stage are: •

Creeping change in original design assumptions – examples are development of sand, vibration or corrosion problems, increasing the likelihood of releases in certain areas; changes in process conditions resulting in change to fire consequence modelling assumptions;

•

Fire-related protective equipment proves unsatisfactory in operation – detection devices give frequent alarms or are found to be failed at every inspection. Alarms that are too frequent are eventually ignored;

•

PFP left off vessels or other equipment for longer and longer periods to allow access for NDT/inspection;

•

Areas of the platform always ‘keyed out’ of the automatic fire and gas system;

•

Very slow process changes which come to be regarded as normal by operations personnel (e.g. more frequent alarms, very low or high operating temperatures etc.).

If minor deviations go unnoticed, over time it becomes custom and practice to operate outside the original design scope, and/or without all protective measures functioning. Problems then become apparent only during an emergency situation. Many of these minor changes would be identified by the independent competent person during the course of his examinations of safety critical equipment and systems, but some changes can still be missed. Most oil companies include operations personnel in their project teams. Often the intended OIMs plus key offshore supervisors are part of the project team specifically to become fully conversant with and supply operations input to the design process. Over a period of 10 years or so however, personnel change and key information, whether held personally, in hard-copy or in electronic format is likely to be lost if no active steps are taken to refresh the ‘corporate memory’ at regular intervals. In addition, over a prolonged period new research improves the understanding of the fire and explosion threats and the ability of the protective measures to counter the threat effectively. The implications of this updated knowledge must be taken into account and where necessary procedures updated including those related to emergency response.

Issue 1

May 2007

Page 151 of 493

FIRE AND EXPLOSION GUIDANCE It is thus recommended that a formal review (taking into account new research knowledge) or audit of the fire hazard management arrangements and records be carried out every 3 to 5 years.

3.8.4

Late operating phases

As platforms age the safety systems tend to require more repair and maintenance in order to keep them in full working condition. The late operating phase is also a time when the platform production tail off and there is a big drive to reduce OPEX costs. Fortunately, as platform age and production rates drop, process pressures also drop, water cut increases and fire risks tend to reduce. It is possible on some installations, where parts of the process have been simplified or decommissioned or where drilling activity is finished, to review a platform’s fire hazard management arrangements and remove fire protection equipment that is, by then, surplus to requirement. This can reduce the maintenance burden. Any such modifications have to be formally justified and recorded through the Operator’s Plant Modification Request procedures, and documented in the Safety Case and associated PFEER/DCR documentation. Typical Problems for the Late Operating Phase are: •

Degradation of Passive Fire Protection;

•

Corrosion of firewater systems and leaks in air-trigger systems;

•

Wear and tear on firewater pumps and deluge valve sets;

•

Obsolescence of parts for Fire and Gas detection/protection systems;

•

Increased leak likelihood due to sand erosion, corrosion (especially under lagging) and fatigue;

•

Tightened commercial constraints and reductions in manning.

Despite the associated cost of maintenance and inspection, the performance standards laid down for of all the safety critical systems, subsystems and individual items must either: •

Continue to be met as per the original design; or

•

Revised (with appropriate justification) to reflect the changing fire risk. The associated written schemes would be updated to reflect the changed performance standard in discussion with the appropriate Independent Competent Person(s).

3.8.5

Aging installations and life extension

3.8.5.1

Overview

Many installations in the North Sea have reached the end of their originally specified life but their continued operation is still worthwhile. Other installations have been modified to act as production hubs, taking product from other subsea wells or tie-ins and processing it, often with new or partially modified topsides plant, for export to pipeline or tanker. Asset life extension raises several issues in relation to fire hazard management, these are discussed in the following sections.

Issue 1

May 2007

Page 152 of 493


Design issues

New process plant needs to be provided with adequate fire and gas detection systems. The existing systems may be adequate to cover the new equipment or may need extending, but the same considerations as for a new design will still apply. The existing system may be virtually obsolete and not feasible to extend so replacement of the whole system may be required. The effect of the new plant on the ESD and blowdown systems must be evaluated in the light of the additional fire scenarios. It should not be assumed that tie-in to the existing platform blowdown system will be adequate, even though original demands on the system may have reduced. If the installation is old, the original blowdown system may have been underdesigned by comparison with existing best practice especially where severe fire scenarios are involved. All new fire scenarios must be reviewed for effect on existing deluge systems. A fire in the new plant may set off several other systems, especially on an open installation. The project may have to supply new fire pumps to cover the new plant as the existing pumps are unlikely to have spare capacity. The condition of existing pumps for extended future service must be assured. More use of passive protection may be possible, but providing facilities/access for integrity assurance for aging piping/structure/equipment must be considered. Existing deluge systems are often difficult to extend. The mechanical condition of the system needs to be assured for extended service. There may now be a new fire scenario with implications for important parts of the structure (e.g. the TR or TEMPSC areas or their supports) which are currently unprotected. (See Sections 3.2.8.9 and 10.3.2.2 for further discussions on the limits to PFP application, including some issues affecting retrofitting PFP to structures in situ). All escalation potential should be considered and the decisions relating to selection of protection recorded. New fire scenarios must be evaluated for impact on evacuation, escape and rescue. New support structure provided for the new plant may be vulnerable to fire impingement from existing fire scenarios, and may require protection.

3.8.5.3

Emergency response issues:

As platforms age, emergency equipment and facilities degrade. Although some items can be easily replaced once they fall below an acceptable standard, other items such as sea ladders, spider deck walkways, gratings on rarely-used escape routes to sea can fall into disrepair and are expensive to replace. Routes to sea are important in severe fire scenarios and must be kept up to standard as long as the fire hazard remains. Where new business is introduced over an old installation, new escape routes, as well as refurbishment of existing routes (where the original fire hazard still exists) may be needed.

3.8.5.4

General considerations

Fire hazards would be identified in the HAZID at FEED stage of the process modification design, and subsequently assessed as for any new design project. The impact of the new facilities on the existing fire and gas detection and protection systems needs to be documented and recommendations tracked to implementation. Issue 1

May 2007

Page 153 of 493

FIRE AND EXPLOSION GUIDANCE Incorporation of new safety critical items into existing Safety Case, SCE and PS related documentation is a legal requirement.

3.8.6 Particular considerations for accommodation and other areas for personnel 3.8.6.1

General

Much fire measurement data, definitions and internationally accepted standard tests have been developed from building fires and the damage caused. Many of these have been adapted for use on the appropriate sections of petrochemical plants and their shortcomings in wider applications should be understood. The following sections deal with some standard aspects of conventional onshore fires but practitioners should refer to standards produced for onshore and civil use for these “non-hydrocarbon” areas. Accommodation and other areas of the installation such as control rooms, some workshops (i.e. those without specific storage requirements for hazardous materials), leisure areas and galleys are all based on normal architectural practices. The internal materials are the same as onshore facilities and the design practices tend also to be the same with minor variation. The key difference with these areas is how they relate to process and other operating areas and extreme care should be taken to make sure that even the most apparently benign systems do not interface with a hydrocarbon system in an unforeseen manner. Key aspects where interfaces can occur are listed below and these should be assessed when considering the process fire hazards: •

HVAC;

•

Drainage;

•

Storage areas/enclosures;

•

Access (both for personnel using the facilities and working there and goods coming into or out of the area).

3.8.6.2

Compartment fires - general

In a compartment or building fire, the source of ignition will normally be at a discrete location and the initial fire growth will be slow. The temperature in compartment will increase and a hot layer of gas will build up below the ceiling. A point is reached when re-radiation from this gas layer causes the unburnt furniture etc to ignite. Within a short space of time the entire contents of the compartment will be burning in a process called flashover. The severity and duration of a building fire depend on the amount of fuel and the ventilation conditions. Fires may be fuel controlled or ventilation controlled, generally, ventilation controlled fires are more severe. The main difference between a building fire and a pool or jet fire is the nature of the fuel. Although buildings contain hydrocarbons in the form of plastics they also generally contain a large amount of cellulosic material in the form of paper, and wooden furniture. It is common, although not strictly correct, to refer to building fires as cellulosic.

Issue 1

May 2007

Page 154 of 493

FIRE AND EXPLOSION GUIDANCE When assessing elements of construction for buildings the standard fire resistance test fire is normally used. For some “fire engineered” designs a natural fire is modelled. The simplest natural fire model is the parametric fire although there are many, more complex, computer models for building fires

3.8.6.3

Compartment fires – parametric

A parametric fire [3.44] is an idealised form of a “natural fire” in a building compartment. They provide a simple means to take into account the most important physical phenomena which may influence the development of a fire. They take into account the fire load, the ventilation conditions and the thermal properties of the compartment linings. The natural fire is assumed to have a slow build-up with a pre-flashover period of ignition and smouldering, following flashover, the heat build-up is rapid and proceeds for some period dependent on the available fuel. There is then a post-flashover period where cooling takes place. The “standard fire” curve starts from an equivalent point at flashover and begins the heating phase directly. For the “standard fire” the heating rate continues (albeit at a slower rate) and does not reach a “cooling period”. The modelling of the temperature curve of the parametric fire also follows a similar logic of heating starting directly from a notional equivalent of the flashover point, i.e. without any preceding phase. The heating rate is then faster than for the standard fire but reaches a point where cooling commences. The cooling rate assumed for parametric fires is linear compared to the accelerating cooling of the natural fire. The parametric fire was developed to model mainly cellulosic building fires. It gives reasonable correlations against tests for modern office fires. It may often be more severe than the Standard cellulosic fire.

3.8.6.4

ISO, cellulosic (standard fire)

Building regulations throughout the world almost invariably require elements of construction to have fire resistance based on the standard fire [3.45]. This is an idealised fire defined by a time-temperature relationship and is the basis for fire resistance tests.

3.8.6.5

Temperatures

The Standard cellulosic fire has, when compared with most other “design” fires, a low initial rate of temperature increase. However, the temperature rises logarithmically with no limit. It reaches 945 ºC in 60 minutes and 1153 ºC in 240 minutes. The temperature reached depends on the conditions in the compartment and in a typical office fire, the combustion products temperature will reach about 1300 ºC. The fire temperature will normally peak at about 45 to 60 minutes and decline steadily afterwards. Compartment temperatures will reduce to 200 ºC after 120 minutes.

Issue 1

May 2007

Page 155 of 493


4 Interactions between management

fire

and

explosion

hazard

4.1 General The methods and systems for the management of explosion and fire hazards will have a degree of commonality. Some of these will be complementary, whereas others will serve a single function only. In addition, conflicts may exist between the successful management of explosion hazards and the successful management of fire hazards; thus, a holistic approach must be taken in the management of both types of hazard. Hazard management will always be a series of compromises between economics, engineering, operability and risk reduction considerations. Successful hazard management involves identifying the best compromise between all these considerations, in compliance with any statutory obligations placed on the operator of the installation.

4.2 Fire and explosion prevention methods 4.2.1

General

It has to be accepted that the complete prevention of fires and explosions can never be attained. However, procedures and systems should be provided to reduce the frequency of such events to as low as reasonably practicable. Such procedures and systems are detailed below.

4.2.2

Minimisation of leakage frequency

The loss of containment of a flammable material is a necessary precursor to the occurrence of an explosion or fire. This can be avoided, so far as is reasonably practicable by: •

Fitness for purpose of all flammable material containing equipment and associated pipework.

•

The maintenance of the design fitness for purpose throughout the life of the installation. This requires that an adequate inspection and maintenance regime is in place throughout the life of the installation. In addition, care must be taken to ensure that the original design intent is not debased by subsequent modification or lost via poor record keeping or industry take-overs and/or mergers.

•

Wherever possible, the number of potential leakage sources should be minimised. Typical of these would be instrument tappings and pipework flange connections. However, care must be taken in applying this philosophy as this may lead to an increased need for ‘hot work’ if modifications, replacement or repair of equipment are required.

Issue 1

May 2007

Page 156 of 493


Minimisation of ignition probability

Given that the leakage of flammable materials cannot be totally prevented throughout the life of the installation, then a fire or explosion will only occur if the leak is ignited. Recently published guidance [4.1] provides more information on ignition probability and the appropriate modelling of these data, however, in generic terms, the probability of ignition may be minimised by: •

Adequate control of ‘hot work’ on live installations by the use of air-purged habitats. Alternatively, only carry out ‘hot work’ during an installation shutdown. (Noting that hot work should be avoided wherever possible, some installations have a ‘no hot work’ policy and insist on bolting (or other methods) and carry out hot work only during a shutdown.)

•

The correct hazardous area zoning for electrical equipment and the correct selection and maintenance of such equipment.

•

The early detection of any leakage together with the necessary control actions to isolate all non-essential items of equipment which could potentially be sources of ignition.

It should be noted that ignition probability per se, does not represent a true measure of risk. What are most significant are the time-delay between a leak occurring and the ignition of the leak, and also the time delay (if any) between the detection of the leak and the ignition of the leak. These are a function of the rate of ignition rather than of the ignition probability. The minimisation of ignition probability illustrates one of the many compromises that have to be arrived at in the management of explosion and fire hazards, whilst accepting that ignition probability must be minimised, in doing so it must also be recognised that the potential for a ‘long-delayed’ ignition increases. Under these conditions a severe explosion event may result.

4.3 Fire and explosion detection and control methods 4.3.1

General

The positive pressure phase of an explosion is in the order of a few hundred milliseconds. Thus, the effects of an explosion are realised immediately. Conversely, the time for the effects of a fire to be realised, even upon personnel, is of at least an order greater than that for explosions. Thus the early detection of a leak is of greater significance for explosion hazards than for fire hazards. It follows that leak-detection and associated alarms, are the only means of providing adequate warning to personnel. Fire-detection is of no value in this context. However, fire-detection is still of importance when fire hazards are considered. It may be that very rapid response fire-detection systems, such as those that utilise flamedetection, could detect an explosion before they are damaged by the explosion blast or drag effects. In addition, rapid response fire detection may also be of benefit with respect to the initiation of explosion mitigation systems (such as deluge on gas detection). As stated above, this would be of no significance when explosion hazards are considered. However, it may be important for the management of fire-hazards to detect any fire that may follow an explosion. This may provide an argument for the use of rapid-response fire-detection systems, where the frequency of occurrence of explosions is deemed to be significant. It may also provide an argument under the same circumstances for the automatic actuation of any active fire control and mitigation systems upon the detection of a leak. Issue 1

May 2007

Page 157 of 493


Automatic release detection systems and alarms

Two generic types of release detectors are available: Type 1) The detection of an accumulation of flammable gas from the release, or Type 2) The direct detection of a release based on its acoustic signature. Type 1) detectors may be point detectors e.g. pellistors, or beam detectors. In each case, there is a requirement to assess the minimum flammable cloud size that should be detected. There is little guidance available to assist in this. One approach may be to consider both the thermal effects and the blast effects on a flammable cloud. The thermal effects may be assessed by treating the combustion of the flammable cloud as a fireball. The minimum cloud size, intended to be detected, may then be based on an acceptable probability of persons in the area surviving these thermal and blast effects. A range of figures for the probability of survival of detection systems following an initial blast load would be between 0.5 and 0.9. The lower end of the range has been used often in QRAs submitted to the Health & Safety Executive but a survival probability of 0.9 if other protective steps have been considered. Type 2) detectors appear to have an advantage over type 1) detectors in as much as they detect a leak directly. However, it is important that the sensitivity of such detectors is adequate; the advantage of leak detection is its sensitivity; there are definite benefits to detect leaks at as low rates as possible, this can be used to alert the operator even if a shut-down is not initiated at this stage of the incident. In addition, there is no clear evidence as to whether or not such acoustic detector will operate adequately when two-phase leaks occur. Thus it is suggested that the ideal leak detection system should employ both types of detectors. The detection of a leak should be annunciated on an installation-wide basis. All installation personnel, including visitors, should have received clear instruction as to the correct action to be taken on the receipt of such an alarm. The minimum cloud size to be detected should also consider the potential escalation. This assessment should be conservative due to the diversity of potential escalation paths and the analysts’ inability to assess them all.

4.3.1.2

Automatic fire-detection systems and alarms

Only leak detection can provide adequate warning to personnel of a potential explosion hazard. Fire detection is of very limited value in the event of an explosion already having occurred. Several fire detection device-types are commonly available, they include: •

UV and IR flame-detectors

•

Rate of temperature rise detectors

•

Smoke detectors

•

CCTV with or without embedded flame imaging software

The flame-detectors will have the most rapid response of the above if they are in the vicinity of the fire. However, very early smoke detector (VESDA) systems can respond rapidly based on an arrangement where the detection system samples smoke at very low concentrations, this has often been used in sensitive enclosed areas, computer systems have a long history of being protected by VESDA systems. Issue 1

May 2007

Page 158 of 493

FIRE AND EXPLOSION GUIDANCE It is advisable that total reliance is not placed on flame-detectors alone. Conditions arise where fires are obscured by smoke and indeed, smoke generation is the major hazard to personnel. IR detectors may also be obscured by water, for example, triggering deluge on gas detection may impair subsequent fire detection, or the IR detectors may fail to register fire escalation to adjoining process systems. The fire-detection system should include a mix of each type of detectors and be appropriate to the mix of release/fire/explosion hazards considered in the escalation path. The comments concerning alarms made for leak detection are equally pertinent for fire detection.

4.3.1.3

Reducing the available inventory of fuel

This is of equal importance to the management for both fire and explosion hazards. Obviously, where explosion hazards are concerned, any beneficial effects will arise if the fuel inventory is partially or completely depleted before an ignition takes place. This contrasts with the situation where fire hazards are concerned, where the beneficial effects will continue to operate after an ignition takes place. However, these beneficial effects on the fire-hazard will only ensue if the automatic isolation and blow-down and flare systems are not damaged by any prior explosion, to such an extent as to prevent their correct operation. Isolation and blow-down valves should, wherever possible, fail to a “safe” condition; generally, this means that isolation valves “fail closed” and blowdown valves “fail open” although there can be extenuating circumstances for this rule. Especially for large high pressure valves, the actuators can be significantly large pieces of equipment, and their destruction in an accident can compromise the “fail safe” mode; such valve actuators should be protected against blast and drag-effect damage as much as reasonably practicable, but it must be accepted that there will be practical limitations on the extent to which this can be achieved. This emphasises the importance of early detection of leaks and the automatic initiation of the ESD and blow-down systems upon the detection of a leak. Whereas, ESD and blow-down systems do provide benefit in the management of fire and explosion hazards, it is important to realise that these systems alone cannot be relied upon to prevent subsequent failures of equipment or structural elements due to the effects of a fire. Blow-down systems are almost universally designed to API RP520 [4.2]. This requires that the internal pressure be reduced by 50 % or to 100 psig (22 barg); whichever is the lower; within fifteen minutes. However, even if this is achieved, a significant fire could still be ongoing which could cause failures, especially in congested areas.

4.3.2

Significance of area ventilation

4.3.2.1

On explosions

The equilibrium size of a flammable cloud, produced by the accumulation of flammable gas from a leak will be inter-alia, a function of the area-ventilation rate. The severity of an explosion following the ignition of such a flammable cloud, will be, inter-alia, a function of the mass of flammable gas in the cloud. Thus it follows that an increased rate of area ventilation will have a beneficial effect upon the explosion hazard. The possible disbenefit of this is that it could make early detection of a leak more difficult to achieve. Nevertheless, in most cases the balance of risk will come down in favour of maximising the rate of area ventilation. Issue 1

May 2007

Page 159 of 493


On fires

The influence of area ventilation rate on fires is less apparent than its influence on explosions. The reported research [4.3] indicates that the suppression of pool fires by water/foam deluge systems is aided by increased wind-speed i.e. an increased ventilation rate. However, the possible distortion of the water spray pattern by the wind could mitigate this. Where mechanically ventilated, enclosed areas are concerned; the internal wind-speeds are unlikely to be sufficient to distort water-spray patterns. Note that for enclosed areas, the rate of mechanical ventilation will usually be of the order of 12 air changes per hour. Research [4.4] has indicated that for naturally ventilated areas ventilation rates in the order of a few hundred air changes per hour are achievable. It is possible to shut down ventilation systems to provide ventilation control of a fire, but it should be noted that in order to prevent smoke and combustion products migrating along ducts if the HVAC is not shutdown and isolated, (which could lead to fire or fire effects spreading to other areas) that common practice is to shut down and isolate HVAC systems in all but the most critical areas (such Temporary Refuges) on confirmed detection of fire.

4.3.2.3

Maximisation of ventilation rates

For existing installations, there are constraints to the options for increasing the existing ventilation rates. For mechanically ventilated areas, major refits are required for fans and ducting sizes, for naturally ventilated areas, the ventilation rate may be increased by the removal of any louvered wind walls. For ‘new builds’ the influence of the rate of ventilation on both fire and explosion hazards should be addressed in the design. For naturally ventilated areas a conflict may arise between protecting the temporary refuge against smoke ingress and the maximisation of area ventilation. It is conventional wisdom that wherever possible, the temporary refuge should be up-wind of the prevailing wind direction. There will normally be bulkheads between the temporary refuge and drilling and process areas. This means that the open sides of these areas will be at a right angle to the prevailing wind direction limiting natural ventilation.

4.3.2.4 Other factors influencing ventilation rate Equipment layout The equipment layout within an area will have an influence on the area ventilation rate. The most efficient layout to maximise the ventilation rate will be the same as that to minimise the explosion hazard. Layout guidance can be found in Section 3.2.6.4 of this guidance. For existing installations, it must be accepted that little can be done to change the existing layout of equipment. For ‘new builds’ cognisance should be taken of the recommendations given in the FLACS explosion handbook. Influence of release rate The release rate of gas can itself have a significant influence on the rate of natural ventilation.

Issue 1

May 2007

Page 160 of 493

FIRE AND EXPLOSION GUIDANCE Published research [4.3] provides some, albeit limited, data on this effect. Analysis of these data indicates that: •

If the leak is counter-flowing to the ventilation flow direction, the ventilation rate will be reduced.

•

If the leak is co-flowing with the ventilation flow direction, the ventilation rate will be increased.

•

If the leak is crosswind to the ventilation flow direction, the ventilation rate is effectively unchanged.

The following correlations are suggested as representing a conservative estimate of these effects. For leak direction counter to ventilation flow direction;

V ′ = V (1 − 22.4 x ) ......................................................................Equation 4-1 Where, V is the reduced ventilation rate (m3 s-1) V' is the original ventilation rate (m3 s-1) x is the gas release rate (m3 s-1) For leak direction co-flowing with the ventilation flow direction;

V ′ = V (1 + 12.45 x ) .................................................................... Equation 4-2 Where, V is the increased ventilation rate (m3 s-1) V' is the original ventilation rate (m3 s-1) x is the gas release rate (m3 s-1) Influence of water deluge Research [4.3] has indicated that the presence of water deluge reduces the ventilation rate in naturally ventilated areas. The data on this are very limited and applies only to deluge rates in the order of 24 l min-1 m-2. It is suggested that a conservative estimate of this effect would be to reduce the area ventilation rate by 30 % when the area deluge system is operating.

4.4

Fire and explosion mitigation methods

4.4.1

Active fire-fighting systems

The first and most obvious, consideration of the interaction with the explosion events is whether or not the fixed fire-fighting systems would still be functional after an explosion. Water deluge systems should be provided with as much protection against the explosion effects as is practicable. For existing installations, it must be accepted that little can be done in this regard. Issue 1

May 2007

Page 161 of 493

FIRE AND EXPLOSION GUIDANCE For ‘new builds’, this may be achieved by the judicious location of water deluge pipe-work. However, because of its very nature, such a system will be distributed throughout the whole of the area; it is likely that only a limited degree of protection could be provided. It is now well established that in well-vented areas, the presence of an area water deluge can reduce the severity of explosions. This would appear to be an argument for the initiation of water deluge, before the ignition of a flammable atmosphere takes place. The could have the benefits of reducing the explosion severity to an extent that the water deluge system in operation to control or mitigate the effects of any subsequent fire, and also prevent damage to automatic isolation and blow-down systems. Reported research on the effects of water sprays [4.5] has provided correlations to estimate the reduction in explosion severity by area deluge. The correlations also demonstrate the variation in explosion severity with the gas concentration in the flammable atmosphere. The correlations are: In the absence of water-spray,

PE 2 = PE 1 e

( −17.693((E −1.0563) −(E −1.0563) )) ......................................... Equation 4-3 2

2

2

1

In the presence of water-spray,

PE 2 = PE 1

( −18.215((E −1.007) −(E −1.007) )) ............................................ Equation 4-4 e 2

2

2

1

where PE1

is the overpressure at equivalence ratio E1

PE2

is the overpressure at equivalence ratio E2

E1 =

C1 CS

E2 =

C2 CS

and C1 is gas concentration 1 C2 is gas concentration 2 CS is the gas stoichiometric concentration It is not possible to provide a generic correlation for the absolute reduction in explosion severity, as the domains in which the explosion takes place will vary from one another. However, it can be stated that the ratio of the unmitigated explosion severity to the mitigated explosion severity increases as the unmitigated explosion severity increases. Thus area deluge mitigation of explosions is most effective where very severe explosions can occur. This means that such a system will be most effective in large, congested well-vented areas.

Issue 1

May 2007

Page 162 of 493

FIRE AND EXPLOSION GUIDANCE The mitigation of explosions by area water deluge will only occur when the explosion is accompanied by significant flame acceleration. In practice, this means large, well-vented domains. Where this does not occur, such as in enclosed domains area water deluge will not provide any benefit, and in some cases, could increase the explosion severity. As has been stated above, the presence of water-deluge will result in the reduction of the natural ventilation rate. This will have the effect of increasing the equilibrium, size of the flammable cloud and also increasing the time required to disperse this flammable cloud. In ageing platforms, there has been a concern that the presence of water-deluge may increase the probability of ignition due to water ingress into electrical equipment. Thus, in any particular situation, the decision as to whether or not the activation of an area water-deluge is appropriate can only be informed by an assessment of all the above factors. Water-deluge systems, with or without foam, can be effective in suppressing and extinguishing pool fires. The following correlations for the time to extinguish pool fires have been developed from a research programme of fire trials [4.6]. These trials used diesel as the fuel but the correlations would give a reasonable approximation for the time to extinguish stabilised crude oil fires.

T50 = 494 − 376 Y + TE = 859 − 448 Y +

29 ............................................................. Equation 4-5 Y

80 ............................................................... Equation 4-6 Y

where T50

is the time to reduce the fire size by 50 % (s)

TE is the time to extinguish the fire(s)

Y = C ×U and C is the water spray area cover rate (l min-1 m-2) U is the internal wind speed (m s-1) These correlations are specific to water sprays with droplets having Sauter mean diameters of 400 to 500 microns. The research report [4.3] indicates that the water droplet diameter can have a significant effect upon the time to extinguish a pool fire. In summary, large droplets are more effective than small droplets, inasmuch as they are less easily displaced by ventilation crosswinds and can penetrate the fire plume more effectively. The addition of a foaming agent to the water spray system can reduce significantly the time extinguish a pool fire compared to those predicted from Equation 4-5 and Equation 4-6. One additional factor in foam compound selection is the viscosity of the finished foam. For two dimensional pool fires a low viscosity of the finished foam is appropriate. However, for threedimensional running fires, such as may be encountered on a helideck, a high viscosity (or sticky) finished foam is appropriate. Issue 1

May 2007

Page 163 of 493

FIRE AND EXPLOSION GUIDANCE Where water miscible fuels may be encountered, then alcohol resistant foam is necessary. In locations where the ambient temperature can be below 0 °C for a significant time the foam compound should be ‘freeze-protected.’ A number of characteristics affect the effectiveness of water spray systems (designed for example to NFPA15 [4.6]) against either pool or jet fires. The effects of water systems with respect to different fire types are discussed in more detail in various sub-sections in Section 5.2. However, area water deluge can provide significant protection against incident thermal radiation from both jet and pool fires. The research report [4.3] suggested the following correlation for the reduction in incident thermal radiation.

R = 100 tanh (1.55 x ) ................................................................ Equation 4-7 where R is the percentage reduction in incident thermal radiation

x = f ×L and f is the water volume fraction in the atmosphere L is the distance through the water spray or curtain (m) This indicates that the presence of area deluge could provide significant protection for personnel escaping from the location of a fire. The same applies to the use of water curtains if these are of adequate thickness. Area deluge systems or water curtains cannot be relied upon to protect personnel from the thermal effects of an explosion. These thermal effects are of too short a duration to prevent any serious risk of failure of equipment or structural elements. Such risks would be associated with the blast and drag effects of an explosion. Obviously, water spray systems can provide no protection against such effects. Dual agent (foam and dry powder) can be effective in the suppression and extinguishment of pool fires. Their effectiveness is probably limited to enclosed areas due to the problem of delivering the dry powder to the base of the fire in open, well-ventilated areas; where effective, dual agents can reduce the fire duration to less than that where water deluge and foam are used. Any area deluge or local cooling system should be fully operational as soon as possible after the receipt of an initiating signal. The recommendation for the maximum value of this time delay, given in NFPA, should be adhered to. This is because waterspray heads constructed of brass or gunmetal will, when exposed to flame impingement, suffer major damage if water flow has not been established. This level of damage is likely to occur within 60 seconds and seriously degrade the effectiveness of the waterspray system. This could be avoided by the use of waterspray heads constructed of a high melting point material, such as super-duplex stainless steel. However this option would be accompanied by a severe cost penalty.

Issue 1

May 2007

Page 164 of 493

FIRE AND EXPLOSION GUIDANCE Consideration should be made as to whether the fire hazard may extend beyond the notional fire area, thus mitigation measures should be able to protect from fire effects from outside (via an adjacent module for example). The application of water systems should then be appropriate to the fire hazard identified and also to the type of protection required, e.g. does the outside area include key escape routes form the primary affected area to the Temporary Refuge. Where high voltage electrical equipment, or equipment susceptible to damage by exposure to water are present then conventional water deluge or foam systems will not be appropriate fire fighting systems. Historically, such equipment has been protected against fire by the installation of Halon flooding systems. Since the adoption of Montreal protocol, this option is no longer available. A number of drop-in Halon replacement systems have come on to the market but these have not yet seen prolonged general service and thus limited data are available on their effectiveness in ‘real’ fire situations. Water mist systems appear to be very effective against electrical fires in enclosed areas. However, there is no general agreement as to whether or not unacceptable levels of damage to such equipment would ensue. At the time of writing this Guidance, more evidence is required to validate this objection to the use of water mist systems.

4.4.2

Fire-proofing systems

Two types of fireproofing materials are in general use on offshore installations. These are: 1. Inert materials; 2. Intumescent materials. The inert materials provide excellent protection against fire exposure and a resistant to the erosive effects of jet flame impact. They do suffer from the disadvantage of increased load on the structure. It is for this reason that the intumescent materials are generally preferred. The intumescent materials can also provide excellent fire protection. However, there is a concern that the erosive effect of jet flame impact could dislodge the ‘char’ formed and thus reduce the effectiveness of the fireproofing. Where these materials are to be used, the material manufacturer should provide jet fire test data to demonstrate that this is not a problem. The design standard performance specifications for fireproofing materials are generally based on diffusion flame engulfment rather than jet flame impact. Thus the need for the test data referred to above is reinforced. In this context it is of course necessary to know whether diffusion flames or jet flames will be encountered. The research report [4.7] does provide some evidence on the likely rainout of liquid from an ignited two-phase release. If the rainout is significant then a pool fire will result. If not, then a spray fire (equivalent to a jet fire) will result. It is suggested that for ignited twophase releases; •

If the GOR is low, then at drive pressures above 10 bar absolute a spray fire will result.

•

If the GOR is high, than at drive pressures above 5 bar absolute a spray fire will result.

Issue 1

May 2007

Page 165 of 493

FIRE AND EXPLOSION GUIDANCE The effectiveness of both types of fireproofing materials can degrade over time. This can be due to mechanical damage of the coating, especially the sealing topcoat. This in turn can lead to water ingress and deterioration of the fireproofing material, together with possible unrevealed corrosion of the substrate. This can be avoided by regular inspection of the fireproofing coatings and repair as necessary. Ideally, the fire-proof coating of any item should be capable of withstanding an explosion blast loading, up to the failure loading of the equipment item or structural element concerned, without suffering any significant degradation of the fire-proof rating. This would retain the protection provided by the fire-proofing against any fire subsequent to the explosion. The design of fire-proofing systems is universally carried out on the basis of the fire loading only.

4.4.3

The temporary refuge

Ideally, the temporary refuge should provide for the protection of personnel against the effects of both fires and explosions. Whilst it is feasible that the temporary refuge could provide such protection against the thermal and smoke effects of fires and against the thermal effects of explosions, there will be a practical limitation on the protection that can be provided against the blast effects of explosions. Thus the objective should be to reduce the explosion blast effects on the temporary refuge to as low as reasonably practicable. This is probably best achieved by maximising the separation distance between the temporary refuge the likely locations of explosions as much as it is reasonably practicable to do.

4.5

Combined fire and explosion analysis

4.5.1

Introduction

In practice it is not realistic to consider fires and explosions in isolation; it is not only impossible to fully isolate the two phenomena, but to do so risks missing potential high-risk events. This applies particularly where a fire analysis ignores potential damage caused by a preceding explosion or where an explosion occurs during a fire. The nature of the interaction between explosion and fire will depend upon whether an explosion precedes a fire (the usual base case) or whether it occurs during a fire. The effects of interaction are discussed in the following sections. For the purposes of this section, explosion shall be assumed to include the effects of projectiles.

4.5.2

Fire response of explosion damaged structures

4.5.2.1

General

There are four categories of explosion damage to structures, three of which may affect subsequent fire endurance. 1. A structure, which has responded to explosion while remaining in the elastic deflection range everywhere and without connection failures. A Category 1 structure can be considered to have been unaffected by explosion when considering its response to fire. This is the case for structures subject to explosion within the SLB range. 2. A structure, which has responded to an explosion with plastic deformation but without connection failures. A Category 2 structure will be unaffected in its response to fire except in respect of:

Issue 1

May 2007

Page 166 of 493

FIRE AND EXPLOSION GUIDANCE o

Possible damage to PFP (e.g. due to substrate strains), but noting that there are extremely limited data available on PFP damage following an explosion;

o

Loss of straightness of members subject to buckling loads;

o

Deformation of supported equipment and pipes;

o

Loss of pipe/equipment support.

3. A structure that has responded to explosion loading with or without connection failures (local or global). Category 3 structures will be weakened and behave differently in fire scenarios, compared to undamaged structures, with much reduced fire endurance. 4. A structure, severely damaged by explosion with loss of entire segments of the structure. Categories 2, 3 and 4 damage relate to structures designed to resist explosion in DLB range.

4.5.2.2

Analytical treatment of explosion damaged structure

For Category 1 damage in an explosion (SLB) it is assumed that there is no weakening of structure with respect to fire endurance hence fire and explosion can be considered independently by different techniques, if required. In practice it is very difficult to perform fire response analysis of explosion-damaged structure, where the explosion damage may have reduced the reserve structural capacity for dead loads. The two practical difficulties are: 1. Calculating the reserve structural capacity for distorted and/or weakened structures; 2. Covering a suitable range of explosion damage scenarios. It is therefore recommended to design the main parts of the structure to survive design events with Category 1 (e.g. 104 years return period) or modest Category 2 damage. In practice this will involve optimising the overall layout of the topsides facilities to minimise explosion pressures. For damage corresponding to Categories 2, 3 or 4, it would be necessary to apply a structure model that has been fully modified to take account of the explosion damage that has occurred prior to fire. This is a particularly advanced type of analysis but could be practical where the non-linear software can determine both fire and explosion response. It is probably necessary to account both for geometry changes and the straining that has occurred in strained members and this will affect the material model for those members. For this reason it may not be suitable to use different software for the fire and explosion response and merely use the output geometry from the non-linear explosion software as input to the fire-response software.

Issue 1

May 2007

Page 167 of 493


Explosion response of structures at elevated temperatures

4.5.3.1

General

As temperature increases, the yield stress and Young’s modulus of metals decrease. This can result in comparatively small temperature rises resulting in a considerable increase in explosion related deflection. This applies particularly where a component is designed to resist explosion through plastic deformation. Explosions during fire can sometimes result from equipment or vessel BLEVEs due to heating in fire or a delayed effect of explosions in one area on an adjacent area, already in flames. This is part of a complex domino situation where a first area is in flames and the explosion in that first area has caused leaks in a second (adjacent) area, and it takes some time before the leaks in the second area ignite and cause the second explosion, causing explosion overpressures in the first area. Unless, analyses of escalation identify clear limits to potential damage, it is recommended that the fire hazard strategy assumes a “burn down philosophy” and that the fire risk analysis should confirm that the TR is not destroyed with an unacceptable frequency, in which case, a different solution will be required (e.g. a revised layout or separate accommodation jacket). Other damage can occur due to projectiles caused by vessel BLEVEs and to a lesser extent from pipe failures. Another source of damage may be equipment and structure falling from areas above that has become weakened by fires. The higher the module stack, the more damage a dropped could cause. Where appropriate, this aspect needs to be linked to dropped-object hazard evaluation. On F(P)SOs and converted jack-up type substructures the damage consequence due to impact with the deck might be large and the protection requirements difficult to meet without heavy protection such as thick steel plates or Bi-steel.

4.5.3.2

Analytical treatment of fire-damaged structure

Rigorous numerical analysis for explosion effects on fire-damaged structure is currently not practical in most cases, though the advanced non-linear techniques briefly alluded to in Section 4.5.2.2 might be applicable here. Coping with the explosion after fire scenarios is principally achieved with a suitable barrier philosophy and distancing (sensitive equipment and structure from hazard). For vessel BLEVEs distancing will not usually be sufficient due to long projectile trajectories. Barriers, (which may be walls or other equipment installed between the location of the BLEVE and vulnerable targets) can reduce projectile trajectories and will be required if projectiles form a significant component of the continuing escalation hazards. From the practical standpoint, where an explosion during a fire is a significant risk, the temperature of structural steelwork may need to be kept significantly lower than for fire-only loaded steelwork. This is to improve resistance to resist the secondary explosions. This can be accommodated by more extensive application of PFP and this factor should be borne in mind when contemplating reducing the extent of PFP coverage to meet only specific fire scenarios. An additional consideration is that where there is a significant risk of an explosion during a fire it is necessary to ensure adequate strength and bonding or fixing of passive fire protection materials at high temperatures.

Issue 1

May 2007

Page 168 of 493


Safety conflicts

4.6.1

General

The application of safety measures always requires a balance regardless of whether the hazards are fire or explosion related. The over-riding principle concerns the risk assessment of the identified hazards and whether the protective steps for one hazard will exacerbate the likelihood or consequences of another. This “conflict” is particularly meaningful when dealing fire and explosion hazards as they are the result of only slightly diverging escalation paths. All protective measures should be considered in the context of the hazards identified for the specific installation as is reiterated elsewhere in this guidance; the hazard identification exercise for the installation should be rigorous and comprehensive. This section will discuss specifically the potential conflicts arising from the use of the protective measures considered for fire hazard management. The detail of each measure discussed can be found elsewhere in this guidance. The conflicts will be reviewed in the context of their role in the protective hierarchy and the issues “in conflict” will be described.

4.6.2

Conflicts arising from inherent safety measures

The major inherent safety steps are to reduce or eliminate inventories. Reduction or elimination of inventory is desirable for all hydrocarbon related hazards and presents no obvious conflicts with other hazard categories. In general, the reduction or elimination of ignition sources is again desirable for all hydrocarbon related hazards although care should be taken that dispersion of gas or vapour to a “non-hazardous” area where ignition sources have been allowed is considered in the HAZID and that suitable other steps have been taken.

4.6.3

Conflicts arising from preventative safety measures

Additional safety measures that might be considered here are open module areas to disperse any hydrocarbon release (in gaseous or vapour form) or providing comprehensive hazardous drainage systems to remove liquid spills as quickly and safely as practicable. These steps would then prevent the concentration of flammable fluids reaching or exceeding the Lower Flammable Limit (LFL). The reduction or elimination of ignition sources will (theoretically) prevent ignition of any release prior to dispersion or dilution having occurred. A conflict arises with the open module concept. The normal practice for fire protection engineers is to consider the firewater demand of the largest area plus adjacent areas to which the fire may spread. It can be seen that the larger area (the practical result of opening modules) increases the firewater demand and may make the demand impractical for normal firewater pump sizing. The open area also decreases the likelihood that the fire will ever be ventilation controlled, thus requiring the designer to consider other steps. This “open module” measure does however improve the situation for explosions.

Issue 1

May 2007

Page 169 of 493

FIRE AND EXPLOSION GUIDANCE Concerning designing drainage systems to remove liquid hydrocarbon spills, these pose no obvious safety conflicts with other hazard categories but may create an undesirable environmental event. Although regulators often acknowledge environmental impacts in extreme events, the design and operational constraints of this safety measure should be considered further and the consequences of both events understood.

4.6.4

Conflicts arising from detection safety measures

Detection measures tend to be relatively passive and provide a step towards a more precise hazard management system (focussed control, mitigation or response). There are no obvious conflicts identified here, merely that the detection devices/systems should certainly be directed towards specific hazard categories and if possible, specific hazards. The detection devices should be defined by their Performance Standards to achieve a certain degree of detection in the context of particular hazards and also with other protective measures having been activated, for example, flame detection effectiveness after firewater systems (deluge or mist) have been activated. Therefore, for detection, the issue is more of omission (of particular applications) rather than conflict and can be clarified by clear application to the defined hazards.

4.6.5

Conflicts arising from control safety measures

Safety measures that might be considered to control the event would comprise isolation valves and blowdown systems to control the inventory available to feed the fire. Dependent upon the way that the incident was defined, a further control system would be the firewater system, either acting to control escalation or acting as a mitigation measure. The firewater systems will be discussed under conflicts arising from mitigation measures. Concerning isolation valves and blowdown systems, these will limit the released inventory for any release event and present no conflict in the execution of that function. However, to function well in the event of an incident, these measures may require additional ESD valves and blowdown lines. The designers should be aware of one area of conflict in that the actuators of large valves are themselves quite large and that they and/or blowdown piping will constitute significant obstructions to explosion generated flame-fronts and thus increase overpressure loads which may in turn require blast protection as both ESD valves and blowdown lines are safety critical. The design process moves into a vicious circle whereby the safety items can increase the severity of the event they are controlling. These issues are not insuperable and like many safety issues are dealt with by adopting good layout principles.

4.6.6

Conflicts arising from mitigation safety measures

The are 3 main mitigation measures for fire hazards; 1. Physical containment; to stop the fire either escalating to adjoining sensitive areas (where personnel may be), or reaching new inventories or to otherwise limit the fire by ventilation control. 2. Extinguishing systems; to extinguish the fire directly or to cool surrounding piping, equipment and structures to retain strength and stop escalation.

Issue 1

May 2007

Page 170 of 493

FIRE AND EXPLOSION GUIDANCE 3. Designing for retention of structural integrity; to provide fire resistance (via intrinsic structural strength or passive fire proofing) in order to maintain structural integrity to support process systems (and avoid escalation) and to support areas of greater safety for personnel (TR and muster areas) and to support evacuation systems (TEMPSC launch stations, helidecks). With respect to the mitigation measures identified under item 1, these measures provide the greatest conflicts with other hazard categories. Physical containment of areas, whilst delineating fire areas, providing greater effectiveness for the applied fire water systems and a degree of ventilation control (in circumstances where the area/module is well sealed) have adverse effects on other hazards. Gas or vapour releases are also contained, they are not dispersed beyond the area/module and the opportunity for dilution to below the Lower Flammable Limit does not exist. Also, there remains the possibility that delayed ignition initiates an explosion rather than a fire in which case the resultant explosion overpressure will more than likely be higher than in an open module (though this may not always be the case and a considered analysis should be undertaken). The avoidance of gas/vapour clouds in the flammable or explosive region should always be the first priority. Concerning mitigation measures identified under item 2, there is a range of demands for the extinguishing systems dependent upon which fire type they are designed for. In addition, there are different nozzle types and spray behaviour required for explosion suppression. The mixture of nozzle types and their location should be considered carefully when designing the firewater system. Dependent upon the hazards identified for an area, a decision can be taken on the basis of the risk (considering both likelihood and consequence) of the “reasonably foreseeable” events. The risk ranking of the types of events will provide an indication as to the types and locations of firewater nozzles to be used. There is also the effect of timing; deluge used for explosion suppression is required to be activated early, i.e. in advance of any ignition and this has led to the practice of some operators of initiating deluge on gas detection. The critical consideration for the structural and safety demands required by mitigating measures under item 3 is to maintain structural integrity. There are no obvious conflicts arising from measures meeting these demands, the increased strength and/or added passive fire proofing do not impact other hazard management measures. However, the addition of passive fire proofing does increase the likelihood of accelerated corrosion due to trapped moisture which may arise from leaking insulation or from temperature cycling generating condensation.

4.6.7

Conflicts arising from emergency response safety measures

The safety measures considered here will form escape and evacuation equipment, both personal and for teams and will also comprise portable and hand-held fire-fighting equipment. These are all measures required to assist personnel and there are no obvious conflicts where their provision impairs the hazard management efforts for other hazard categories. At worst, they may be ineffective, as indeed they will be for some fire scenarios.

4.7

Fire and explosion walls

There are two main types of fire and explosion resistant walls, proprietary corrugated walls (in carbon or stainless steel) and bulkhead walls.

Issue 1

May 2007

Page 171 of 493

FIRE AND EXPLOSION GUIDANCE Corrugated walls are the most popular, mostly because they are lighter, less expensive and can be manufactured complete, off-site and installed after grit-blasting and painting of topsides structure and installation of main equipment. They fit more easily into the construction programme. PFP is generally tested using flat surfaces; the effects of a jet fire on a corrugated wall either in terms of heat load or surface PFP are less well understood. Another issue for manned areas can be toxicity of smoke from intumescent PFP. This type of PFP is rarely used on corrugated walls but is common on bulkhead structures. Corrugated walls are designed not to participate in the loads bearing capacities of the structures they are integrated into and only have to have residual strength in fire to support their own weight. Bulkhead walls on the other hand do participate in the dead load carrying capacity of the structures into which they are constructed and therefore require to be insulated to prevent strength loss in fire. Most fire / blast walls do not otherwise require to be insulated, and insulation of them is only normally required where they are used as boundaries to enclosed occupied rooms. Resistance to penetration by projectiles will be affected by temperature rise and this will depend upon whether PFP is used or not. It also depends on whether or not the insulation is on the fire attack side or the cold side of the wall. In some cases relatively thin coatings of PFP have been applied to (carbon steel) corrugated walls and this has the advantage of ensuring limited temperature rise during the important early blow-down phase of platform equipment when BLEVE and projectile risk is highest (a compromise solution). Stainless steel corrugated walls have more residual strength at elevated temperatures and are therefore more resistant to projectiles. On the other hand they tend to be thinner than equivalent carbon steel walls and this diminishes the strength advantage in regard to projectile penetration, but they are very ductile. Support interface design is important as this must allow for thermal expansion of the wall in fire and out-of-plane bending, due to preceding explosion or differential temperature through the depth of the wall or both. The out of plane deflection due to fire is lower with corrugated walls because the geometry of the wall profile ensures that the inner flange and outer flange are heated equally, whereas large differential temperatures occur in bulkhead walls and stressed skin construction (with the plate on the fire side) because the cold side flange of the stiffeners is not heated directly: the temperature gradient is greatest with uninsulated walls. Provided the supports are configured to deform without strength-loss, the residual strength of the wall will not be affected by the distortion but care needs to be taken with the PFP in these areas, particularly where such PFP is within the coat-back distance for the structure that supports the wall. If in doubt, shaped stainless steel flashings can be used in such locations with fibrous insulation behind.

4.8

Decks

Decks normally comprise a series of girders and a stiffened deck plate. Usually the PFP will be applied to limit the temperature rise of main girders and those secondary beams that support the higher categories of Safety Critical Equipment. Coat-back requirements are often relaxed to 50 mm or so hence the overall percentage of cover to deck steel work will be relatively small. Issue 1

May 2007

Page 172 of 493

FIRE AND EXPLOSION GUIDANCE It is not normal to coat the top surface of decks, in pool fires decks would not be expected to be significantly heated if the fire is from above but this may not be the case with jet fire. The top flanges of girders can be weakened in such circumstances, particularly as the insulation to the girder below the deck plate will inhibit heat loss and allow higher top flange temperatures to occur. As a general rule it is preferable to specify the secondary deck beams and plating to have a higher strength than the primary structure so that it’s loss in explosion and / or fire does not lead to the primary structures being dragged down or losing their secondary stabilising support members, for example for lateral torsion buckling. The welding of secondary steel and girder connections needs particular attention and it is recommended to make welded connections capable of transmitting the forces imposed during gross deformation of the secondary members they connect without fracture (as in earthquake-resistant design). Potential deficiencies in fire resistance of decks which support SCE’s or which act as fireboundaries can sometimes be overcome by the addition of deck to deck hangers. Where the critical fire is below the deck these hangers would not be weakened as they would be located in a different fire area. This is a solution that can be applied for retrofit situations. It should be understood that there may be a problem of running pool fires on decks due to distortion of plates arising from the fire. All analyses are based on a circular or bunded fire and do not take into account potential running. At the time of writing, it is understood that HSE are planning a test programme to investigate this effect.

Issue 1

May 2007

Page 173 of 493


5 Derivation of fire loadings and heat transfer 5.1

Introduction

In the following sections generic fire types are identified for the types of fire that might occur on or near an offshore installation. The fire types are considered further in terms of their characteristic flame and how their behaviour might be affected by confinement and/or deluge. The parameters used to define the fire and the hazards presented by the fire in terms of thermal and smoke loading are defined. Based on large scale experimental work (including unpublished studies by Advantica to which access has been granted for this guidance) and on the predictions of validated models developed and used by Shell and Advantica, typical fire loading data are summarised for the fire types. Typical values can be used to assess the hazard to personnel and the likely effect on fire impacted obstacles using a simple calculation method. Also considered are the effects of deluge on fire behaviour, the potential heat loads from fires and the effect on the temperature rise of an engulfed object, plus the manner in which PFP may limit the rate of temperature rise of an engulfed object and how blow-down may reduce the heat load and hence the likelihood of failure. Using these typical fire loadings and calculations of heat transfer to objects, the steps to prepare an initial scoping or indicative QRA of the fire hazards are also outlined.

5.2

Fire characteristics and combustion effects

5.2.1

General

In Section 3.2.4, potential fires on offshore installations were categorised into six fire types. In this section, each of these fire types is described in detail in terms of the likely nature of the flame and the thermal loading it may present to the surroundings. Where appropriate, the effect of active water deluge on the fire is discussed as is the effect of confinement.

5.2.2

Gas jet fire

5.2.2.1

Nature of the gas jet fire

An ignited pressurised release of a gaseous material (most typically natural gas) will give rise to a jet fire. A jet fire is a turbulent diffusion flame produced by the combustion of a continuous release of fuel. Except in the case of extreme confinement which might give rise to extinguishment, the combustion rate will be directly related to the mass release rate of the fuel. In the offshore context, the high pressures mean that the flow of an accidental release into the atmosphere will be choked having a velocity on release equal to the local speed of sound in the fluid. Following an expansion region downstream of the exit the flame itself commences in a region of sub-sonic velocities as a blue relatively non-luminous flame. Further air entrainment and expansion of the jet then occurs producing the main body of the jet fire as turbulent and yellow. In the absence of impact onto an object, these fires are characteristically long and thin and highly directional. The high velocities within the released gas mean that they are relatively unaffected by the prevailing wind conditions except towards the tail of the fire. The fire size is predominantly related to the mass release rate which in turn is related to the size of the leak (hole diameter) and the pressure (which may vary with time as a result of blowdown).

Issue 1

May 2007

Page 174 of 493

FIRE AND EXPLOSION GUIDANCE In the case of high pressure releases of natural gas, the mixing and combustion is relatively efficient resulting in little soot (carbon) formation except for extremely large release rates. Hence little or no smoke is produced by natural gas jet fires (typically <0.01 g m-3), and the fires tend to be less luminous than jet fires involving higher hydrocarbons. CO concentrations in the region of 5 to 7 % v/v have been measured within a jet fire itself but this is expected to drop to less than 0.1 % v/v by the end of the flame. A factor which is often overlooked is the noise produced by sonic gaseous releases. This is usually high pitched and so loud that it may prevent effective radio communication between personnel. As a result emergency actions could be hampered. A further point to note is that some combinations of leak size and pressure will not give rise to an inherently stable flame. For hole sizes under 30 mm diameter, there is a lower bound pressure which high pressure releases must exceed to produce stable flames. Simplistically, this extends approximately linearly from 2 barg at 30 mm diameter to about 75 barg at 8 mm diameter. In practice this means that most small leaks (see Section 5.4.1) will be inherently unstable and will not support a flame without some form of flame stabilisation, such as the presence of another fire in the vicinity to provide a permanent pilot or stabilisation as a result of impact onto an object such as pipework, vessels or the surrounding structure. This implies that unstable flames may self-extinguish revert to leaks thus contributing to potentially explosive environments. This aspect of flame behaviour should be considered in determining major hazard scenarios and their escalation paths, however, in the highly congested environment offshore, impact within a short distance is very likely, and small leaks will most likely stabilise on the nearest point of impact. Apart from providing flame stabilisation, impact onto an obstacle may also significantly modify the shape of a jet fire. Objects which are smaller than the flame half-width at the point of impact are unlikely to modify the shape or length of the flame significantly. However, impact onto a large vessel may significantly shorten the jet fire, and impact onto a wall or roof could transform the jet into a radial wall jet where the location and direction of the fire is determined by the surface onto which it impacts. As noted above, the combustion process within a natural gas jet fire is relatively efficient and produces little soot (carbon). Consequently these flames are not as luminous as higher hydrocarbon flames. Radiation emissions from natural gas flames arise mostly from water vapour and carbon dioxide, except for very large releases where soot production starts to enhance the process. The long thin shape may also result in a flame path which is not optically thick. The net result is that the radiative heat transfer to the surroundings is lower than for higher hydrocarbon flames and this is reflected in the fraction of heat radiated, F, for such fires (see Section 5.3.1, “Fire loading to the surroundings”). Similarly, the radiative heat transfer to objects engulfed by the flame is generally lower than for higher hydrocarbon flames, but the high velocities within gas jet fires can result in high convective heat transfer to objects. Clearly the total heat flux which is imparted to an engulfed object will vary over the surface of the object. In addition, the relative proportions of convective and radiative heat flux will vary over the surface, with the highest convective component likely to be experienced close to the point of impact of a flame where the highest velocities occur, whereas the highest radiative heat load will be experienced where the more radiative part of the flame (usually nearer the end of the flame) is viewed by the object. As the more radiative part of the flame is closer to the tail, this can result in the highest overall heat fluxes being experienced on the rear surface of an engulfed object which may seem counter-intuitive. Neglecting such spatial variations, broadly speaking, for a given location of an object within a flame (as a proportion of flame length), the convective component is more or less constant with increasing size of release, whereas the radiative component increases with release rate as the flame becomes optically thick and more smoky. Hence the relative proportion of convective to radiative flux varies with fire size (see Section 5.4.2). Issue 1

May 2007

Page 175 of 493


Effect of deluge on gas jet fires

The activation of general area deluge can adversely affect the stability of high pressure gas jet fires, particularly if the fire is not impacting onto an obstacle. However, in most practical cases, this undesirable effect is very unlikely to occur due to impact onto obstacles providing adequate flame stabilisation. Indeed, deluge has little effect on the size, shape and thermal characteristics of a high pressure gas jet fire. Therefore, the heat loading to engulfed obstacles is not diminished. The same is true for dedicated vessel deluge systems; the water being unable to form a film over the vessel in the presence of the high velocity jet, and so dry patches form where the temperature rise is undiminished by the action of deluge. There is some evidence that the deluge increases combustion efficiency resulting in lower CO and increased CO2 levels within the flame. The major benefit of area deluge with jet fires arises from the suppression of incident thermal radiation to the surroundings, which protect adjacent plant and in particular, aid escape by personnel. For a medium velocity type (e.g. MV57) nozzle operating at 12 l min-1 m-2, incident radiation levels can be reduced by about 20 % for a single row of nozzles, 30-40 % for 2 rows and 40-60 % for more than 2 rows (general area deluge). Increased deluge rates can further reduce incident radiation levels: 60-70 % at 18 l min-1 m-2; 80-90 % at 24 l min-1 m-2 for general area deluge. Nozzles producing smaller droplet sizes can have an enhanced mitigation effect, but there is an increased risk that the droplets will be blown away by the wind.

5.2.2.3

Effect of confinement on gas jet fires

The behaviour of a jet fire within a confined or partially confined area will depend upon the degree of confinement and the direction of the jet relative to the ventilation opening. If ventilation is plentiful or the jet is directed through a vent then there may be little difference in jet fire characteristics compared to an unconfined fire. However, if the release rate of gas is large relative to the size of the confinement or the ventilation openings are small then the fire may not be able to entrain enough air for complete combustion inside the compartment. This is likely to result in increased levels of incomplete combustion products such as CO, increased levels of smoke (soot) and increased flame temperatures, particularly in regions close to the ceiling of a compartment where hot combustion products may be trapped and recirculate. This leads to increased heat flux to objects and surfaces compared to an unconfined fire. The location where combustion occurs and the hottest parts of the flame may also shift due to the confinement. In tests involving horizontal jet fires in a compartment incorporating a single wall vent, where the jet was directed away from the vent, increased temperatures were seen at the interface between the smoke layer leaving the compartment and the air layer entering the compartment, most particularly in the area furthest from the vent. Unlike unconfined fires, the behaviour of under-ventilated confined fires changes with time as the air initially available within the compartment is consumed, and this may lead to ‘external flaming’ after a period of time when the body of flame moves through the vent in order to find the oxygen required for combustion. CO levels of up to 5 % v/v at the vent may occur but after the onset of external combustion the CO levels drop to typically less than 0.5 % v/v by the end of the flame. Soot production is related to the equivalence ratio and hence the degree of ventilation and may range from about 0.1 g m-3 at an equivalence ration equal to 1.3 to up to 2.5 g m-3 at an equivalence ration equal to 2. Certain ventilation patterns could lead to flame instability and extinguishment. The worst case condition is likely to occur if the jet fire is slightly under-ventilated as this leads to high heat release rates and enhanced soot production. Issue 1

May 2007

Page 176 of 493


Confinement and deluge of gas jet fires

Deluge of a confined jet fire may lead to flame extinguishment and hence a serious explosion hazard from the continuing release. The likelihood of flame extinguishment is significantly increased if the surroundings are already hot at the time the deluge is activated as the main mechanism which results in extinguishment of the jet fire is ‘inerting’, that is evaporation of the water droplets leading to a mixture of gas/air/steam within the compartment which is outside the flammable limits. The water vapour may also contribute to flame instability by reducing the burning velocity. However, if the deluge is activated at an early stage, prior to the compartment walls becoming hot, then the fire may not be extinguished and some benefit in terms of reduced flame temperatures and wall temperatures may accrue.

5.2.2.5

Two-phase jet fire

An ignited release of a pressurised liquid/gas mixture (such as ‘live crude’ or gas dissolved in a liquid) will give rise to a two-phase jet fire. The gas stream atomises the liquid into droplets which are then evaporated by radiation from the flame. However, a pressurised release of a liquid can also give rise to a jet fire in which two-phase behaviour is observed if the liquid is able to vaporise quickly. This is most likely to occur when a liquid is released from containment at a temperature above its boiling point at ambient conditions whereupon flash evaporation occurs, (for example propane, butane). Pressurised releases of non-volatile liquids (for example, kerosene, diesel, or stabilised crude) are unlikely to be able to sustain a two-phase jet fire, unless permanently piloted by an adjacent fire; even so, some liquid drop-out is likely and hence the formation of a pool. At high pressures, a spray of liquid droplets may be formed which can drift in ambient winds and become dispersed over a wide area. As for the gas jet fire described above, the two-phase jet fire is a turbulent diffusion flame produced by the continuous combustion of a fuel at a rate directly related to the mass release rate, producing a fire which is long and thin (although generally wider than a gas only jet fire) and highly directional. The exception is when liquid drop-out occurs, leading to a potentially increasing accumulation of fuel as a pool. Two-phase jet fires (particularly those generated by flashing liquid releases) are significantly less noisy than gas jet fires. As for gas jet fires, impact onto an obstacle larger than the flame half- width at the point of impact may shorten or modify the shape of a fire significantly. The liquid content results in relatively higher release rates for a given aperture and pressure compared to gaseous releases and, when the release is two-phase (such as may arise from a relatively long pipe connected to a liquid storage vessel), estimating the release rate is difficult. The output from Codes used to characterise 2-phase releases should be viewed with caution as these types of mixed fluid flows are very difficult to model accurately. The generally lower exit velocities from flashing liquid releases lead to shorter flame lift-offs and proportionately shorter and more buoyant flames overall. These lower velocities also make the fires more wind affected whilst the higher hydrocarbon content of these fuels increases the flame luminosity. However, two-phase releases involving gas dissolved in, or mixed with, a liquid can result in a jet fire which combines the worst aspects of both the gas jet fire and the flashing liquid jet fire, that is, high velocities and high flame luminosity. The higher hydrocarbon content also results in more soot being formed than in a natural gas jet fire, although there is no available experimental data quantifying the difference. Measurements in the smoke downstream of a ‘live crude’ jet fire determined an optical obscuration factor of typically 10 % over a 200 mm path length. This corresponds to a visibility distance of about 5 m. Issue 1

May 2007

Page 177 of 493

FIRE AND EXPLOSION GUIDANCE The soot produced then contributes significantly to the radiant emissions from the flame, resulting in a proportionately higher contribution of radiative flux to engulfed objects. However, the generally lower velocities arising from flashing liquid releases (such as propane or butane) results in a lower convective flux to engulfed objects. Impaction to an obstacle close to the leak can also result in a local cold spot and hence high temperature gradients to the surrounding hot areas, inducing thermal stress. In the case of a pressurised gas-liquid mixture (such as ‘live’ crude), the high velocities may still occur and result in a high convective contribution, whilst the higher hydrocarbon content maintains a high radiative contribution; making these type of jet fires a ‘worst case’ in terms of total heat flux to engulfed obstacles. Experimental work suggests that the maximum combined fluxes occur for gas-liquid mixtures which are about 70 % by mass liquid. A special case of interest at some installations is ‘live’ crude which includes a significant quantity of water. Experiments have shown that mixtures with a ‘water cut’ (defined as mass of water/mass of fuel x 100 %) of up to 125 % remain flammable, although not necessarily capable of supporting a stable flame in the absence of some other supporting mechanism. The inclusion of water also slightly increases flame length and flame buoyancy, and the amount of smoke produced reduces significantly. For water cuts under 50 % no significant reduction in heat fluxes to engulfed objects can be expected (<10 %). However, over 50 % the flames are significantly less radiative, and the overall heat flux to an obstacle can be reduced by 40 % or more.

5.2.2.6

Effect of deluge on two-phase jet fires

Compared to the situation with a gas jet fire, the use of dedicated vessel deluge to protect a vessel against a flashing liquid two-phase jet fire (e.g. propane, butane) can be more effective. The water interacts with the flame to some extent; reducing the flame luminosity and the amount of smoke produced. Nevertheless, at typical application rates (10 to 15 l min-1 m-2) it cannot be relied upon to maintain a water film over the vessel and hence to prevent vessel temperature rise in areas where dry patches form, although the rate of rise may be expected to reduce to 20-70 % of the rate without deluge for a propane jet fire. Similar behaviour has been noted for ‘live’ crude jet fires with dedicated deluge although, in this case, no reduction in the rate of temperature rise was observed in the area where the fire impacted the obstacle. However, in tests with an increased water application of 30 l min-1 m-2, a 2 tonne LPG tank was effectively protected when subjected to a 2 kg s-1 flashing propane jet fire. For ‘live crude’ jet fires, using area deluge at the ‘standard’ rate of 12 l min-1 m-2 is unlikely to modify the flame behaviour although there is some evidence that a higher deluge rate (24 l min-1 m-2) can result in water interaction with the flame, resulting in a shorter flame and some reduction in heat fluxes to certain areas of an engulfed object, notably the front (where flame impact occurs) and top areas. Since dedicated vessel deluge is more effective at reducing the radiative heat fluxes in the region to the rear of the vessel, the combination of area deluge and dedicated vessel deluge can be effective in reducing overall heat fluxes to a vessel such that the temperature rise is halted or at least the rate of temperature rise is reduced. This may prevent vessel failure, especially if combined with a blowdown strategy. As for gas jet fires, a major benefit of area deluge of two-phase jet fires arises from the attenuation of incident thermal radiation to the surroundings, which protect adjacent plant and in particular can aid escape by personnel. Even dedicated vessel deluge alone can result in some reduction (~15-20 %) in the incident thermal radiation to the surroundings as a result of modifying the flame characteristics.

Issue 1

May 2007

Page 178 of 493

FIRE AND EXPLOSION GUIDANCE Measurements in the combustion products downstream of ‘live crude’ jet fires determined an obscuration factor due to smoke of typically 10 % over a 200 mm path length without deluge and no significant change was noted in the presence of area deluge at 12 l min-1 m-2. At 24 l min-1 m-2 the smoke changed from black to grey due to the increased water vapour and this had the effect of increasing the obscuration factor to about 20 %, corresponding to a visibility distance of about 2 m.

5.2.2.7

Effect of confinement on two-phase jet fires

Confined two-phase jet fires are expected to behave in a similar manner to confined gas jet fires (see Section 5.2.2.3).

5.2.2.8

Confinement and deluge of two-phase jet fires

The effect of area deluge on two-phase jet fires in compartments is expected to be similar to that noted in Section 5.2.2.4 for gas jet fires. Extinguishment could give rise to a mist-air explosion hazard and/or the formation of a liquid pool. In tests involving only partial confinement around the upper area of a module, during which ‘dead spaces’ occurred close to ceiling, area deluge was found to be beneficial in reducing heat fluxes to the ceiling surface, reducing the flame extent and the amount of smoke produced.

5.2.3

Pool fires on an installation

5.2.3.1

Nature of hydrocarbon pool fires

A pressurised release of a hydrocarbon liquid which is not sufficiently atomised or volatile to vaporise and form a jet fire will form a pool. Similarly a spillage from non-pressurised liquid storage will result in a liquid pool being formed. Ignition of the vapours evolving from the liquid can lead to a pool fire which is a turbulent diffusion flame. For hydrocarbons such as condensate the vapours will evolve readily from a spillage and be easily ignited. For heavier hydrocarbons, such as diesel or crude oil, little vapour evolution occurs unless the fuel is heated and hence initial ignition of a spillage may be dependent on the presence of other fires in the vicinity providing sufficient energy to initiate vapour evolution. However, once ignited, the fire itself radiates heat to the pool surface causing more fuel to evaporate. The heat transfer from the flame to the pool controls the vapour evolution rate (and hence mass burning rate) and within minutes the fire will reach a steady state condition of flame size and mass burning rate. Larger fires from larger pools will tend to result in higher mass burning rates. However, an upper limit is reached when the radiation to the pool surface is independent of the flame thickness above it (optically thick). This occurs for fires only a few metres in diameter for heavy hydrocarbons due to the radiative emissions from soot. The mass burning rate is also dependent on the fuel type and for liquid hydrocarbons decreases with increasing carbon number (typically ranging from 0.1 kg m-2 s-1 for light hydrocarbons to 0.05 kg m-2 s-1 for some crude oils). Combustion of these relative high hydrocarbons inevitably leads to the production of large quantities of soot, particularly in large pool fires where the size of the pool reduces the ability of air to mix with the fuel evolving in the centre of the pool. The soot emissions result in the characteristic yellow flame and large quantities of smoke can be produced; to the extent that the smoke can result in reduced thermal radiation to the surroundings by screening of the radiant flame. Hence, the fraction of heat radiated, F (see Section 5.3.1 for definition), tends to decrease with increasing fire size, although the smoke hazard may increase.

Issue 1

May 2007

Page 179 of 493

FIRE AND EXPLOSION GUIDANCE In measurements in the smoke downstream of 16 m2 diesel pool fires, the obscuration factor over a 200 mm path length, as a result of the soot, was found to be typically 30 % corresponding to a visibility distance of about 1 to 2 m. CO levels measured at the same location were in the range 100-200 ppm v/v. However, a worst case level at the end of the flame of about 0.5 % v/v is recommended. Soot levels in the range 0.5 g m-3 to 2.5 g m-3 can be expected. Except in very large fires where buoyancy driven turbulence may become significant, the low velocities within the fire result in the flame being affected by the wind and this factor determines the trajectory of the flame. These low velocities also result in low convective heat fluxes to objects engulfed by the fire; the predominate mode of heat transfer being radiation.

5.2.3.2

Effect of deluge with hydrocarbon pool fires

General area deluge can be very effective in controlling hydrocarbon pool fires and mitigating their consequences. If the water is capable of reaching the liquid pool, the cooling of the fuel reduces vapour evolution and hence reduces the size of the flame. This, in turn, leads to reduced radiative heat transfer from the flame to the fuel surface which also contributes to reducing the vapour evolution. Consequently, with time, the fire size is reduced and complete extinguishment may result or, if not, sufficient control achieved that manual fire fighting could be safely undertaken. The ability of the water to enter the pool of fuel is higher on the upwind side of the fire where the thickness of the flame is least. Consequently, as the deluge starts to take effect on the fire, the flame retreats from the upwind side of the spillage. In tests involving condensate, the fire coverage of the pool was reduced by over 90 % in 10 minutes. Hence, after 10 minutes, the flame size was commensurate with a pool of less than 10 % of the original area. The introduction of a small percentage (1 %) aqueous film forming foam (AFFF) into the deluge system can significantly increase the rapidity of achieving fire control and extinguishment. Due to the much reduced fire size when a pool fire is subject to water deluge, the amount of smoke is also significantly reduced. Measurements of the obscuration factor over a 200 mm path length in the combustion products from a diesel pool fire dropped from typically 20-30 % to negligible levels when the fire was deluged and CO levels at the same location dropped from over 100 ppm v/v to typically 10 ppm v/v. However, if the water does not directly interact with the fire itself and only interacts with the stream of smoke evolving then there is no evidence that the water deluge ‘washes’ soot out of the smoke, nor that the toxicity (such as CO level) is reduced. A point of note is that the cooling effect of deluge may reduce the smoke buoyancy and possibly result in smoke being present at lower heights where it may hinder the visibility for personnel trying to escape. The heat loading to objects engulfed in a pool fire may also be reduced by the activation of deluge, most particularly on the surfaces where a water film can be maintained. The vulnerable areas will be the underside where the water cannot provide coverage and the downwind side where the flame is likely to be thickest. Nevertheless, in these areas the rate of temperature rise is likely to be reduced and additional benefit accrues from the action of the deluge in reducing the fire size. The use of dedicated vessel deluge would be expected to protect an object engulfed in a pool fire, especially in combination with general area deluge which will, simultaneously, reduce the degree of fire attack. As for jet fires, the water deluge will also provide benefit to objects not engulfed by the fire by attenuating the thermal radiation (see Section 5.2.2.2)

Issue 1

May 2007

Page 180 of 493


Confined hydrocarbon pool fires

The behaviour of confined pool fires will depend on the degree of ventilation and whether the confining structure becomes hot and re-radiates heat to the fire. In the case of adequate ventilation for combustion, the mass burning rate and fire behaviour will be similar to a pool fire in an unconfined area, unless the walls become hot due to insulation in which case the flame temperatures may rise significantly (by about 200-400 ºC) and hence the heat fluxes to objects within and near the flame will rise. This is associated with soot combustion and can lead to less smoke being evolved. However if the ventilation is less than that required for combustion the fire becomes ventilation controlled and the mass burning rate (and hence the vapour evolution rate) decreases to match available air flow. Due to the reduced burning rate, the flame size and heat fluxes to objects from ventilation controlled confined pool fires may be lower than from unconfined fires unless re-radiation from hot compartment walls increases flame temperatures. The restricted air flow may result in an external fire at the vent openings and so areas not previously exposed to fire outside the compartment may now be exposed to flame engulfment and thermal radiation. In under-ventilated conditions both the CO and soot levels increase. CO up to 5 % v/v may be measured at a vent prior to the onset of external flaming although at the end of an external flame the levels are likely to fall to less than 0.5 % v/v. Soot levels up to 3 g m-3 might be expected.

5.2.3.4

Confined hydrocarbon pool fires with deluge

When deluge is activated within a confined space, the residence time of the water droplets in the flame and hot walls leads to water evaporation within the flame and a significant reduction in flame temperatures. This then reduces the radiation back to the pool surface and results in a lower mass burning rate. An initially ventilation controlled pool fire may then become fuel controlled at this lower burning rate and any external flaming that had formed is likely to be reduced or to cease entirely.

5.2.3.5

Methanol pool fires

Methanol differs significantly from the hydrocarbon fuels discussed above. It burns with a nonluminous invisible flame. No soot is produced and the thermal emissions are dominated by the molecular emissions associated with the production of CO2 and water vapour. The flame height is about one third that expected from an equivalent sized hydrocarbon pool. The mass burning rate increases with increasing pool size and a value of 0.03 kg m-2 s-1 has been measured for a 10 m diameter pool. It is not known if the flame has reached ‘optical thickness’ at this scale and hence whether this would increase further for larger fires. The low radiative emissions of the flame results in a low fraction of heat radiated, F, and low heat fluxes to engulfed objects. On an offshore platform an important hazard may be to personnel entering the flame unwittingly due to its invisibility.

5.2.3.6

Hydrocarbon pool fires on the sea

Once established, a hydrocarbon pool fire on the sea will behave in a similar manner to an unconfined pool fire on an installation (See Section 5.2.3.1). Consequently, depending on the size of the fire, engulfment of the installation legs and the underside of the platform are possibilities. Flame temperatures of typically 900 to 1200 ºC can be expected and heat fluxes to engulfed objects up to 250 kW m-2.

Issue 1

May 2007

Page 181 of 493

FIRE AND EXPLOSION GUIDANCE Following initial ignition, the flame spread across the surface of a spill on the sea will depend upon the volatility of the fuel, and the wind speed and direction. For oil spills, the rate of flame spread downwind increases with increasing wind speed. The flames tend to spread from the ignition source downwind across the spill without significant crosswind spread and flame spread upwind is slow. The presence of sea currents or regular waves (swell) does not appear to influence flame spread but it may be curtailed by choppy conditions or steep waves. The significant difference between liquid spills on an installation and liquid spills on the sea is that on the sea it is unlikely that ignition will occur at all. Overall, the likelihood of ignition is low (especially for less volatile hydrocarbons such as crude oil) due to a number of factors which are discussed below. The likelihood of ignition also decreases with time following a spill, sometimes rapidly, so spills where immediate ignition could occur (or ignition has already occurred) are likely to be the main focus of attention. Firstly, and perhaps most importantly, the likelihood of an ignition source being present near the sea surface would generally be low. Assuming an ignition source is present, there are three main factors that influence the ignitability of liquid spills onto the sea, all of which are time dependent. Their significance in inhibiting ignition increases with time resulting in lower ignition probabilities. These are: pool thickness; fuel flashpoint; and emulsification. Following an initial spillage, the pool will spread out quickly reaching an equilibrium thickness within a few hours, even for a large spillage. This equilibrium thickness depends upon fuel type with typical values of less than 0.1 mm for light crude oils and 0.05-0.5 mm for heavy crude oils. However, there is a minimum pool thickness which is capable of supporting a stable flame; about 0.5 mm for condensate; 1 mm for light crude; and 1-3 mm for heavier oils. When the thickness falls below these levels, the cooling effect of the sea prevents evaporation of the fuel from the pool surface which is required for combustion. This is because the temperatures at the pool/water interface are never above 100 ºC and are generally close to ambient temperatures. When the pool is thick, a steep temperature gradient through the pool allows evaporation at the pool surface and potential ignition, especially if a high energy ignition source is present such as another fire which will enhance evaporation rates. Therefore, the fuel flashpoint is also a factor in determining the likelihood of ignition. Fuels with a flashpoint lower than the ambient temperature will ignite readily but those with a flashpoint over 100 ºC (such as stabilised crude oil) will require the presence of a major heat source to achieve ignition, such as a pre-existing fire on the platform. Therefore, the likelihood of ignition of a liquid spill reduces with time as the lighter fractions evaporate. Emulsification of a hydrocarbon fuel with sea water will reduce significantly its flammability. For crude oils, emulsions with over 25 % water are considered to be not ignitable. The cut-off point for condensate is unknown, but is likely to be higher. Emulsification of the fuel and water arises primarily as a result of the initial spill conditions and the subsequent weather/sea conditions. Breaking waves and wind speeds over 15 m s-1 will promote emulsification and result in a low probability of ignition. (The wave action will also cause fluctuations in the pool thickness and may result in breaking up of the pool and thereby prevent sustained burning). Spills which plunge into the sea from the platform, (which, if burning, may be extinguished in the process) are likely to break up and begin to emulsify. The least emulsification is likely to result if spills run down an installation leg or occur close to the sea surface. In the case of sub-sea oil pipeline failures in shallow water (<200 m), the oil plume widens as it rises through the water and breaks up into small droplets. Any significant gas component in the oil provides additional initial upward momentum and the oil droplets are likely to break the surface in a location above the original failure and then spread radially. However, the pool may then be carried along by tidal currents and wind. This process provides significant opportunity for emulsification and reduces the ignitability of any resulting pool. Issue 1

May 2007

Page 182 of 493

FIRE AND EXPLOSION GUIDANCE In case of stabilised crude, the lower initial buoyancy will result in the rising plume being more affected by tidal currents and the oil may reach the surface at a location displaced laterally from the original leak site. In deep water, some or all of the gas component may form gas hydrate solids and this results in a reduced initial upward velocity for the leak, leaving the oil droplets to rise purely as a result of their buoyancy. In these circumstances the lateral movement of the rising plume may be significant and the oil eventually reaches the surface some distance from the original leak location. Again, significant emulsification will have occurred resulting in very low ignition probabilities. In summary, a low velocity, ignited, large volume spillage of a volatile liquid hydrocarbon close to the sea surface near to the installation in calm or moderate conditions represents the worst case scenario in terms of a pool fire on the sea. Most other scenarios have a low likelihood of producing a pool fire. Experiments have been carried out by Sintef in two experiment series at Spitzbergen in 1994.

5.2.4

Gas fires from sub sea releases

In shallow water, failure of a sub-sea gas pipeline (or a pipeline containing a gas-oil or gas-condensate mixture with a high GOR) could give rise to a flammable gas release at the sea surface. However, the likelihood depends primarily on the depth of sea water. In shallow water the plume of bubbles will increase in radius approximately linearly as it rises through the water producing a conical plume. When close to the water surface, the streamlines diverge horizontally and tidal currents interact with the plume and this may result in the area where the gas bubbles break the surface being twice that expected by conical plume development only. Whether the resulting gas breaking the surface is flammable will depend on the rate of gas released and the area over which it breaks the surface which, as already noted, is related to the water depth. However, unless the water is very shallow (<10 m), the resulting gas release at the sea surface is likely to be a dispersed low velocity source and burn as a weakly turbulent diffusion flame, strongly affected by the wind. It could be considered as a ‘pool fire’ with an effective mass burning rate given by the release rate divided by the area over which the gas surfaces. A full bore rupture of a sub-sea pipeline will result in a highly transient outflow, so the resulting fire hazard will also vary with time. The operation of a sub-sea ESDV valve may limit the duration of the release and also give rise to a rapidly changing release rate with time. In deep water (>300 m) some formation of gas hydrates is likely and over 500 m some researchers report complete conversion to hydrates, although this also depends on gas composition and water temperature. In such cases, the hydrates will rise solely as a result of buoyancy and are likely to reach the sea surface some distance laterally from the original leak site. Some researchers suggest that water turbulence may keep the hydrates in suspension and the gas may never reach the surface.

5.2.5

BLEVE

Fire impingement on a vessel containing a pressure liquefied gas causes the pressure to rise within the vessel and the vessel wall to weaken. Even within a short timeframe, this may lead to catastrophic failure and the total loss of inventory. The liquefied gas which is released flashes producing a vapour cloud which is usually ignited. These events are known as Boiling Liquid Expanding Vapour Cloud Explosions, BLEVEs. This highly transient event generates a pressure wave and fragments of the vessel may produce a missile hazard leading to failure of other items in the vicinity and hence the potential for escalation. In addition, there is a flame engulfment and thermal radiation hazard produced by the fireball. Issue 1

May 2007

Page 183 of 493

FIRE AND EXPLOSION GUIDANCE Onshore, BLEVEs are generally associated with the storage of pressure liquefied fuels such as LPG. Experimental work has shown that a standard LPG storage vessel, incorporating the normal pressure relief valve, can fail catastrophically within 5 minutes of being subjected to a medium sized (<2 kg s-1 or ~100 MW) jet fire, despite operation of the relief valve. Following failure, a large approximately spherical fireball is produced which is highly radiative with little smoke obscuration due to the fuel atomisation and vaporisation leading to good mixing with the air. Consequently, the fraction of heat radiated, F, is higher than for a large pool fire involving the same fuel. The initial upward momentum and vorticity of the fireball causes it to rise into the air as it develops and eventually it burns out when all the fuel is consumed. How much of the initially liquid fuel vaporises and takes part in the fireball depends upon the degree of superheat of the fuel at the time of failure and also whether liquid becomes entrained into the flashing vapour. In the offshore context, a BLEVE hazard might be considered, for example, in relation to a pressurised separator vessel containing unstabilised condensate and gas. However, a BLEVE is unlikely to develop in the same way as described above for an onshore facility as the vessel will probably be located within a module amongst other vessels and pipework. The potential for escalation is thus much increased due to the proximity of other vessels and pipework which may be struck by missiles. Additionally, the presence of this other equipment may lead to increased overpressures being developed as the burning gas cloud expands through the congested region. The presence of roof confinement will significantly modify the shape of the developing fireball and lead to increased lateral development. Even a small inventory of fuel being involved in a BLEVE event (<100 kg) would be expected to produce a fireball extending throughout the entire volume a typical module. Consequently, apart from the risk of the BLEVE causing escalation, the event presents a severe hazard to exposed personnel. Whilst pre-activation of deluge (area and dedicated vessel deluge) may prevent or delay the occurrence of a BLEVE, the deluge is unlikely to provide any significant benefit in terms of mitigation of the event, especially within the region of potential flame engulfment.

5.3

Fire and smoke loading

5.3.1

Fire loading to the surroundings

An obvious hazard presented by a fire is the thermal radiation to the surroundings, in particular to personnel during escape and evacuation. The incident thermal radiation, q, to a person or object from a fire can be described as: q=VEt

(kW m-2) ................................................................. Equation 5-1

Where: V

is the view factor of the flame by the receiver,

E

is the average surface emissive power of the flame (kWm-2) (Note the surface emissive power varies over the surface of the flame and hence an area-based average is required to represent the whole surface)

τ

is the atmospheric transmissivity

The view factor is a function of the flame shape. Consequently, most integral or empirical mathematical models will assume some kind of simplified flame shape which is then used to calculate the view factor. The flame average surface emissive power is also a function of the flame shape. Therefore, average surface emissive powers used by the model will not necessarily be the same as those measured during an actual fire. Issue 1

May 2007

Page 184 of 493

FIRE AND EXPLOSION GUIDANCE In the far field, (typically more than 2 flame lengths away) the flame shape is not critical, so a simplified approach can be taken using the ‘point source’ model, whereby the difficulties of defining a flame shape and associated average surface emissive power can be avoided. In this approach, the fraction of the heat of combustion of the fuel radiated to the surroundings is defined as:

F=

EA ....................................................................................... Equation 5-2 Q

Where: A

is the surface area of the flame (m2)

Q

is the net rate of energy release by combustion of the fuel (kW) and Q = m& H

m&

is the rate of fuel combustion (kg s-1)

H

is the net calorific value (kJ kg-1)

The incident radiation received in the far field at a distance, d (m), from the fire is then expressed as: qd =

τ F m& H ................................................................................ Equation 5-3 4 π d2

The atmospheric transmissivity will depend upon the prevailing atmospheric conditions (absolute humidity) and the path length, but might typically be 0.8 on a dry day. However, fog would significantly reduce this value. The activation of water deluge on an offshore installation, producing water droplets in the air, effectively reduces the transmissivity by absorbing radiation. However, for the purposes of this document, a revised ‘effective’ fraction of heat radiated is defined as F ′ , accounting for the reduced transmissivity in the area being deluged, (but not including the transmissivity of the atmosphere between the fire and the receiver which is outside the deluged area). The incident radiation at a distance, d(m), from the fire can be estimated using:

qd =

τ F ′ m& H .............................................................................. Equation 5-4 4 π d2

Note that the above equation does not necessarily take account of any effect of the deluge on the flame behaviour itself – such as lowering the flame temperature or size. As will be noted later, jet fires are little affected by deluge, but pool fires can reduce significantly in size. In the case of pool fires, this reduction in size (area of the surface actually burning) would result in a reduced value of m& and hence would be reflected in calculations made using the above equation.

Issue 1

May 2007

Page 185 of 493

FIRE AND EXPLOSION GUIDANCE This ‘point source’ model can be useful for estimating the distance to a given radiation level. In the case of personnel, it is important to consider both the level of radiation and the duration of exposure and the consequences for personnel (in terms of burn injuries or fatality) are often related quantitatively to the dosage level, S d , given by:

( 4 3) dt ...............................................................................

S d = ∫ qd

Equation 5-5

As a guide, a radiation level of about 5 kWm-2 can be tolerated for about one minute and consequently represents a level from which it is reasonable to assume that escape, without significant injury, would usually be possible for an average employee wearing typical protective clothing, (see also Section 5.5.1.13). However, the point source model is not suitable for estimating incident radiation to locations close to (certainly within one flame length) of the flame, where it may be significantly in error. In the near field, a mathematical model which defines a realistic flame shape (and ideally a variation of surface emissive power over the flame to allow for smoke obscuration) should be used.. Typical values of F and F ′ are provided in Section 5.4.2 for a range of fire types.

5.3.2

Thermal loading to engulfed objects

The thermal load per unit area to an object engulfed by fire will be a combination of radiation from the flame (qrl) and convection from the hot combustion products (qcl) passing over the object surface. Hence the thermal load can be written as:

q1 = qrl + qcl

(

)

q1 = ε f σ T f4 + τ f σ Ta4 + h T f − Ts ............................................... Equation 5-6 where

ε f , τ f are the flame emissivity and transmissivity respectively,

σ

is the Stefan-Boltzmann constant (5.6697 x 10-11 kWm-2K-4)

T f , Ts and Ta

are the flame, object surface and ambient temperatures respectively

(K) h is the convective heat transfer coefficient (kWm-2K-1)

However, not all the thermal loading is necessarily absorbed by the surface, some may be reflected back and the surface will also lose heat by radiation. Hence the total absorbed load per unit area ( qt ) is given by:

(

qt = ε f α s σ T f4 − ε s α f σ Ts4 + α s τ f σ Ta4 − ε s τ f σ Ts4 + h T f − Ts

)

Equation 5-7

where α s , α f are the absorptivities of the surface and flame respectively. Assuming that both the flame and surface can be considered as diffuse grey bodies, then α s = ε s , α f = ε f and

τ f = 1 − ε f . Furthermore, the term involving Ta is small and can be neglected, giving: qt = qr + qc Issue 1

May 2007

Page 186 of 493


(

) (

)

qt = ε s σ ε f T f4 − Ts4 + h T f − Ts ............................................... Equation 5-8

When considering an actual object engulfed by a fire, the flame temperature exposed to different parts of the object surface may vary; similarly the flame velocities (and hence convective heat transfer coefficient) may vary. Hence, to determine the total load absorbed by an object, Equation 5-8 should be summed over the area of the object. Also, as the object engulfed in the flame heats up, the absorbed load will reduce. This is particularly the case with the convective load which reduces linearly with increasing object temperature. Therefore, for an accurate transient calculation of the temperature rise of an object, the parameters T f , ε f and h are required, together with the emissivity of the surface (which itself may change as the surface heats up). Where possible, typical values of these parameters are provided in Section 5.4.2. However, researchers often quote heat fluxes measured during experiments using calorimeters (for total heat flux) and radiometers (for radiative flux). These instruments are designed to have a surface emissivity close to 1 and are maintained at a low temperature throughout the experiments. Hence the fluxes measured and reported for calorimeters are given by Equation 5-8 with ε s = 1 and Ts ≈ 333 K and can be regarded as a conservative estimate of the total heat flux absorbed by an engulfed object. Radiometers are designed and calibrated to measure ε f σ T f4 . At an early stage, whilst Ts is low, the flux measured by a

radiometer is approximately ( qr ε s ) and so, if ε s is taken as 1, it provides a conservative estimate of the radiative flux absorbed by an object. Subtracting the measured radiative flux from the measured total heat flux enables the initial convective flux absorbed by the object to be determined. Using an estimated or measured value for T f enables h to be determined at the measurement location. In this way, experimentally measured flux levels can be used to derive input data for transient heat-up calculations (see also Section 5.5.1.6). Consequently, typical values of the total, radiative and convective fluxes (as defined in Equation 5-8 above with ε s = 1 and Ts ≈ 333 K ) are also provided in Section 5.4.2 for the range of fire types.

5.3.3

Smoke loading

The combustion of hydrocarbons produces large volumes of initially high temperature combustion products which disperse and cool down. If combustion is efficient and complete then the products from burning a hydrocarbon mixture comprise carbon dioxide and water vapour. These are not toxic or harmful, providing the ambient oxygen levels are not significantly affected. (The foregoing excludes fuels containing sulphur or sulphur compounds which can present a toxic hazard). However, the combustion process of non-premixed hydrocarbon fuels is rarely so efficient (especially for higher hydrocarbons) and intermediate combustion products such as carbon monoxide (CO) and soot (carbon particles) are usually formed within the flame and may persist beyond the flame envelope within the stream of combustion products. Incomplete combustion may also lead to unburnt fuel being carried over in the products as well. CO is toxic and soot particles are an irritant to the lungs. The soot also reduces visibility and may affect the ability to escape.

Issue 1

May 2007

Page 187 of 493

FIRE AND EXPLOSION GUIDANCE The amount and nature of the combustion products produced by a fire is determined by the fuel combustion rate and the amount of air involved in the combustion reaction or entrained within it. A rough estimate of the mass flow rate of combustion products evolving from a fire can be made by multiplying the fuel mass burning rate by the ratio of air needed for complete combustion. For methane this figure is about 17.2 and for higher hydrocarbons it is about 15. The equivalence ratio, φ , defined as:

φ =r

m& ........................................................................................ Equation 5-9 a&

Where;

m& is the mass burning rate of fuel is the mass rate of air entrained

a&

r is the mass ratio of air to fuel required for stoichiometric burning (that is ~15)

Hence, for stoichiometric burning, φ = 1 and the rate of formation of products will be (r + 1) times the mass burning rate of fuel. For well ventilated fires where plentiful air mixes with the fuel, φ < 1 and more products may be produced compared to the case of stoichiometric combustion. However, the excess air in the products dilutes the smoke, reducing both the concentration of toxic products and soot and also lowering the temperature. For fires where the ventilation is restricted to an extent that insufficient air is available for complete combustion, φ > 1 and the concentrations of intermediate combustion products (for example CO and soot) will increase and are more likely to persist beyond the flame envelope. The amount of CO within the combustion products is usually quantified in terms of its volume concentration as a volume percentage (or ppm). For soot, the mass concentration of particles in the combustion products is difficult to measure and an alternative approach is to determine the optical density by measuring the attenuation of a beam of light passing through the smoke. The optical density, D10 , is given by: ⎛ I ⎞ 10 D10 = −10 log10 ⎜ ⎟ = κ C L ............................................. Equation 5-10 ⎝ I 0 ⎠ 2.303 Where; I

is light intensity through the smoke

I0 is the intensity without smoke

κ is the extinction coefficient C is the mass concentration of soot (g m-3) L

Issue 1

is the path length of the optical beam through the smoke

May 2007

Page 188 of 493

FIRE AND EXPLOSION GUIDANCE The optical density, expressed in terms of unit path length (D10 / L in db m-1) correlates reasonably well with visibility with 1 db m-1 corresponding to a visibility of about 10 m and 10 db m-1 corresponding to about 1 m. The visibility of exit signs can be significantly improved if they are back-illuminated and may be seen at 2.5 times the distance of a surface illuminated sign. For more information on smoke and its effects on people, refer to Section 7.8.5.2.

5.4

Estimating fire and smoke loadings

5.4.1

Inventories and release rates

The inventories of isolatable sections between ESDVs may vary considerably but typically would be less than 10 tonnes for gas and 25 tonnes for liquids, excluding those associated with the well and risers and utility fuels such as diesel and methanol. The inventory of an isolatable section and the size of a leak will determine the maximum duration of resulting fire. For gas inventories, this duration may be further reduced by a successful blowdown of the isolated section. Hence, the duration of large gas leaks may be relatively short. For liquid spills, an effective drainage system may limit the inventory involved in a fire. Historical data also shows that the likelihood of a release is also related to its size, with the smallest leaks being more common. The resulting fire size following an accidental release will be strongly dependent on the mass release rate of the fuel, which will be determined by the hole size and pressure. For a QRA a range of representative scenarios should be considered (see also Section 2.6.5.9). A leak classification often used is: • Small leaks – typically 0.1kg s-1 • Medium leaks – typically 1kg s-1 • Large leaks – typically 10 kg s-1 • Major failures – typically >30 kg s-1 For high pressure gas releases, these correspond to failure sizes of the order of 1, 10, 30 and 100 mm diameter respectively. In the following section, these leak sizes are considered for the gas jet fires and two-phase jet fires. For leak sizes 10 kg s-1 and above, the fire is large compared with the average module and it may be necessary to consider the fire to be ‘confined’ with the consequent effects on fire characteristics as discussed in Sections 5.2.2.3 and 5.2.3.3. For pool fires, two sizes are considered: •

Small pool (typically less than 5 m diameter)

•

Large pool (typically >10 m in diameter)

A small pool fire might typically result for a leak rate in the region of 1 to 2 kg s-1 and, within a typical open module, would be expected to burn in the fuel controlled regime, that is, sufficient air for combustion should be available and the fire behaviour would not be affected by confinement or restricted ventilation. A large pool fire would be expected to produce a flame reaching to the roof of a module and be affected by the confinement. It may also suffer from restricted ventilation. Consequently, the effects of confinement on fire characteristics as discussed in Section 5.2.3.3 need to be considered. Page 189 of 493 Issue 1 May 2007

FIRE AND EXPLOSION GUIDANCE A similar effect might arise for a small pool fire within a compartment within a module and these fires should be considered as behaving like a large pool fire. For pool fires on the sea, only large spills are considered, as small spills are unlikely to affect the installation. Similarly, only a gas fed fire at the sea surface due to major failure of a 24” diameter sub-sea pipeline is considered. For BLEVEs, as discussed in Section 5.2.5 even a small inventory would be expected to give rise to a fireball extending throughout a module resulting in serious consequences for personnel within the immediate area.

5.4.2

Typical values

5.4.2.1

General

Ideally, the fire size and thermal loading from fires should be assessed using mathematical models which have been extensively validated against large scale data. A range of such models are available on a licence or consultancy basis. (See Section 5.4.3 and Annex F). However, a simplified approach was proposed in the Interim Guidance Notes, whereby correlations for flame dimensions were suggested for jet and pool fires together with guidance on typical heat loadings to engulfed objects. In this section a similar approach to the Interim Guidance Notes is taken and updated to reflect recent knowledge and experimental work. For the six fire types identified and discussed in Section 5.2, tabulated values are provided giving guidance on typical fire sizes and heat loadings for the release rates identified in Section 5.4.1. The values presented were derived from information in the literature; the results of an extensive body of large scale experimental data (some of which is unpublished but to which Advantica has kindly provided access); and predictions made by Shell and Advantica. In essence the fire loading data presented here is an updated, more detailed and comprehensive version of the guidance values provided in the Energy Institute document ‘Guidelines for the design and protection of pressure systems to withstand severe fires’ Information on smoke loading is also based on experimental data gathered by Advantica and Shell, much of which is unpublished.

5.4.2.2

High pressure jet fires – gas and two-phase

Wherever possible, the following information is provided for the four release rates of Section 5.4.1: •

The expected flame extent, so that items or personnel within that range can be identified and the consequences of flame engulfment considered.

•

The Fraction of Heat Radiated, F, so that estimates of the far field incident radiation hazard can be made using Equation 5-3 in Section 5.3.1.

•

The CO level and soot concentration in the smoke produced.

•

The total heat flux to an engulfed object together with the radiative and convective components, so that calculations of the object heat-up can be performed (see Section 5.5 “Heat transfer”). Note that these fluxes represent the initial values when the engulfed object is cold. Values of typical flame temperature, emissivity and convective heat transfer coefficients are also provided.

Issue 1

May 2007

Page 190 of 493


The effect of deluge (where appropriate) in terms of the reduction in the heat flux to engulfed objects and the enhanced attenuation of incident radiation to the surroundings using the Effective Fraction of Heat Radiated, F’ (see Equation 5-4).

•

The effect of confinement on fire characteristics and the combined effect of confinement and deluge.

This information is presented in Table 5.1 for gas jet fires and Table 5.2 for two-phase jet fires. As discussed in Section 5.2.2.5, for two-phase jet fires, the maximum heat fluxes to engulfed objects have been found to occur when the mixture is about 30 % gas and 70 % liquid by mass. Consequently, the values shown in Table 5.2 correspond to this worst case condition. Table 5.1 - High pressure gas jet fires Size (kg s-1)

0.1

1.0

10

>30

Effect of confinement

Flame length (m)

5

15

40

65

Affected by enclosure shape and openings

Fraction of heat radiated, F

0.05

0.08

0.13

0.13

CO level (% v/v) and smoke concentration (g m-3)

CO < 0.1

CO < 0.1

CO < 0.1

CO < 0.1

Soot ~0.01

Soot ~0.01

Soot ~0.01

Soot ~0.01

Total heat flux (kWm-2)

180

250

300

350

Radiative flux (kWm-2)

80

130

180

230

Convective flux (kWm-2)

100

120

120

120

Flame temperature, Tf (K)

1560

1560

1560

1560

Flame emissivity,

0.25

0.40

0.55

0.70

Convective heat transfer coefficient, h (kWm-2K-1)

0.08

0.095

0.095

0.095

εf

Effect of deluge

No effect on heat loadings to engulfed objects. In far field, take F’=0.8F for 1 row of water sprays, F’=0.7F for 2 rows and F’=0.5F for >2 rows at 12 l min-1 m-2, for use in Equation 5-4.

Increased CO up to about 5 % v/v at a vent prior to external flaming, but after external flaming <0.5 % v/v at the end of the flame. Soot levels depend on equivalence ratio from about 0.1 g m-3 at φ = 1.3 to 2.5 g m-3 at φ = 2.0 Increased heat loadings up to 400 kWm-2. (280 kWm-2 radiative, 120 kWm-2 convective, Tf = 1600K, εf = 0.75, h = 0.09)

Risk of extinguishment and explosion hazard if deluge activated when enclosure is already hot and fire is well established.

May improve combustion efficiency and reduce CO levels within flame.

Issue 1

May 2007

Page 191 of 493


It should be noted in Table 5.1 and Table 5.2 that for the largest leaks (i.e. a flow rate >30 kg s-1 a single number is given for the total heat flux which could be interpreted as implying a constant value for all of these larger release rates. Where heat flux calculations are required for larger leak rates, the heat flux figures should be used with caution, CFD simulations can be used to obtain data on the effects of larger fires. Table 5.2 - High pressure two-phase jet fires

Fuel mix of 30 % gas, 70 % liquid by mass Size (kg s-1)

0.1

1.0

10

30

Flame length (m)

5

13

35

60

Fraction of heat radiated, F

Flashing liquid fires (e.g. propane/ butane).

1.0

Affected by enclosure shape and openings

See equation below table

CO level (% v/v) and smoke concentration (g m-3)

CO < 0.1 Soot ~0.01

CO < 0.1 Soot ~0.01

CO < 0.1 Soot ~0.01

CO < 0.1 Soot ~0.01

Total heat flux (kWm-2)

200

300

350

400

230


100

180

230

280

160

Convective flux (kWm-2)

100

120

120

120

70


1560

1560

1560

1560

1300

Flame emissivity, εf

0.30

0.55

0.70

0.85

1.00

Convective heat transfer coefficient, h (kWm-2K-1)

0.080

0.095

0.095

0.095

0.070

Effect of deluge

Issue 1

Effect of Confinement

Increased CO up to about 5 % v/v at a vent prior to external flaming, but after external flaming <0.5 % v/v at the end of the flame. Soot levels depend on equivalence ratio from about 0.1 g m3 at φ = 1.3 to 2.5 g m-3 at φ = 2.0

Some benefit to engulfed objects but temperature may still rise although at a slower rate. Combined area and dedicated deluge may prevent temperature rise if effectively applied. See Section 5.2.2.6. In far field take F’ as per Table 5.1.

May 2007

Increased heat fluxes, take values as per 30 kg s-1 two-phase jet fire.

Risk of extinguishment and potential formation of pool.

Page 192 of 493

FIRE AND EXPLOSION GUIDANCE Fraction of Heat Radiated, Fm , of mixture involving x% liquid by mass: ⎛ x ⎞ Use Fm = ⎜ ⎟ ⋅ ( FL − FG ) + FG where FG is the fraction of heat radiated for natural gas as ⎝ 100 ⎠ given in Table 5.1 and FL is the fraction of heat radiated for the liquid fuel involved. Take FL = 0.24 for C3; 0.32 for C4, 0.45 for C6-C25 (including condensate and diesel); and 0.5 for crude oil.

5.4.2.3

Pool fires on the installation

The following information is provided for pool fires on an installation:

•

The expected flame extent, so that items or personnel within that range can be identified and the consequences of flame engulfment considered.

•

The mass burning, so that the duration of a fire following a spillage might be assessed and to provide input to calculations of the incident radiation field.

•

The Fraction of Heat Radiated, F, so that estimates of the far field incident radiation hazard can be made using Equation 5-3 in Section 5.3.1, where the rate of fuel combustion, m& , is taken as the mass burning rate times the area of the pool.

•


•

The total heat flux to an engulfed object together with the radiative and convective components, so that calculations of the object heat-up can be performed (see Section 5.5). Note that these fluxes represent the initial values when the engulfed object is cold. Values of typical flame temperature, emissivity and convective heat transfer coefficients are also provided.

•

The effect of deluge in terms of the reduction in the heat flux to engulfed objects and the enhanced attenuation of incident radiation to the surroundings using the Effective Fraction of Heat Radiated, F’ (see Equation 5-4).

•

The effect of confinement on fire characteristics and the combined effect of confinement and deluge.

This information is presented in Table 5.3.

Issue 1

May 2007

Page 193 of 493

FIRE AND EXPLOSION GUIDANCE Table 5.3 Pool fires on the installation Pool fire parameter

Methanol pool

Small hydrocarbon pool

Large hydrocarbon pool

Effect of confinement

Typical Pool Diameter (m)

5

<5

>5

Any

Flame Length (m)

Equal to pool diameter

Twice pool diameter

Up to twice pool diameter

Mass Burning Rate

0.03

Crude – 0.045-0.06 Diesel – 0.055 Kerosene – 0.06 Condensate - 0.09 C3/C4s – 0.09

Crude – 0.045-0.06 Diesel – 0.055 Kerosene – 0.06 Condensate - 0.10 C3/C4s – 0.12

Fraction of Heat Radiated, F

0.15

0.25

0.15

See Section 5.4.2.3. Take values as per large hydrocarbon pool fire for worst case. If confinement is severe then mass burning rate will decrease to match available air flow and large external fire at vent expected.

CO level (% v/v) and Smoke Concentration (g m-3)

Negligible

CO < 0.5 Soot 0.5 – 2.5

CO < 0.5 Soot 0.5 – 2.5

Increased CO up to about 5 % v/v at a vent prior to external flaming, but after external flaming about 0.5 % v/v at the end of the flame. Soot levels up to 3 g m-3 .

Total Heat Flux (kWm-2)

35

125

250

Radiative Flux (kWm-2)

35

125

230

See Section 5.4.2.3 Take values as per large hydrocarbon pool fire.

Convective Flux (kWm-2)

0

0

20


1250

1250

1460

Flame emissivity, εf

0.25

0.90

0.90

Convective Heat Transfer, h Coefficient (kWm-2K-1)

-

-

0.02

(kg m-2 s-1)

Issue 1

May 2007

Page 194 of 493

FIRE AND EXPLOSION GUIDANCE Pool fire parameter

Methanol pool

Small hydrocarbon pool

Effect of Deluge

Extinguishable using AFFF. Water soluble but effect of water deluge unknown.

See Section 5.2.3.2

Large hydrocarbon pool

Considerable fire control and potential extinguishment can be achieved. Expect a reduction in flame coverage (and hence flame size) of up to 90 % within 10minutes. Rapid extinguishment with AFFF. Up to 50 % reduction in radiative heat flux to engulfed objects.

Effect of confinement See Section 5.2.3.4. Expect reduced flame temperatures and reduced or no external flaming. Mass burning rate reduces to match available air flow.

In far field take F’ = 0.8F for 1 row of water sprays, F’=0.7F for 2 rows and F’=0.4F for >2 rows at 12 l min-1 m-2

5.4.2.4

Fires on the sea

The following information is provided in Table 5.4 for hydrocarbon pool fires on the sea:

•

The expected flame extent, so that items within that range can be identified and the consequences of flame engulfment considered.

•

The mass burning, so that the duration of a fire following a spillage might be assessed and to provide input to calculations of the incident radiation field.

•

The Fraction of Heat Radiated, F, so that calculations of the far field incident radiation hazard can be made using Equation 5-3, where the rate of fuel combustion, m& , is taken as the mass burning rate times the area of the pool.

•


•

The total heat flux to an engulfed object together with the radiative and convective components, so that calculations of the object heat-up can be performed (see Section 5.5 “Heat transfer”). Values of typical flame temperature, emissivity and convective heat transfer coefficients are also provided.

The gas outflow from a sub-sea pipeline will depend on the pressure and the pipeline size. The release will also vary with time; this variation depending upon the length of pipeline which is depressurising. Similarly, the area at the sea surface over which the gas emerges will depend on the depth and the gas release rate. Furthermore, depending on the gas outflow and the depth, the gas plume at the sea surface may not be within flammable limits. For these reasons, simplified guidance cannot be readily provided and the use of a model is recommended. This topic is an area of some uncertainty and model predictions vary considerably. For illustrative purposes, predictions of the fire hazard following the rupture of a long 24” diameter natural gas pipeline operating at 100 barg at a depth of 50 m suggest that the fire diameter might be of the order of 100 m with a flame length of 150-200 m. On the basis that the fire is a low velocity laminar flame, it can be regarded as a large pool fire and the values presented in Table 5.4 for fraction of heat radiated and heat fluxes are recommended.

Issue 1

May 2007

Page 195 of 493

FIRE AND EXPLOSION GUIDANCE Table 5.4 - Hydrocarbon pool fire on the sea Pool fire on sea parameters Typical Pool Diameter (m)

>10

Flame Length (m)

Up to twice diameter

Mass Burning Rate (kg m 2 s 1)

Crude – 0.045-0.060 Diesel – 0.055 Kerosene – 0.060 Condensate – 0.100 C3/C4s – 0.200

Fraction of Heat Radiated, F CO level (% v/v) Concentration (g m-3)

5.4.2.5

Value

and

0.12 Smoke

CO < 0.5 Soot 0.5 – 2.5

Total Heat Flux (kWm-2)

250

Radiative Flux (kWm-2)

230

Convective Flux (kWm-2)

20

Flame Temperature (K)

1460

Flame Emissivity,

0.90

Convective Heat Transfer Coefficient, h (kWm-2K-1)

0.02

BLEVEs

BLEVEs are highly transient events in which a fixed inventory is instantaneously released. The subsequent combustion gives rise to a fireball which grows in size to a maximum before burning out as all the fuel is consumed. Consequently, the key parameters of interest in terms of a consequence assessment are the extent of the flame and the incident radiation hazard to personnel outside the flame. These parameters are also highly transient. In relation to incident radiation levels outside the fireball, both the maximum level experienced and the ‘dosage’ over the duration of the event are of interest in order to determine the effect on people. Consequently, Table 5.5 presents the following data in relation to BLEVEs:

•

Typical maximum fireball diameter (assuming unconfined) based on the mass of fuel involved in the BLEVE, and the maximum flame volume calculated assuming a spherical geometry. Hence the area of a module which would be expected to be engulfed in flame can be assessed by dividing the volume of the fireball by the height of the module.

•

The expected duration as a function of the mass of fuel involved in the BLEVE.

•

The Modified Fraction of Heat Radiated F*, which can be used to calculate the maximum incident radiation received at a location d, remote from the fireball (more than one fireball diameter distant from edge of fireball) using the equation:

Issue 1

May 2007

Page 196 of 493

FIRE AND EXPLOSION GUIDANCE qd ,max =

τ F*M H 4 π d2 t

kWm-2 ...................................................... Equation 5-11

where: t is the duration of the BLEVE event (s)

τ is the atmospheric transmissivity M is the mass of fuel involved in the BLEVE (kg) H is the calorific value (kJ kg-1) d is the distance from the centre of the fireball where the dosage is experienced (m)

Various correlations have been developed relating the maximum diameter (D), maximum height (h) and duration (t) of the fireball following an unconfined BLEVE to the mass of fuel released, for example CCPS Guidelines for Chemical Process Quantitative Risk Analysis [5.1] suggests that: D = 6.48 x M0.325 h = 0.75 x D t = 0.825 x M0.26

These equations have been used to derive the values presented in Table 5.5 for maximum diameter and duration. Comparisons with large scale data showed reasonable agreement.

Table 5.5 - BLEVEs Parameter

Characteristic expressed as function of BLEVE fuel mass (kg of fuel) D = 6.48 x M0.325

Maximum Diameter (m) Maximum Flame Volume (m3)

V = 142.47 x M0.975 t = 0.825 x M0.26

Duration (s)

Modified Fraction of Heat Radiated, F*

5.4.3

0.35 (ONLY for use in Equation 5-11 to derive maximum incident radiation at a locations remote from the fireball)

Predictive models for fire loading

There are basically three types of predictive models which can be used to predict fire characteristics and the thermal loading from fires, these being:

•

Empirical models;

•

Integral (or phenomenological) models;

•

Numerical (CFD) models.

Issue 1

May 2007

Page 197 of 493

FIRE AND EXPLOSION GUIDANCE Empirical models contain, to varying degrees, a physical basis combined with correlations which have been derived from experimental data. They are generally easy to use, but their applicability is limited to the range of experimental data used to derive them. Integral models use equations relating the fire characteristics to the physical processes involved, such as mixing, combustion and thermal emissions. However, the relationships are simplified and are generally one-dimensional. Such models will also often contain some parameters which have been empirically derived from experimental data. Nevertheless, integral models provide an effective method for predicting fire characteristics and are generally easy to use. Strictly speaking, they should only be applied to the range of circumstances for which they have been validated by experimental data. However, because of the physical basis of the equations, the models can be applied, within reason, to situations outside this range. Numerical models (CFD) attempt to model in 3-dimensions the time varying processes within a fire such as the fluid flow and combustion processes. In principle, this physical basis enables these models to study complex geometries and conditions far removed from experimental data used to validate them. It is noted that resulting predictions may be sensitive to small changes in input parameters if not used properly. Therefore these models generally require ‘expert’ users.. For these reasons, CFD codes are not routinely used for general risk assessments. However, they can be useful to study in detail a particular fire scenario of interest due to its severity. The impact of potential design changes (such as increased ventilation) can then compared and provide at least qualitative guidance on how to reduce the hazard. The CFD predictions use more realistic geometry and dynamic models and may require the risk assessment to take into account new parameters such as the leak jet direction, leak location, and the dynamic behaviour of the fire. This makes the risk analysis larger. For explosion risk, the CFD method is well established following the NORSOK Z13 standard [5.2]. However, for fire risk calculations, it is not routinely used. Annex F discusses the above model types in more detail and provides an in-depth review of different fire modes currently available.

5.5

Heat transfer

5.5.1

Mechanisms for heat transfer

5.5.1.1

General

Basic heat transfer by radiation, convection and conduction is well covered in the standard text books (e.g. Incropera and De Witt, 2002 [5.3]). This section concentrates on determination of heat transfer using the values identified in Table 5.1 through to Table 5.5 for key parameters measured in intermediate and large scale trials as; previously, these have not been readily available. This follows on from the approach recommended by the Energy Institute (formerly the Institute of Petroleum) in assessing the effect of severe fires on pressure vessels (Energy Institute, 2003) [5.4].

5.5.1.2

Radiation

Radiation from the hot gases and incandescent soot particles is the main mechanism for transferring heat. For flames with relatively little momentum, e.g. pool fires, radiative transfer to an impinged object represents at least 80 % of the heat transferred. Even with impinging high velocity jet fires, radiative heat transfer still represents 50 % to 60 % of the heat load.

Issue 1

May 2007

Page 198 of 493

FIRE AND EXPLOSION GUIDANCE The radiative heat emission process is modelled by assuming that the radiation comes from the flame surface. The surface emissive power (SEP) of a flame is the heat radiated outwards per unit surface area of the flame. Generally, a uniform SEP is taken over the whole flame shape but this a gross simplification of what may happen in practice. For example, in a large pool fire, the base of the flame may have the relatively high SEP of 180 kW m-2 whereas the smoke obscured flames, which may comprise two thirds of the flame shape, may have the relatively low SEP of 60 kW m-2. If an object is definitely not directly impinged by flame, the radiative heat transfer is given by Equation 5-12 below.

qrad = VF Eτ .................................................................................. Equation 5-12 where VF is the geometric view factor, E (kW m-2) is the surface emissive power of the flames and is the atmospheric transmissivity. The view factor is purely a geometrical parameter determining the proportion of radiation leaving one surface which reaches a second surface. As radiation travels in straight lines, only those parts of the respective surfaces that can see one another contribute to the value of the view factor. Analytical expressions for the view factor are available for standard geometries, e.g. McGuire J H, 1953 [5.5]. For example, pool fires may be represented by tilted cylinders, jet fires by a conical frustum and fireballs by circular discs through the centre of the fireball. Numerical integration may be used for more complex geometries where the flame surface is divided into a series of regular shapes (e.g. triangles or squares) and the view factors for each of these summed. Atmospheric attenuation is primarily caused by absorption of radiation by carbon dioxide and by water vapour and scattering by dust particles. The atmospheric transmissivity over a specified path length, due to the presence of water vapour and carbon dioxide, can be calculated from the temperature and relative humidity of the atmosphere provided that the emission spectrum is known. Usually it is assumed that there is emission at every wave length (black or grey body). For path lengths of 10 m or less it is usual to take the atmospheric transmissivity as 1. Expressions of differing complexity are available ranging from those that just take distance into account to those that also consider water and carbon dioxide concentration. The following empirical expression can be used, which takes both water vapour and carbon dioxide concentrations into account:

t = 1.006 − 0.01171 ⎡⎣log10 X ( H 2O ) ⎤⎦ − 0.02368 ⎡⎣log10 X ( H 2O ) ⎤⎦ −0.03188 ⎡⎣log10 X ( CO2 ) ⎤⎦ + 0.001164 ⎡⎣ log10 X ( CO2 ) ⎤⎦

2

2

Equation 5-13

Where

X ( H 2O ) = Rh d S mm

288.651 ..................................................... Equation 5-14 T

Rh is the fractional relative humidity, d is the path length (m), Smm is the saturated vapour pressure of water (mmHg) at atmospheric temperature T (K). This expression assumes that the flame is 1500 K, which was chosen as an average between that of a propane fire and a LNG fire. The transmissivity given by this expression at 15 °C is illustrated by Figure 5.5.1.

Issue 1

May 2007

Page 199 of 493


Figure 5.5.1 - Variation of atmospheric transmissivity with distance at 15 °C The 0.8 transmissivity suggested in Section 5.3.1 corresponds to that at a distance of 25 m at a relative humidity of 60 %. As indicated in Section 5.3.1, the radiation to the surroundings may be represented by a point source model. For a point source model, the radiation received (qd, kWm-2) at a distance d (m) is given by:

qd =

τ F m& H .............................................................................. Equation 5-15 4π d2

Generally, the heat of combustion (H, kJ kg-1) will be known from the literature (e.g. Weast [5.6]) and typical values for the fraction (F) of the heat of combustion radiated for six & ) for main fire scenarios considered are given in Section 5.4.2. The mass burning rates ( m hydrocarbon pool fires are given in Table 5.3. Slightly higher values are given for C3/C4 and condensate pool fires if the pool diameter is greater than 5 m. For jet fires, the mass burning rate is based on the leakage rate and, for QRA, these are generally assumed to be 0.1, 1, 10 or > 30 kg s-1. In the case of fireballs, the mass burning rate is based on the total amount of fuel released divided by a fireball duration calculated using an expression (0.825. mass0.26) based on the mass released. Application of the two techniques is illustrated using data from the BLEVE of a 2 tonne LPG tank (Roberts et al., 2000 [5.7]). The relevant data are summarised in Table 5.6 below.

Issue 1

May 2007

Page 200 of 493

FIRE AND EXPLOSION GUIDANCE Table 5.6 - Example LPG BLEVE fireball data Parameter

Value

Heat of combustion

46000 kJ kg-1

Amount of fuel released

1708 kg

Duration

7s

Mass burning rate

244 kg s-1

Fraction of heat of combustion radiated

0.38

Surface emissive power

312 kW m-2

Fireball diameter

71 m

The full data set indicated that the maximum output from the fireball was at the lift off point. This situation can be modelled by treating the fireball as a disc through the centre of the fireball just touching the surface and the target as a vertical receiver (normally it is necessary to determine both the vertical and the horizontal component of the view factor) on the surface (see Figure 5.2).

Figure 5.2 - View factor for circular disc with receiver off axis but parallel

Issue 1

May 2007

Page 201 of 493

FIRE AND EXPLOSION GUIDANCE The view factor is given by, [5.5]:

⎛ y2 + z 2 − R2 ⎜ VF = 0.5 ⎜ 1 − 2 ⎜ R4 + 2 ( y2 − z 2 ) R2 + ( y2 − z 2 ) ⎝

⎞ ⎟ ⎟ .......................... Equation 5-16 ⎟ ⎠

Hence, if z = R and y = n.R

⎛ n ⎞ VF = 0.5 ⎜1 − ⎟ ................................................................. Equation 5-17 4 + n2 ⎠ ⎝ Table 5.1 provides the data for applying both a solid flame and point source model. Assuming an atmospheric transmissivity of 1, the results from application of each model are plotted in Figure 5.3.

Figure 5.3 - Comparison of solid flame and point source model for a fireball Figure 5.3 suggests that a solid flame model should be used if the object of interest is closer than two flame widths/lengths from the flame as, at these distances, the receiver cannot “see” all of the flame. The above models are only applicable if there is no direct flame impingement. If the flames are impinging on an object then the radiation received may be approximated (ignoring reflection and re-radiation, see Section 5.3.2 for the derivation) by Equation 5-18. Issue 1

May 2007

Page 202 of 493

FIRE AND EXPLOSION GUIDANCE qrad = ε s σ ( ε f Tf4 − Ts4 ) ................................................................ Equation 5-18 where εf, εs are the flame and surface emissivities, σ is the Stefan-Boltzmann constant (5.6697 x 10-8 Wm-2K-4), and Tf, Ts are the flame and object surface temperatures (K). Section 5.4.2 gives typical values for these coefficients for a range of fire types and sizes.

5.5.1.3

Convection

Heat transfer by convection occurs when there are hot gases flowing over the surface of the object. Convective heat transfer will always occur to some extent if there is direct flame impingement and, in these circumstances, at least as much radiative heat transfer will accompany it. Convective heat transfer can occur without significant radiative heat transfer if a plume of hot gases is channelled to an object not in direct (or reflected) line of site with the flames. Heat transfer by convection from impinging flames is represented by Equation 5-19.

qconv = h (T f − Ts ) ......................................................................... Equation 5-19 where Tf and Ts are the flame and object surface temperatures respectively (K) and h is the convective heat transfer coefficient (W m-2 K-1). The convective heat transfer coefficient varies with geometry, boundary layer conditions, gas velocity and temperature. Typical values for the heat transfer coefficient for a range of types and sizes of fire are given in Section 5.4.2. In cases where there is convective heat transfer from a hot plume, the plume temperature can be used in Equation 5-17 instead of the flame temperature if it can be reasonably estimated.

5.5.1.4

Conduction

Heat transfer by conduction is very small compared to the other methods of heat transfer but needs to be taken into account in some circumstances. One-dimensional heat conduction under steady state conditions is represented by Equation 5-20 below.

qcond = k

(Ts − Tl ) L

......................................................................... Equation 5-20

where Ts is the temperature (K) of the surface exposed to flame, Tl is the temperature (K) at a thickness L (m) and k is the thermal conductivity (Wm-1K-1). The thermal conductivity of carbon steel is about 45 Wm-1K-1 and hence, even with a fairly large temperature differential, the heat transmitted is low. Hence, in most circumstances, the heat transmitted by conduction can be ignored. However, there can be problems through differential heating at the joints between thick and thin thick-walled structures. The other conditions where conduction is normally taken into account are where heat is transferred through passive fire protection or through the walls of a vessel or pipe to a fluid inside.

5.5.1.5

Flame position relative to the receiver

Generally, flames are not static. They will move around in the wind and will vary with the fuel release rate, amount of back radiation etc. For a pool fire, the wind may tilt the flame towards, away from or sideways to the receiver. With jet fires, a co-flowing wind will elongate the flames and a variable crosswind will move the flames from side to side. A fireball will present a smaller flame area up and down wind compared to the crosswind area. An understanding of the geometry of the flame is essential in order to apply the heat transfer mechanisms identified in the previous section.

Issue 1

May 2007

Page 203 of 493

FIRE AND EXPLOSION GUIDANCE Modern, validated empirical and phenomenological models are now available for most of the standard situations but the user needs to be aware of the limitations and simplifications made in the model used if the results are to be relied upon. Summaries and comparisons of these models are available in the standard reference books e.g. “Yellow book” (1997) [5.8], SFPE Handbook (2002) [5.9], Lees (2005) [5.10]. Some of these models have been incorporated in commercially available suites of programmes e.g. Shell Global Solution’s FRED and DNV’s PHAST. The following are given as examples:

•

Carsley (1995) [5.11] has developed a model for predicting the probability of impingement of jet fires;

•

Cracknell et al. (1995) [5.12] have developed one for the heat flux on a cylindrical target due to the impingement of a large-scale natural gas jet fire;

•

Chamberlain (1995) [5.13] considered the hazards from confined pool fires in offshore modules.

A feature of most of these models is that the surface emissive power used for a particular situation will depend on how the flame geometry is modelled for that situation. Hence a model using a high surface emissive power and relatively low flame area may/should give the same answer as a model using a relatively low surface emissive power but larger flame area. Combustion models used in computational fluid dynamics (CFD) have advanced, enabling more realistic modelling in situations where the fire scenario can be fully described (this is discussed further in Annex F). However, in preparing a safety case, only general assumptions are normally made and in practice, CFD would only be used to look at a particular case in detail when the extent of the safety issues or costs at risk justify it. In assessing the heat transferred, the key decision is on whether or not the object is impinged by flame. For the general case, it may be sufficient to apply a safety margin, e.g. 50 %, to the flame lengths given by a model or the relevant table in Section 5.4.2. If a key structural item is of particular concern, e.g. a platform support leg, one approach used by industry is to estimate (using a solid flame model) the distance for 50 kW m-2 received radiation and assume that everything within this distance is impinged by flame and that everything outside this distance only receives radiation. In practice, the heat transferred to a receiver will depend on whether it is fully, partially or not enveloped in flame and, in partially or totally enclosed modules, how much re-radiation there is from walls, ceilings and process plant. Even when there is full engulfment, the situation is still complicated as the:

•

Relative proportions of radiative and convective load from a flame will vary depending on the fuel type and location of the object within the flame.

•

Total heat loads will vary depending on the fuel type, the size and shape of the object and the location of the object within the fire:

Particularly with jet fires, the flames can be channelled along and around an object where heat loads will vary over the surface of the object and the heat absorbed by the object will vary with time. Whilst detailed analysis may now be made using CFD and finite element analysis, calculations for an initial analysis can be readily performed if some of the above factors are simplified.

Issue 1

May 2007

Page 204 of 493

FIRE AND EXPLOSION GUIDANCE As indicated in Section 5.3, the main simplifying assumptions are that:

•

There are no heat losses;

•

The flame and receiver surface are considered grey bodies;

•

The ambient temperature can be neglected; and

•

In most circumstances, heat conduction can be ignored.

In these circumstances, the heat transferred to the object surface from an impinging flame may be represented by Equation 5-8.

qtotal = qrad + qconv = ε s σ ( ε f T f4 − Ts4 ) + h (T f − Ts ) ...................... Equation 5-21 If the object is not impinged by flame (e.g. beyond the 50 kWm-2 distance) then, ignoring the hot plume case, the heat transfer is by radiation and the solid flame model (Equation 5-1) should be applied.

qrad = V f E τ ................................................................................ Equation 5-22 If the object is more than two flame widths/lengths away then the point source (Equation 5-3) or a multipoint source model (where the source is split into a number of zones, each representing a fraction of the total radiation emitted and each zone represented by a point source emitting this fraction of the radiation) may be used as an alternative to the solid flame model. It may be used at closer distances but the results will be very conservative. This may be acceptable in some situations.

qrad = 5.5.1.6

τ F m& H ............................................................................ Equation 5-23 4π d2

Temperature rise

All the equations given above provide the heat flux to the surface of the receiver. The key requirement is to determine the temperature rise in the item being considered and the time taken to reach the critical temperature for that particular component. The main situations considered are:

•

Unprotected steel;

•

Fire protected steel;

•

Pressure vessels (unprotected and protected);

•

People.

As the heat absorbed is a time dependent process. Mathematical models, particularly finite difference methods, are available which can undertake these calculations from first principles or with the input parameters εs, εφ,, Tf and h as determined by the particular model used or as provided in the tables in Section 5.4.2. Such models may also simultaneously calculate the heat up of a structure, a vessel or pipe work contents. However, conservative calculations of heat up can be undertaken on the basis that, at any particular time, steady state conditions exist. Issue 1

May 2007

Page 205 of 493


Unprotected steel

The equations given in FABIG Technical Note 1 [5.14] are still valid. However, those equations used a section factor (Hp/A, m-1) defined as the heated perimeter (Hp, m) divided by the steel cross-sectional area (A, m2). ASFP (2002) [5.15] comment that in new European fire testing and design standards (e.g. ENV 13381-4 2002 [5.16], BS EN 1993-1-2 2005 [5.17] and BS EN 1994-1-2 [5.18],) the section factor (the unit remains the same, i.e. m-1) is defined as Asteel/Vsteel (note: the steel subscripts are provided here to avoid confusion with other parameters) where Asteel is the surface area of steel exposed to fire per unit length and Vsteel is the volume of the section per unit length. Using the Asteel and Vsteel notation, for a fully engulfed steel member, e.g. an I - beam, the heat up of the steel member is described by Equation 5-24 below.

ε s σ ( ε f T f4 − Ts4 ) + h (T f − Ts ) =

Vsteel dT Csteel ρ steel .................... Equation 5-24 dt Asteel

Where Csteel is the steel heat capacity (Jkg-1 K-1) and ρsteel is the steel density (kg m-3). A steel section with a large surface area will receive more heat than one with a smaller surface area and the greater the volume the greater the heat sink. Hence the lower the section factor the slower an I - beam will heat up. For an I - beam, the heated perimeter (ASFP still use this in their examples and data sheets) is calculated as:

Figure 5.4 - “I” beam heated perimeter Where B and D are the overall breadth and depth of the section and W is the web thickness. A comprehensive list of heated perimeter equations for different types of beams, columns etc are given by ASFP [5.15].

Issue 1

May 2007

Page 206 of 493

FIRE AND EXPLOSION GUIDANCE For a steel section that is not engulfed in flame, the heat up of the steel member is described by Equation 5-25 below.

qrad = V f E τ =

Vsteel dT ............................................... Equation 5-25 Csteel ρ steel dt Asteel

In this case, the heated perimeter is the projected area of the member that sees the radiation. Equation 5-24 and Equation 5-25 can be solved numerically (e.g. by using a spreadsheet with fixed cell addresses for the constants) by using incremental time steps. An example is given in Section 5.5.1.9 on pressure vessels.

5.5.1.8

Fire protected steel

The Interim Guidance Notes [5.19] advocate a heated perimeter approach when the steel is insulated. The equation assuming that the fire protection material has negligible heat capacity is shown below (Equation 5-26). It is assumed that the insulation surface temperature (Ts) rapidly reaches the flame temperature.

dT =

Asteel K PFP (Ts − T ) dt .................................................... Equation 5-26 Vsteel Csteel ρ steel L

where KPFP is the thermal conductivity of the protection material and L the thickness of the insulation material. It should be noted that the thermal conductivity and heat capacity of both the steel and the insulation material will vary with temperature and, for accurate calculations; these would have to be expressed as parametric equations. The problem is that it is very difficult to obtain a realistic value for both the thermal conductivity and heat capacity as most forms of passive fire protection react in a complex way. Generally, steel may be protected from fire by passive fire protection, which may take the form of a cladding or a coating (cementitious, vermiculite or intumescent). Summaries of their properties are reiterated below and should be read in conjunction with further detail in Section 3.2.8.1, “Firewalls” and 3.2.8.9 “Passive fire protection methods”. 1. Inert cladding e.g. ceramic boards, a thin steel panel backed by mineral wool, a removal jacket or a composite panel. The insulation backed steel panels act as passive insulator until the insulating materials melts leaving voids. Insulation materials such as rock wool contain resins that will melt and migrate. Composite panels may comprise a series of panels of different materials with either air gaps between them or some or all of the gaps filled with insulating material. In most of these cases, the thermal conductivity needs to take account of different materials and of internal voids giving rise to internal convection effects and heat capacity will vary with each material used. 2. Cementitious coatings. These will act as passive insulator with a thermal conductivity dependent on the amount of water present until the temperature reaches about 100 °C. The temperature will be kept at this until all the chemically and physically bound water has been driven off. The temperature will then rise with the material again acting as passive insulator but with a different thermal conductivity. Hence, an overall thermal conductivity value must account for movement and evaporation of water in a situation where the total amount of physically bound water is not likely to be known.

Issue 1

May 2007

Page 207 of 493

FIRE AND EXPLOSION GUIDANCE 3. An intumescent coating. These react to flames by melting and then swelling to form a hard char five to ten times thicker than the unreacted material thickness. The char is gradually eroded away exposing unreacted material, which then reacts to form more char. Hence the unreacted material is gradually being used and, once it has all been used, bare steel will be exposed. In this case, the thermal conductivity needs to take account of the unreacted material and the char and the fact that there are continual boundary and phase changes. Not withstanding all the problems identified, the manufacturers will have data from furnace tests with cellulosic and hydrocarbon heat up curves and will have resistance to jet fire test data. In general, the manufacturers will use the ASFP (2002) [5.15] method to derive the thickness of material required to protect against a particular fire scenario or combination of fire scenarios e.g. jet fire preceding a pool fire. The manufacturers will have performed a series of furnace tests conducted on structural elements with varying section factors, usually between 50 and 350 m-1, to various fire durations and limiting temperatures. The thickness of material (L) required to provide specific standards of fire resistance e.g. at least 1 hour for a mean temperature rise of 140 °C, is derived by means of the empirical relationship:

tresist = a0 + a1 L

Vsteel + a2 L ............................................................ Equation 5-27 Asteel

where tresist is the fire resistance time (minutes). The furnace tests are chosen to cover the range of section factors, thicknesses and duration required. The constants, a0, a1 and a2, applicable to each material are determined by multiple linear regressions. Once a satisfactory correlation has been obtained, the protection thicknesses for a given section factor and required fire resistance time can be derived using the rearranged equation:

L=

tresist − a0 .......................................................................... Equation 5-28 V a1 steel + a2 Asteel

Generally, interpolation of fire test data is allowed but extrapolation is not. ASFP (2002) [5.15] give illustrations of how this works with product data sheets based on cellulosic fire curve furnace tests. A method of combining the results from furnace and jet fire tests is to compare results from tests on substrates with similar section factors (usually about 100 m-1) and use this to derive an “erosion” factor which is added to the value obtained from the expression derived from the furnace tests. This data can also allow approximate thermal conductivities and heat capacities to be determined but they will be product specific and the manufacturers of the products being considered should be consulted.

5.5.1.9

Pressure vessels

There are many different processes occurring when a flame interacts with a pressure vessel due to the complex behaviour of the flame, the vessel and the vessel contents. API has considered the requirements for pressure relief valves (API 520, 1997) [5.21] and emergency depressurisation systems (ISO 23251:2006, 2005) [5.20] and these are considered in Section 7.7 discussing relieving and other process responses. However, API only considers relatively small hydrocarbon pool fires and, if it is a realistic fire scenario, a pressure vessel is much more likely to fail in a jet fire. This was reviewed by Roberts et al. (2000) [5.22] and the Institute of Petroleum (2003) [5.4] have published guidance on the effects of severe fires on pressure vessels and Scandpower (2004) [5.23] have considered this in regard to emergency depressurisation. Issue 1

May 2007

Page 208 of 493

FIRE AND EXPLOSION GUIDANCE The key processes occurring during jet-fire impingement on pressure vessels include:

•

Heat transfer between the fire and outer surface of the vessel, in the vapour and liquid 'zones', by radiation and convection;

•

Heat transfer through the vessel walls by conduction. The wall may comprise of an outer passive fire protection (PFP) coating plus the underlying steel wall;

•

Heat transfer into the vessel fluids by predominantly radiation in the vapour space, and by natural convection or nucleate boiling in the liquid phase;

•

Mass transfer from the bulk liquid or vapour to the outside environment through any holes in the vessel;

•

Mass transfer out of the vessel through any open or partially open pressure safety valves (PSVs);

•

Mass transfer within the liquid phase by flow of heated fluid into a stratified 'hot' layer lying above the bulk liquid. The hot layer may or may not be stable;

•

Mass transfer between the liquid and vapour phases by evaporation;

•

Pressure, enthalpy and composition changes (e.g. relative fractions of mixed hydrocarbons in a separator) in the fluids during each of the above processes;

•

Catastrophic vessel failure resulting in a possible BLEVE.

The heat transfer processes described above are shown schematically in Figure 5.5.

Figure 5.5 - Heat and mass transfer Various models have been proposed that take these factors into account although few have been fully validated. Persaud et al. (2001) [5.24] have applied the Shell HEATUP model to the heat up and failure of LPG tanks. They give equations for all the physics describing heat and mass transfer processes and predict vessel failure by comparing the hoop stress with the ultimate tensile strength of steel. Issue 1

May 2007

Page 209 of 493

FIRE AND EXPLOSION GUIDANCE In practice, when a fire impinges on a vessel containing liquid, the wall in contact with vapour will heat up very quickly and the wall in contact with liquid will stay at a relatively low temperature unless film boiling occurs. In flashing liquid propane jet fire trials on unprotected 2 tonne LPG tanks (Roberts et al., 2000) [5.25] the vapour wall reached up to 870 °C on failure whilst the wall in contact with liquid did not exceed 230 °C.

5.5.1.10

Vessel walls

LPG trials indicate that the prime cause of failure, at least for relatively thin walled vessels, was heating the wall in contact with vapour to a temperature where the steel weakened rather than due to over pressurisation although over pressurisation will be an important factor if a vessel becomes hydraulically full. Gayton and Murphy (1995) [5.26] also suggest that time to metal plate rupture is used in depressurisation system design. On this basis, a conservative estimate can be made of the time to failure by ignoring the heat transfer to the contents. As indicated above, the iterative process for solving the time dependent heat transfer equations is illustrated for the vessel vapour wall case. In a time step Δt, the object will heat up by ΔT given by:

ΔT =

Δt q0

Csteel ρ steel L

.......................................................................... Equation 5-29

where the initial heat absorbed by the wall (ignoring heat losses to the contents) is given by Equation 5-30 below.

q0 = ε sσ ( ε f Tf4 − T04 ) + h (Tf − T0 ) .................................................. Equation 5-30 At time t1 = t0 + Δt, the surface temperature will be T1 = T0 + ΔT, where T0 is the initial surface temperature. Using the new T1 and substituting into Equation 5-30, then the heat absorbed at time t1 is,

q1 = ε sσ ( ε f Tf4 − T14 ) + h (Tf − T1 ) .................................................. Equation 5-31 So, in general, at time ti, the thermal flux absorbed by the object is given by:

qi = ε sσ ( ε f Tf4 − Ti 4 ) + h (Tf − Ti ) ................................................... Equation 5-32 and the temperature of the object will increase to Ti+1 = Ti + ΔTi where

ΔTi =

Δt qi

Csteel ρsteel L

.......................................................................... Equation 5-33

In order to illustrate the conservatism of the data in Section 5.4.2, both trials data and data derived from Table 5.1 are given below in Table 5.7.

Issue 1

May 2007

Page 210 of 493

FIRE AND EXPLOSION GUIDANCE Table 5.7 - Data for calculation of LPG tank failure Flashing liquid fires 1 kg s-1 (From Table 5.1)

Trials data

Total incident flux (kWm-2)

230

170


160

110

Convective flux (kWm )

70

60

Emissivity of flame

f

1.0

0.8

s

0.8

0.8

1300

1320

70

60

5.67 x 10-8

5.67 x 10-8

0.0071

0.0071

7850

7850

520

520

Parameter

-2

Emissivity of steel

Temperature of flame, Tf (K) -2 -1

Heat transfer coefficient, h (Wm K ) Stefan-Boltzman constant, σ (Wm-2K-4) Wall thickness, L (m) Density of steel, ρ (kg m-3) -1

-1

Heat capacity of steel, C (J kg K )

The predicted rise in wall temperature, for an initial temperature of 20 °C, is illustrated in Figure 5.6. The measured times to failure and maximum wall temperatures (all at positions in contact with vapour) for each degree of fill are summarised in Table 5.8, the same failure points also shown in Figure 5.6.

Table 5.8 - LPG tank failure data Degree of fill Time to Maximum wall Pressure at of 2 tonne tank failure temperature at failure failure (%) (s) (Celsius) (barg)

Issue 1

20

250

870

16.5

41

286

704

21.3

60

217

821

18.6

85

254

848

24.4

May 2007

Page 211 of 493

FIRE AND EXPLOSION GUIDANCE Heat up times

1200

Wall temperature (oC)

1000

800

600 Flashing liquid jet fire data

400

Trials data Failure data

200

0 0

60

120

180

240

300

Time (s)

Figure 5.6 - Comparison of heat up time with LPG failure times and temperatures A comparison can also be made with data for an unwetted 25.4 mm plate, which .gives 12 minutes to reach 593 °C. Use of the small hydrocarbon pool fire data in Table 5.3, gives about 11 minutes as the time; (the data quoted above are based on calculations from a gasoline trial with a 0.125” plate).

5.5.1.11

Vessel contents

More discussion of the response of process systems including pressure vessels is considered further in Section 7.7. As indicated above, the actual heat transfer processes are very complex. Traditionally, the API approach has been used to calculate the heat transfer to a vessel contents. For vessels containing only gas, vapour or super-critical fluid the vessel wall is considered to be unwetted and the heat transfer to the contents is not directly calculated. For vessels containing liquid, the approach is based on the heat transfer to the wetted surface of vessels up to a height of 7.6 m; as only relatively small hydrocarbon pool fires are considered. Two expressions are given; one (Equation 5-34) where adequate drainage and fire fighting equipment exists and one (Equation 5-35) where it does not.

Qabsorb = 43200 F A0.82 .................................................................. Equation 5-34 Qabsorb = 70900 F A0.82 .................................................................. Equation 5-35 where Qabsorb is the total heat absorbed (W), F is an environment factor and A is the total wetted surface area (m2). The expression A0.82 is an area exposure factor which recognises that large vessels are less likely than small ones to be completely exposed to the flame of an open fire. In the likely confinement offshore, it would be more appropriate to use A rather than A0.82. The environment factors are given in Table 5.9.

Issue 1

May 2007

Page 212 of 493

FIRE AND EXPLOSION GUIDANCE Table 5.9 - ISO 23251:2006 environment factors Type of equipment

Environment factor (F)

Bare vessel

1.000

Water deluge protected vessel

1.000

Depressurising and emptying facilities

1.000

-2

Insulated (conductance 22.71 kWm K-1) vessel

0.300

Insulated (conductance 11.36 kWm-2 K-1) vessel

0.150


0.075


0.050

-2

Insulated (conductance 2.84 kWm K-1) vessel

0.038


0.030


0.026

Note that credit is only given for insulated vessels. API now makes it clear that the insulation must be passive fire protection but the requirement is that the insulation material should function effectively up to 904 °C. As is recognised by API, their approach is not suitable if the fire scenario identified is more severe than a 110 kW m-2, that is, it is not suitable for a jet fire or a confined hydrocarbon pool fire. Hekkelstrand and Skulstad (2004) [5.27] consider slightly higher heat fluxes than API. They consider small to medium size fires on the basis that the aim is to prevent escalation to a large fire. Two figures are given for the incident heat fluxes from fuel-controlled fires. The local peak heat load is used to calculate the rise in steel temperature and global average heat load is used to calculate the pressure profile. Their incident heat fluxes for jet and pool fires are summarised in Table 5.10.

Table 5.10 - Global and local peak loads Jet fire Heat load

Pool fire

Leak rate > 2 kgs-1

Leak rate* > 0.1 kgs-1

Local peak (kWm-2)

350

250

150

Global average (kWm-2)

100

0

100

* This calculation is for an object close to the fire.

Various rules are given for the application of these values and the original publication [5.27] should be consulted before using the values given. Issue 1

May 2007

Page 213 of 493


Effect of fire protection on heat transfer to vessels

Directed water deluge No credit is given for directed deluge systems in ISO 23251:2006 [5.20] as the reliability of water application is uncertain because of freezing weather, high winds, clogged systems, unreliable water supply and vessel surface conditions that can prevent uniform water coverage. However, it is suggested that systems designed to NFPA 15 [5.28] can be effective. NFPA specifies an application rate of 12 l m-2min-1. This is derived from small-scale pool fire trials where the application rate is taken as the amount of water leaving the nozzles divided by the vessel surface area. The NFPA requirements for nozzle spacing and spray angle are very general. In practice, it is the amount of water flowing over the surface of the vessel, which has the greatest influence on fire resistance. As only between 35 % and 45 % of the water leaving the nozzles actually forms a film on the vessel surface, a poorly designed system delivering the minimum requirement of 12 l m-2min-1 may not even fully protect against a pool fire. Although the application requirement of 10 l m-2min-1 in the FOC tentative rules (1979) [5.29] is lower than the NFPA requirement, systems designed to the latter standard will, in general, apply more water to the surface of the vessel as there is a more detailed specification of the nozzle spacing (longitudinal and stand-off from the surface), numbers of rows of nozzles and spray angle relative to the size of vessel. There has been considerable interest in the use of directed deluge in protecting against jet fires. Shirvill and White (1992) [5.30] have shown that deluge systems with the usual medium velocity nozzles are not effective in protecting against natural gas jet fires. Lev (1995) [5.31] has suggested that it may be possible with systems using high velocity nozzles and Shirvill and White suggest it may be possible with high velocity water monitors. Shirvill (2004) [5.32] has shown that a system delivering about 17 l m-2min-1 is not effective in fully protecting vessels (keeping the wall temperature to 100 ºC or less) against 2 to 10 kg s-1 flashing liquid propane and butane jet fires. Roberts et al. have shown that about 30 l m-2min-1 will protect 2 tonne vessels against 2 kg s-1 flashing liquid propane jet fires. Hankinson and Lowesmith (2003) [5.33] have looked at the effectiveness of area and directed deluge in protecting against “live” jet fires and all these recent results are summarised in a special edition of the Journal of Loss Prevention in the Process industries (March, 2003) [5.34]. Even though a directed deluge system may not be fully effective (primarily in protecting the unwetted wall) in protecting against flashing liquid propane and butane jet fires, Shirvill [5.32] suggested that the overall rate of heat transfer is reduced by 50 %. This is consistent with results (Roberts, 2003) [5.35, 5.36 and 5.37] from 20 % filled LPG tanks. Passive fire protection Roberts and Moodie (1989) [5.38] have shown that a range of fire protection materials are suitable for protecting LPG tanks against hydrocarbon pool fires. As indicated previously, API [5.21] takes reduced heat input into account by the use of environment factors. These environment factors are calculated using Equation 5-36.

F=

kPFP ( 904 − Trelief ) .................................................................. Equation 5-36 66570 L

where kPFP is the thermal conductivity (Wm-1K-1) of the PFP, Trelief the temperature (°C) of the vessel contents at relieving conditions and L is the thickness (m) of the insulation. API provides thermal conductivities for a range of materials but these may only be strictly applicable to hydrocarbon pool fires.

Issue 1

May 2007

Page 214 of 493

FIRE AND EXPLOSION GUIDANCE In general, PFP materials that have successfully passed a test illustrating resistance to jet fire by meeting the required time to critical temperature (Jet Fire Working Group, 1995) [5.39] will be suitable for protecting pressure vessels against jet fires. At present, there appear to be no standardised criteria for the protection of pressure vessels. LPGA [5.40] suggest that 90 minutes to reach 300 °C (the temperature at which carbon steel starts to lose its strength) is suitable for LPG vessels. Higher temperature criteria may be suitable for thicker walled (> 12 mm) vessels and for vessels made from steel alloys, which maintain their strength to higher temperatures.

5.5.1.13

People

The response of people to fires is considered in Section 7.8. Hymes et al. (1996) [5.41] have considered the physiological and pathological effects of thermal radiation and relate these to a thermal dose (note: dosage is usually taken as irradiation x time). The thermal dose TL (s (W m-2)4/310-4) is given by: 4

TL = t ( qrad ) 3 10−4 ........................................................................ Equation 5-37 where t is the exposure time (s), qrad the radiation (Wm-2) received and 10-4 a convenient scaling factor. The radiation received should be calculated from either the solid flame model, if close to the fire, or the point source model if more than two flame widths/lengths away from the source. From a major hazard perspective, there are two issues: 1. How long can a worker continue to operate in an emergency system whilst exposed to a given level of radiation? 2. What fraction of the population will die or sustain injury given exposure to a certain dose of radiation? In regard to the former, API [5.21] provides permissible design thermal radiation levels for personnel. These are given in Table 5.11 below (Note: ISO 23251:2006 [5.20] should be consulted to consider these in the context - disposal by flaring - in which they are given).

Issue 1

May 2007

Page 215 of 493

FIRE AND EXPLOSION GUIDANCE Table 5.11 - ISO 23251:2006 permissible radiation design levels Permissible design level (kWm-2)

Conditions

9.46

Maximum radiant heat intensity at any location where urgent emergency action by personnel is required. When personnel enter or work in an area with the potential for radiant heat intensity greater than 6.31 kW m-2, then radiation shielding and/or special protective apparel (e.g. a fire approach suit) should be considered a

6.31

Maximum radiant heat intensity in areas where emergency actions lasting up to 30 s may be required by personnel without shielding but with appropriate clothing b

4.73

Maximum radiant heat intensity in areas where emergency actions lasting 2 to 3 minutes may be required by personnel without shielding but with appropriate clothing b

1.58

Maximum radiant heat intensity at any location where personnel with appropriate clothing b may be continuously exposed.

Superscript notes: •

It is important to recognise that personnel with appropriate clothing b cannot tolerate thermal radiation at 6.31 kW m-2 for more than a few seconds.

•

Appropriate clothing consists of hard hat, long-sleeved shirts with cuffs buttoned, work gloves, long-legged pants and work shoes. Appropriate clothing minimises direct skin exposure to thermal radiation.

The lethality to the population is usually addressed by probit or logit analysis. The two commonly used probit relations for fatality are:

Eisenberg (based on nuclear bomb data) ........... Y = −14.9 + 2.56 ln ( X ) Equation 5-38 43 Where X = t qrad

Lees (valid up to 70% mortality) ......................... Y = −10.7 + 1.99 ln ( Z X ) Equation 5-39 where ZX is a function of X depending on whether clothing ignites. Hymes et al. [5.41] gives doses for probability of 1 % and 50 % lethality as 1050 s(W m-2)4/3104 and 2300 s (W m-2)4/310-4 respectively. These correspond to a radiation dose of 8.6 kW m-2 for 1 minute or 2.6 kW m-2 for 5 minutes for 1 % lethality and 15.4 kW m-2 for 5 minutes for 50 % lethality. More details on using these and other methods are given by Lees et al. (1996) [5.42]. The response of personnel is considered further in Section 7.8.

Issue 1

May 2007

Page 216 of 493


6 Derivation of explosion loads 6.1

Introduction to explosion load determination

6.1.1

General

This Chapter is based on the basis documents developed during the generation of this Guidance [6.1, 6.2, 6.3] and describes the process of derivation of explosion loads. These basis documents contain more detailed information. Gas explosions can be defined as the combustion of a premixed gas cloud containing fuel and an oxidiser that can result in a rapid rise in pressure. Gas explosions can occur in enclosed volumes such as industrial process equipment or pipes and in more open areas such as ventilated offshore modules or onshore process areas [6.4]. For an explosion to occur a gas cloud with a concentration between the Upper Flammability Limit (UFL) and Lower Flammability Limit (LFL) must be ignited. The overpressure caused by the explosion will depend, amongst other things, on:

•

The gas or gas mixture present

•

The cloud volume and concentration

•

Ignition source type and location

•

The confinement or venting surrounding the gas cloud

•

The congestion or obstacles within the cloud (size, shape, number, location)

For stoichiometric hydrocarbon gas clouds, filling a closed volume initially at atmospheric pressure, combustion without heat loss will result in overpressures of close to 8 barg. This pressure rise is mainly due to the temperature rise caused by the combustion process and is generally not dependent on the congestion within the volume. This type of explosion is referred to as confined. A stoichiometric air/fuel mixture is such that it contains exactly the required amount of oxygen to completely consume the fuel. Gas explosions in more open environments can also lead to significant overpressures depending on the rate of combustion and the mode of flame propagation in the cloud. All of the above points can affect the explosion overpressures in this type of environment. If the rate of volume generation within the explosive region is greater than the ability of the vents to release this volume then the overpressure will continue to rise. Two types of explosion can be identified depending on the flame propagation rate: 1. A deflagration is propagated by the conduction and diffusion of heat. It develops by feedback with the expansion flow. The disturbance is subsonic relative to the un-burnt gas immediately ahead of the wave. Typical flame speeds range from 1-1000 ms-1 and overpressures may reach values of several bars. The overpressures are not limited to the 8 barg maximum typical of completely confined explosions.

Issue 1

May 2007

Page 217 of 493

FIRE AND EXPLOSION GUIDANCE 2. A detonation is propagated by a shock that compresses the flammable mixture to a state where it is beyond its auto-ignition temperature. The combustion wave travels at supersonic velocity relative to the un-burnt gas immediately ahead of the flame. The shock wave and combustion wave are coupled and in a gas-air cloud the detonation wave will typically propagate at 1500-2000 ms-1 and result in overpressures of 15-20 barg. Most vapour cloud explosions offshore would fall into the category of deflagrations. In an environment typical of gas explosions on offshore platforms the gas cloud engulfs many obstacles including equipment, piping, structure etc, often referred to as congestion. It is also usually confined by a number of solid planes such as plated decks, blast walls, equipment rooms etc. The explosion typically starts as a slow laminar flame ignited by a weak ignition source such as a spark. As the gas mixture burns, hot combustion products are created that expand to approximately the surrounding pressure. As the surrounding mixture flows past the obstacles within the gas cloud turbulence is created. This turbulence increases the flame surface area and the combustion rate. This further increases the velocity and turbulence in the flow field ahead of the flame potentially leading to a strong positive feedback mechanism for flame acceleration and high explosion overpressures. The behaviour of the explosion will be influenced by both the degree of confinement and the congestion within the combustion region.

6.1.2

Dynamic pressures and overpressures

Gas explosions can generate both high overpressure and high-speed gas flows as a result of the gas combustion process. Large components of the structure such as solid decks or walls experience loads due to the pressure differences on opposite sides of the structure. Typically within an explosion there will be a strong variation of the spatial and temporal pressure distribution. There will typically be localised high regions of overpressure with lower values of average pressure acting on large components. The overpressure at a location within a gas explosion will typically rise to a peak value and then fall to a sub atmospheric value before returning to zero overpressure. The duration of the positive phase in an explosion can vary greatly with shorter durations associated with higher overpressure explosions. Typical durations range from 50 to 200 ms. For smaller objects such as piping the overpressures applied to the front and reverse side of such items will be of approximately the same magnitude at any moment in time and in this case the overpressure will not apply any net load to the object. For this type of object the dynamic pressure associated with the gas flow in the explosion will dominate the applied loads. Methods for calculating loads acting on intermediate sized objects such as large vessels are described in Section 6.11.3.

6.1.3

External explosions

Secondary or external explosions may result as vented unburnt fuel/air mixture comes into contact with the external (oxygen rich) atmosphere. As the flame front progresses outside the compartment, an external explosion may occur, which may distort the pressure time history and result in double peaked pressure traces inside and outside the compartment. This may have consequences for the escape ways and may give rise to a blast wave which may impinge on neighbouring structures, and in particularly the TR. Further descriptions of the external explosion phenomenon are available [6.5]. Issue 1

May 2007

Page 218 of 493


Far field effects

Following a gas explosion that generates significant overpressures, a pressure pulse will propagate into the surrounding atmosphere. The convection in the flow will tend to make pressure disturbances at the back of the pulse catch up with those at the leading edge of the pulse. This has the effect of decreasing the duration of the positive part of the pulse and causes a faster rate of increase of the leading pressure wave. A blast wave with near zero rise time will then develop. Often this wave has zero net impulse as it travels away from the explosion. Simple methods exist for calculating the form of this blast wave and its effects on targets in its path [6.6, 6.7]. Some are taken from military and nuclear codes. The peak overpressure in this blast wave will then decrease with distance while the blast wave duration will typically increase and as a result the impulse will decrease more slowly than the overpressure. The blast wave will be affected by other confining objects such as decks, blast walls and accommodation blocks that will result in reflection and diffraction of the blast wave. This may affect the decay of the blast wave and in some cases can increase local overpressures where a blast wave is reflected from a surface or object. The received pressure on a flat surface may be greater than that in the incident blast wave. At pressure levels typical of a blast wave generated by a hydrocarbon explosion, this received pressure may be up to twice the incident pressure, a process which is referred to as ‘pressure doubling’.

6.2

Tasks for the determination of explosion loads

As described in Sections 2.8.4, 2.8.5 2.8.6 there are suggested approaches by level of sophistication. The category of the installation does not preclude the use of more sophisticated methods of assessment which may result in reduced conservatism and potentially reduced cost. The treatment in this section concentrates on higher risk methodology techniques with simplifications for the low risk methodology suggested for each of the tasks described. An explosion assessment is performed in the following steps, for the earlier steps, the reader will note the similarity for preparing for a fire risk assessment. 1. A hole of a given size is assumed to be present in a vessel, piping or riser, leading to a gas or spray release. Immediate ignition is assumed not to occur [6.8]. 2. The time history of the release rate is calculated. The probability of the occurrence of the release may be estimated from published failure statistics or even from simulation. 3. A dispersion analysis will predict how the gas or vapour cloud develops and disperses under wind and ventilation conditions. Part of this cloud will be within the explosive concentration limits of the gas/air mixture. 4. An ignition source within the explosive part of the gas cloud is then assumed to ignite the local fuel/air mix causing expansion resulting from combustion in the region surrounding the ignition point [6.8]. 5. Explosion loading software is then used to calculate how the flame front accelerates through the surrounding environment. Interaction with obstacles gives rise to increased turbulence, flame folding, increased flame area, increasing overpressures and increasing gas velocities within and outside the gas cloud. 6. Overpressures may then be calculated for any barriers in the vicinity. Issue 1

May 2007

Page 219 of 493

FIRE AND EXPLOSION GUIDANCE 7. Fuel/air particle velocities are also calculated to determine dynamic pressures or drag loads on any structural members, piping or vessels in the vicinity. 8. Small objects may be picked up during the explosion, creating secondary projectiles. The peak energy for typical projectiles may be calculated from the dynamic pressure load time history and their mass. 9. Secondary, ‘external’ explosions may result as the unburnt fuel/air mixture comes into contact with the external (oxygen rich) atmosphere. 10. The explosion loads on piping and equipment may result in further releases with consequent fires or explosions. 11. A blast wave will propagate away from the explosion region and impinge on adjacent structures. This section deals with tasks 3 to 11, effectively the ‘Consequence Analysis’. It is unlikely that the SCEs will withstand a worst case explosion scenario defined as that scenario which considers a maximum stoichiometric cloud filling the compartment or engulfing the installation ignited at the worst position. Design explosion loads with a known probability must then be derived, which the structure and other SCE’s must resist. A method is discussed which uses exceedance curves for representative peak overpressures for the compartment/installation. This is discussed in Section 6.10 on the generation of exceedance curves and Section 8.5.2 on the classification of SCE’s for explosion response assessment. In order to provide some measure of asset protection as well as protecting life and the environment two levels of explosion should be considered, the strength level blast (SLB) and the ductility level blast (DLB).

6.3

Determination of explosion frequency

The main reason for using a probabilistic assessment method is to derive relationships for the probability of exceedance of a given explosion parameter such as overpressure or dynamic pressure at a specified location or in a specified region. This enables the range of scenarios to be compared with their probability of occurrence leading to the definition of design explosion loads which can and must be designed against. Some possible methods of deriving exceedance curves are described in Section 6.10 and the Century Dynamics basis document [6.1]. The first step in the compilation of a frequency versus overpressure curve is the determination of overall explosion frequency. This can be achieved by standard means used in Fire Risk Analysis (FRA) using the following steps: 1. Select representative leak sizes 2. Determine leak frequencies from equipment item counts and generic release frequency data per item 3. Calculate representative release rates based on release size, composition and pressure 4. Calculate ignition frequency, dependent on release rate or the rate of generation of new flammable volume 5. Determine proportion of ignitions for which explosions occur (delayed ignitions). Issue 1

May 2007

Page 220 of 493

FIRE AND EXPLOSION GUIDANCE The above steps are familiar to most safety practitioners and who will use generic data collected from past hazard events in the UK petrochemical industry [6.9, 6.10,6.11, 6.12, 6.13, 6.14]. There is no specific guidance on the above process; companies undertaking QRA tend to have their own individual procedures. The following table however gives an indication of where the data can be located.

Table 6.1 - Release and ignition data sources Item Release Sizes

Possible data source Selected to a give spread of potential consequences (from low release rate long duration to high release rate short duration). A typical spread might be: •

3 mm representing small releases (0-6.5 mm)

•

10 mm representing medium releases (6.5-20 mm)

•

30 mm representing large releases (20-60 mm)

•

100 mm representing catastrophic releases (>60 mm)

•

(Optional) Full bore if significantly different consequence from 100 mm

Leak frequency data

Accident statistics for fixed offshore units on the UK continental shelf [6.13], the WOAD database [6.10], OREDA [6.12] and the UKOOA release statistics review [6.14].

Leak Rate

Calculated from release size, inventory pressure and gas properties [6.15].

Ignition frequency

Accident statistics for fixed offshore units on the UK continental shelf [6.13] or Classification of Hazardous Locations [6.16].

Proportion of ignitions giving explosion

Classification of Hazardous Locations [6.16]].

The weak points in the estimation are the variability of gas cloud size with ventilation and environmental conditions and the choice of ignition time and location. A Monte Carlo approach may be used to explicitly represent the variability of these and other parameters. Usually a phenomenological method of calculation of overpressures is used in view of the large number of simulations necessary. The increased accuracy in the representation of frequency and consequence variability will offset the reduced accuracy in load determination in the determination of explosion risk.

6.4

Dispersion

6.4.1

General

Once the release rate and frequency has been determined then the dispersion characteristics of the gas cloud, vapour cloud or liquid spray release must be calculated. This may include a time history of the cloud’s extent and the identification of the likely ignition sources in the flammable range.

Issue 1

May 2007

Page 221 of 493

FIRE AND EXPLOSION GUIDANCE Three main methods are discussed in this document for the determination of the extent of the gas cloud after a release. They are the direct CFD method whereby the cloud evolution is tracked through time, the workbook approach developed in the JIP on ‘Gas build up from high pressure natural gas releases in naturally ventilated offshore modules’ [6.18], and the simplified method is given in the ‘Explosion Handbook’, [6.19]. Other approaches include the zonal and Shell DICE methods. The direct CFD method has the advantage that ignition sources and their position in the gas cloud may be modeled with the effect of wind speed and direction being represented. The software used for the dispersion simulations may be the same as that used for the explosion simulation itself. The disadvantage is that at present these simulations do take some time to perform in view of the long time scale of the dispersion process as compared with the explosion simulation. This approach is discussed further in the section on the NORSOK procedure Section 6.13.

6.4.2

Workbook approach for calculation of gas cloud size

Cleaver [6.20] describes an investigation of gas build up in naturally ventilated offshore modules following high-pressure releases. This work was based on an experimental program of 66 experiments in the full size Spadeadam test rig. The objective of these experiments was to investigate the effects on the dispersion process of release location, orientation, pressure and diameter as well as module perimeter confinement and the wind driven ventilation rate. The majority of the releases were at a constant rate of between 0.5 to 10 kg s-1 but the effects of declining release rates were also considered. Gas concentration during the gas release event was recorded at up to 200 locations within the rig. A correlation for the flammable volume of gas within the rig (between 5 and 15 % concentration) was derived based on simple experiments and dimensional considerations. A plot of an upper bound estimate of the fraction of the module filled with flammable gas against the non-dimensional parameter R is given below:

Issue 1

May 2007

Page 222 of 493


Figure 6.1 - Non-dimensional flammable volume vs. release parameter [6.18] The Release parameter R is defined as: R= (dm/dt) / ( ρ s U V L2 ) Where: dm/dt = mass flow rate of gas released into module (kg s-1)

ρs

= The density of the released gas

Uv

= The average ventilation velocity in the module before the gas is released (m s-1)

•

L = cube root of the module volume

It was generally found that greater confinement gave lower ventilation rates and larger flammable cloud volumes, however, it should be noted that the larger rate releases themselves changed the ventilation flow within the test rig. In reference [6.18] this approach is extended to a ‘workbook’ form. This requires the separate determination of the ventilation flow rate through a confined and congested region and the determination of the flammable gas cloud volume. Two estimates of the flammable volume are made:

•

A upper but realistic estimate of the flammable volume that a given release would produce for use at the ‘screening’ stage

•

A mid-range estimate of a typical flammable volume that a release will produce to give a ‘best estimate’ of the likely outcome.

The flow through the module is characterised by a representative ventilation velocity that is assumed to be related to the external wind velocity. Four generic module layouts are referred Issue 1

May 2007

Page 223 of 493

FIRE AND EXPLOSION GUIDANCE to specific details are not described. The normalised volume of the flammable gas cloud is also defined by a non-dimensional relationship. Finally, a relationship for flammable gas volume between two given concentrations is given. It is stated that the workbook could be combined with accidental release rate/frequency data held by regulatory authorities.

6.4.3

Explosion Handbook approach

A further simple method of calculating gas accumulation in a module is described in the ‘Explosion Handbook’ by Czujko [6.19]:

Mg =

LVent RLeak 3600 LModule RVentilation = Mass of gas in the process area (kg)

Where: Mg LVent

= Distance to module vent of end of congested area (m)

LModule

= Length of module (m)

RLeak

= Gas leak rate (kg s-1)

RVentilation = Ventilation rate in air changes per hour

It is stated that this simple model will often give a good estimate of the amount of gas within the module, provided that the ventilation flow field is close to uniform. For more complex flow fields the model uncertainty increases.

6.4.4

Equivalent Stoichiometric Clouds

At the current time it is not recommended to directly use dispersed non-homogenous and turbulent gas clouds in CFD or phenomenological explosion simulations due to a lack of testing/validation and therefore there is a lack of confidence in the codes for this application [6.19]. Instead an equivalent quiescent stoichiometric gas cloud intended to give overpressures similar to the non-homogenous and strongly turbulent clouds ignited in some full scale tests should be used. Three methods for the conversion of dispersed clouds into equivalent stoichiometric clouds are summarised in this section. Hansen [6.21] describes a parameter called ‘Q5’ that is calculated during FLACS dispersion simulations. To calculate the Q5 parameter the mass of gas at non-stoichiometric concentrations is multiplied by the burning velocity and the volume expansion ratio at the concentration, both normalised to that for a stoichiometric mixture. This process calculates the total mass of gas in the equivalent stoichiometric gas cloud. The filters used in this process are shown in Figure 4, on page 10 of this reference [6.21]. It is also stated that for very confined modules the burning rate filter becomes less important and in the case of a fully closed vessel, only the volume expansion filter should be used. Pappas [6.22] describes how the complex shape of a dispersed cloud can be represented using a cubic cloud typically extending from floor to ceiling in the module of interest. It is stated [6.18] that this method will generally give pressures of similar strength for the equivalent quiescent clouds as for the non-homogenous and strongly turbulent clouds ignited in full-scale tests. It is also stated that the explosion overpressure durations may be shorter than for the non-stoichiometric clouds that may in turn affect the structural response.

Issue 1

May 2007

Page 224 of 493

FIRE AND EXPLOSION GUIDANCE In the full-scale dispersion and explosion tests conducted in Phase 3b [6.23] Advantica proposed an alternative method for calculating a stoichiometric gas cloud volume equivalent to the dispersed cloud in an experiment. This was used to generate an equivalent volume based on the dispersed clouds with results from partial stoichiometric fills of the test rig. For non-stoichiometric concentrations a weighting proportional to the square of the product of the laminar burning velocity times the expansion ratio, both normalised to a stoichiometric concentration was used. This method was proposed for data evaluation purposes. It has not been validated as a methodology for general use. A curve relating the likely overpressure to the fraction of the module filled with a gas cloud normalised to the fully filled case was derived. For fill fractions above 80 % the explosion overpressures are predicted to be as high as those with a stoichiometric cloud completely filling the test rig. The experimental data and a possible curve fit to it are shown in Figure 6.2. It is suggested [6.19] that a simple straight line could be added to this figure to form an upper bound for the likely overpressures at small fractional equivalent stoichiometric fill volumes.

Figure 6.2 - Normalised overpressure vs. equivalent stoichiometric fill fraction Data are shown for each large-scale realistic release experiment. The data and correlation for the idealised partial fill experiments are also shown [6.24]. The process of the representation of a dispersed gas cloud of varying concentration as an equivalent stoichiometric cloud is considered by Advantica to introduce uncertainties in the chain of calculations leading to the calculation of the explosion loads. This has a bearing on the accuracy of the overall process and whether high levels of detail in other parts of the chain are needed or can be justified. It is hoped that this process can be improved or that the CFD/phenomenological codes may be validated against experiment for the case of varying density within the gas cloud.

6.5

Ignition

6.5.1

General

The probability of the occurrence of a detectable overpressure being developed ‘Prexpl‘ is the product of the probability of the release ‘Prrel‘ and the probability of delayed ignition ‘Prign‘.

Issue 1

May 2007

Page 225 of 493

FIRE AND EXPLOSION GUIDANCE The estimation of probability of ignition and the time to ignition are key aspects of the risk assessments presented in the Safety Case. There has been limited information available but at the time of compiling the Guidance, recent published information has been made available [6.25].

6.5.2

Estimation of delayed ignition probability Prign

Delayed ignition of a gas cloud implies that the resultant combustion would produce overpressure effects and can be characterised as an explosion. An overpressure will result from the ignition of an accumulation of mixed air and fuel. This may occur during ignition of a jet fire and may then escalate to a fire ball. A significant overpressure is defined in this Guidance as above 50 mbar and may serve to provide a workable definition of an explosion. 50 mbar is the commonly accepted lower limit for the opening of pressure relief panels. The IP review [6.25] of the estimation of ignition probability and noted that adopting generic correlations for the probability of ignition based on the mass release rate was overly simplistic and potentially overly conservative. The correlations have been developed to support the use of ignition probability calculations in QRAs. A model workbook and look-up correlations have been provided. The report reviews a range of sources of ignition probability data and benchmarks against collected incident and reported data. The review looks at linkages with dispersion and fractional module fill as well as reporting on the effect of ignition source density. A comparison table [6.25] is reproduced below, see Table 6.2, to illustrate the comprehensiveness of the review undertaken and upon which the model is based.

Issue 1

May 2007

Page 226 of 493

FIRE AND EXPLOSION GUIDANCE Table 6.2 – Comparison of ignition probabilities by model for selected scenarios

Area (m2 of cloud to LFL)

DNV TDIM [6.26] Ignition intensity (per m2)

Pign by DNV TDIM method [6.26] (Area basis)

Pign by WS Atkins method [6.27] (Area basis)

Pign by DNV TDIM method [6.26] (Volume basis)

Pign by Cox, Lees and Ang [6.28] (Flow basis)

Hot work – 50 hr/yr

120

2.85x10-5

3.42x10-3

1.7x10-3

5.71x10-3

--

Light equipment in process area – 60 % of full module, very short contact time for gas to reach LFL

120

2.70x10-5

3.42x10-3

5.8x10-2

3.24x10-3

2.44x10-2

Light equipment in process area – 1 kgs-1 medium leak, so medium contact time

3.6

2.70x10-5

9.72x10-5

1.8x10-3

1.05x10-5

1.56x10-2

Light equipment in process area – 0.1 kgs-1 small leak, so long contact time

0.04

2.70x10-5

1.08x10-5

2.1x10-4

3.33x10-7

3.56x10-3

Heavy equipment in process area – 60 % of full module, short contact time for gas to reach LFL

120

8.51x10-5

1.02x10-2

2.6x10-1

1.02x10-2

2.44x10-2

Heavy equipment in process area – 1 kgs-1 medium leak, so medium contact time

3.6

8.51x10-5

3.06x10-4

9.0x10-3

3.32x10-5

1.56x10-2

Heavy equipment in process area – 0.1 kgs-1 small leak, so long contact time

0.04

8.51x10-5

3.40x10-5

1.1x10-5

1.05x10-6

3.56x10-3

Scenario Basis 20x10x6 m module

Note: 60 % of full module cases, [6.25], probability based on a mass release rate of 2 kgs-1, the flow indicated by the JIP Gas Build-up Workbook as at transition point at which an open ended module would become “saturated” with gas. Other volumes are based on simple momentum jet representation. The probability review Table 6.3, presents compressed data into a coarser ranking, this summary is shown below.

Issue 1

May 2007

Page 227 of 493

FIRE AND EXPLOSION GUIDANCE Table 6.3 - Generic ignition probabilities Release rate (kgs-1)

Cox et al, gas leak

Cox et al, oil leak

Revised oil & gas

Minor

<1

0.01

0.01

0.01

Major

1-50

0.07

0.03

0.03

Massive

>50

0.3

0.08

0.10

Release rate category

In addition, an overview of timing is presented [6.25].

Table 6.4 - Ignition timings review Relative probability of ignition within time t, (s) Plant type 1

10

30

100

1000

>1000

Plant

0.22

0.29

0.36

0.63

0.94

1.0

Transport

0.53

0.53

0.53

0.60

0.86

1.0

Pipelines

0.24

0.30

0.31

0.39

0.61

1.0

CMPT blowouts

0.10

0.40

0.67

1.0

OIR12 offshore

0.94

0.98

1.0

During the Phase 3b tests [6.24] it was observed that for realistic releases giving a nonuniform cloud density, the ignition of the cloud did not occur every time the ignition source was activated. This was due to the fact that the source may be located in a non-flammable region of the cloud or that the initial combustion ceased as the small initial flame front progressed to non-flammable regions before it could develop. Further information may be found in the E&P Forum hydrocarbon leak and ignition database [6.29]. If a full dispersion analysis is performed then intermittent and continuous time dependent ignition may be considered. Assuming a largely uniform distribution in space of ignition sources will result in a time dependent probability of ignition proportion to the rate of generation of flammable cloud volume.

Issue 1

May 2007

Page 228 of 493


Explosion overpressure determination

6.6.1

Explosion prediction methods and tools

The commonly used methods for predicting gas explosion loads have been reviewed [6.4]: Empirical models based on correlations with experimental data and usually used to predict far field blast effects outside the gas cloud combustion region. The limits of applicability and accuracy of these methods are generally determined by the extent of the experimental data that they are based on. They can be simple and quick to use so they can be a practical design aid but in general the least accurate and cannot address general scenarios, as they should strictly be used within the range of data on which they are based. Examples of empirical models include Baker-Strehlow, Congestion Assessment Method and Multi-energy method and-equivalency [6.1]. Phenomenological methods are simplified physical models that attempt to model the essential physics of explosions. Generally they represent the actual scenario geometry using a simplified system, for example a small number of interconnected chambers with turbulence generating source terms between them, to represent the fully 3 dimensional nature of the real geometry. This can be a reasonable representation of some geometries such as an offshore module but may not be adequate for more complex situations. Phenomenological models typically generate a peak overpressure or a single pressure-time history taken as representative throughout the area under consideration. Some codes can also predict the blast wave that will propagate away from the gas combustion region into the far field. Short run times make this type of model suitable for running large numbers of explosion scenarios. Examples of phenomenological models include CLICHE/CHAOS, SCOPE (note CLICHÉ and CHAOS are now included in the Advantica ARAMAS package). A Monte Carlo approach may be used to explicitly represent the variability of these and other parameters. Usually a phenomenological method of calculation of overpressures is used in view of the large number of simulations necessary. The increased accuracy in the representation of frequency and consequence variability will offset the reduced accuracy in load determination as compared with CFD simulations in the determination of explosion risk. Computational Fluid Dynamics (CFD) are in principal the most fundamentally based of the methods discussed here and have the best potential for accurate prediction of gas explosion behaviour over a wide range of geometries and explosion scenarios and in both the near and far field. These tools solve the conservation equations of mass, momentum and energy including turbulence and combustion in a large number of relatively small control volumes covering the region of interest. These tools can provide a wide range of information about the flow field and the explosion behaviour at the expense of significant effort required to set up a suitable geometry model and significant computational power requirements. In practice accuracy is limited by:

•

Available computation power limiting the numerical resolution that can practically be used;

•

Accuracy of numerical models;

•

The underlying empirical sub models for; o o o o

Issue 1

Reaction zone, Turbulence generation, Turbulence length scale, Turbulent combustion. May 2007

Page 229 of 493

FIRE AND EXPLOSION GUIDANCE In addition the numerical grid is typically insufficient to resolve smaller items of equipment and most pipe work. These items must be represented as they are responsible for a large proportion of the turbulence generated during an explosion so they are represented as drag and turbulence source terms within each cell (so called ‘subgrid’ modelling or Porosity, Drag Resistance (PDR) models). These models are therefore calibrated against experimental data of which full-scale data is preferable to avoid scaling effects known to exist in gas explosions [6.30]. The full-scale tests performed in the Spadeadam test rig during Phases 2, 3a and 3b of the Fire and explosion JIP therefore provide important reference data for CFD explosion prediction tools. Importantly Phase 2 of this JIP [6.31] gives a comparison of predictive capabilities for selected explosion simulation tools. Examples of specialist CFD gas explosion simulation tools include: AutoReaGas, FLACS, EXSIM. A simplified formulation CEBAM has been developed in the US.

6.6.2

Limitations of CFD codes

Whilst CFD codes are considered to be the most accurate and stable codes for the generation of explosion loads and are in widespread use, they all have the following properties:-

•

The codes are mostly designed to deal with fully turbulent flames.

•

The codes do not directly model flame distortion and diffusion/hydrodynamic instabilities that occur between ignition and fully turbulent combustion. Consequently the codes must rely on empirical flame folding models that are valid for a limited range of fuel-air concentrations and boundary conditions.

•

The codes do not model flame propagation phenomena involving instabilities associated with acoustic waves and shocks.

•

The codes should not be expected to accurately model flame quenching due to deficiencies in the models, and due to lack of validation with experiments where quenching can be directly observed.

Many of these deficiencies are partly due to the current limited understanding of the various flame propagation phenomena, and due to inadequate computer resources which prevent sufficient spatial and temporal resolution. Important inputs to the analysis are the laminar and turbulent flame velocities. The turbulent flame velocity is related to the laminar flame velocity in Appendix A of the basis document [6.1]. Further data are available [6.32, 6.33].

6.6.3

Explosion code review/selection

The relatively limited time available for the preparation of this Guidance precluded a detailed survey of the current status of explosion prediction tools. The information described here was instead based on a recent survey conducted by the Health and Safety Laboratories [6.4].

Issue 1

May 2007

Page 230 of 493

FIRE AND EXPLOSION GUIDANCE Some of the relevant conclusions/discussion from this recent review by HSL are summarised below:

•

The phenomenological code SCOPE and ‘simple’ CFD codes AutoReaGas, EXSIM and FLACS are in widespread use

•

Phenomenological and CFD methods generally give fairly good accuracy (within an factor of two*) so these models yield solutions that are approximately correct

•

The limitations associated with empirical and phenomenological methods (simplified physics and relatively crude representation of geometry) can only be overcome through additional calibration

•

It is recommended to develop ‘advanced’ CFD codes that will allow fully realistic combustion models and resolution of all obstacles but is stated that it is likely to be 10 or more years before such tools are available. This is primarily due to the large computational expense of this type of model.

It is considered however that the present phenomenological and CFD models are adequate for the assessment process being carried out given the uncertainties in the other stages of the process. It should be noted that the view in Norway is that a correct application of the NORSOK protocol for explosion simulation will result in an accuracy of +/- 30 % in peak overpressures [6.18, 6.22]. Further extracts from this report can be found [6.1] along with a brief description of the empirical, phenomenological, and ‘simple’ CFD codes that are described in the report.

6.6.4

Summary of main conclusions of HSL report [6.4]

‘The limitations associated with empirical and phenomenological models i.e. simplified physics and relatively crude representation of the geometry, can only be overcome through additional calibration. This limits the scope for improvements.’ ‘In light of the fact that gas explosion predictions are needed now, but that it will probably be ten or more years before the CFD-based models will incorporate fully realistic combustion models, be able to more adequately model turbulence and turbulence-combustion interaction as well as being able to accurately represent all important obstacles in real, complex geometries, one must make the best use of the currently available models. However, it may be unwise to rely on the predictions of one model only, given the uncertainties that remain – especially if the model is used outside its range of validation. One must also be aware of the uncertainties associated with whatever modelling approach is used’. ‘The accuracy expected from, say phenomenological and ‘simple’ CFD models is generally fairly good (to within a factor of two), e.g. the models yield solutions which are approximately correct, but, importantly, only for a scenario for which the model parameters have been tuned. This limits the accuracy of these models as truly predictive tools.’ (no. 8 of main findings). ‘Perhaps the safest that can be advised at this point is that it would be unwise to rely on the predictions of one model only, i.e. better to use a judicious combination of models of different types, especially if a model is being used outside its range of validation.’ (no. 9, of main recommendations).

Issue 1

May 2007

Page 231 of 493

FIRE AND EXPLOSION GUIDANCE Note All phenomenological and CFD codes represent to greater or lesser degree the physics of combustion and flame behaviour and all are ‘calibrated’ or ‘validated’ against experiments. It could be said that all could not therefore be used outside their experimental validation, but it should be recognised that because there is an understanding of the physics involved, it is not unreasonable to move the models outside there region of experimental validation as long as this is done with a knowledge and understanding of the limitations.

6.6.5

Practical use of CFD explosion prediction tools

6.6.5.1

Geometry requirements, methods for early project phases

During the early stages of a typical offshore project, only the general layout and location of the major pieces of equipment are known. The level of geometric detail usually increases as the project proceeds as smaller pieces of equipment and objects such as piping and cable trays are defined. For explosion overpressures predictions at each project stage the likely effects of geometry detail to be added later in the project should be accounted for. If this is not done it is likely that the calculated explosion characteristics such as overpressure and impulse will increase significantly as detail is added throughout the project duration. Two possible methods of addressing this have been postulated [6.23].

•

Make allowance for later increases in explosion loads by multiplying the explosion overpressures predicted for a given level of geometry detail by applying a factor for equipment growth (and hence congestion) based on previous project experience

•

Addition of anticipated ‘probable’ congestion into the explosion geometry model to allow for as yet undefined geometry

Detailed investigation of an integrated deck platform typical of the central/northern North Sea showed that reasonable prediction of the likely final overpressures required the definition of all major equipment, boundaries (decks, TR/accommodation blocks), all piping with diameters > 8”, Primary structure, secondary structure with cross section dimensions > 5”. The anticipated additional congestion likely to be added as the design is progressed can be based on historical data for similar previous projects, equivalent equipment with all of its associated pipe work. Several possible measures of the ‘completeness’ of the current geometry model such as the total length of the defined obstacles or various measures of the blockage ratio have also been proposed.

6.6.5.2

Hints, tips and recommendations for use

Further details of these methods are summarised in reference [6.29].

•

Uniform cells should be used in the region of a CFD model where turbulent combustion will take place

•

It is recommended that in FLACS simulations there should be at least 13 cells across an unconfined gas cloud. Fewer cells are necessary with confinement, [6.29, 6.34, 6.35].

•

For AutoReaGas the recommended constants provided for turbulent combustion modelling (factor slope and turbulent combustion modelling constant) should be used with close to 1 m3 cells.

•

It is recommend that uniform stoichiometric concentration gas clouds are used in explosion modelling due to lack of calibration/validation for non-uniform non-stoichiometric concentration clouds

•

A sufficiently detailed geometry model should be used with explosion prediction models that rely on a detailed geometry model of the facility

Issue 1

May 2007

Page 232 of 493


An explosion prediction code with a demonstrated predictive capability should be used, consult your code supplier.

•

The numerical mesh should be extended sufficiently far from the region of interest to prevent boundary conditions from affecting the simulation results of interest to the project

•

The computer code EXSIMPO is available for use with EXSIM which determines the appropriate cell size from the layout.

6.6.6

Validation/calibration of gas explosion prediction tools

It has been found experimentally that gas explosion behaviour in confined and congested environments is dependent on the scale of the test [6.30, 6.31]. Thus one of the main objectives of the Phase 2 BFETS JIP [6.31] was to provide specific information on the characteristics of explosions in a full-scale test rig intended to be representative of an offshore module. Comparison between results for complete stoichiometric methane fills of a 1:3.2 scale and full size Spadeadam test rig showed overpressures between 5 and 2.5 times greater at full scale. The full-scale test results from the Phases 2 and 3a can now be obtained from the UK HSE and are an important resource for validating/calibrating explosion assessment tools. It is therefore recommended that the suitability of explosion assessment tools should be at least partly assessed by comparison of simulation results with a selection of test cases taken from full scale tests in the Spadeadam test rig. It is worth noting that the only assessment of full scale blind explosion predictions, made before the relevant test results were publicly available, were conducted in Phase C of the Model Evaluation Exercise conducted during Phase 2 of the Fire and Explosion JIP [6.31]. This was a demonstration of certain predictive capabilities of the range of gas explosion simulation tools available at this time. The validation process should demonstrate the “predictive” capability of the proposed tool rather than simply calibrate a result to one set of experiments.

Issue 1

May 2007

Page 233 of 493


Example overpressure traces

Results from the explosion tests at the Advantica Spadeadam test site, revealed that the overpressure time histories had a large number of short duration spikes which seemed to be superimposed on a generally smooth curve. Figure 6.3 shows a typical trace from inside the test rig.

Figure 6.3 - Example overpressure trace (inside a compartment) The origin of these spikes could be:

•

local supersonic flow and the resulting generated shock waves

•

localised centres of combustion and pressure generation

•

acceleration of the pressure transducers during the explosion

•

local response and subsequent generation of shock waves through the (bolted) structure.

Whatever the cause investigations have shown [6.36] that the influence of these short duration loads is insignificant for components with natural periods more than 0.02 seconds (natural frequency less than 50 Hz) which includes most components. These spikes which can take the observed overpressures beyond 12 bar may therefore be ignored and pressure traces may be smoothed by time averaging over a period of 1.5 milliseconds. Other more refined smoothing techniques have been investigated [6.37]. Existing CFD explosion simulation codes do not generate these spikes as they cannot represent any of the processes identified above so overpressure traces from CFD simulations may be used directly as the input loading for some finite element packages (FEA) packages. This form is not characteristic of far field blast waves outside a compartment. A typical trace for this case is shown in Figure 6.4. Issue 1 May 2007 Page 234 of 493


Figure 6.4 - Typical pressure trace at some distance from a vent – blast wave.

6.6.8

Extrapolation of the results of a worst case explosion simulation

For an initial screening analysis the following method from reference [6.17] is a method for the extrapolation of the results from a simulation based on a worst case scenario with the whole volume is full of a stoichiometric mix of gas for use when partial fills are more realistic. This may occur if the released inventory cannot be sufficient to form a cloud of this size. The peak smoothed overpressure for this worst case scenario simulation will be Pult The reliability of the results of this method will depend on the reliability of the base simulation. The method is based on the assumption that any gas within the module is perfectly mixed and that the probabilities of an explosion occurring at any concentration within the flammable range are equal. It is recommended that the variation of explosion overpressure with ignition point location is investigated by considering at least three ignition points at representative points, such as both ends and the centre of the module, again assuming that the module is fully filled with a stoichiometric concentration cloud. The variation of explosion overpressure with concentration for unmitigated explosions is defined by the following relationship:

PE2 = PE1e17.693•[( E 2 −1.0563) Where: PE1

2

− ( E1 −1.0563 ) 2 ]

= overpressure at concentration equivalence E1 (Pult for a stoichiometric mix)

•

PE2

= overpressure at concentration equivalence E2

•

E

= Concentration of Interest/Stoichiometric Concentration

Issue 1

May 2007

Page 235 of 493

FIRE AND EXPLOSION GUIDANCE This relationship for the variation of the maximum peak explosion overpressure with cloud size has been developed based on limited medium-scale experimental evidence and FLACS simulations of these events. The method was developed based on experiments for one explosion geometry. The relationship between the fraction of the module filled with stoichiometric concentration and the fraction of the overpressure corresponding to a fully filled module, produced by a given cloud is shown below in Figure 6.5:

1

Normalised Overpressure

0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 0

0.1 0.4 Normalised Cloud Volume

1

Figure 6.5 - Normalised overpressure vs. Normalised cloud volume The influence of water spray mitigation, based on a small data set, is quantified by the use of a ratio of the unmitigated overpressure to the mitigated pressure ‘Pr.’. This varies with the unmitigated explosion overpressure as given below:

Table 6.5 - Pr - unmitigated/mitigated peak overpressure

Issue 1

Maximum unmitigated explosion overpressure (Bar)

Pr

0 to 0.2

1

0.2 to 0.5

2

0.5 to 1.0

3

1.0 to 2.0

3.4

2.0 to 4.0

6

> 4.0

8

May 2007

Page 236 of 493

FIRE AND EXPLOSION GUIDANCE A relationship for mitigated explosion peak overpressure is also given in the same form as the earlier relationship for unmitigated explosions:

PE2 = PE1e18.215•[( E2 −1.0007 )

2

−( E1 −1.0007 ) 2 ]

The factors given in Table 6.2 represent median values, with a large spread in the data for all overpressure ranges. The use of these factors may considerably under or over estimate the real local overpressure peak values.

6.7

Development and application of nominal explosion loads

6.7.1

Intended use of nominal explosion loads

During the concept selection/definition phase of a project it would be useful to have an indication of likely gas explosion loads for use in assessing alternative concepts. At this stage of the project very little detailed information will be available and this will almost certainly be insufficient to allow the use of explosion prediction methods that require the input of geometry models with any level of detail. In addition normal project timescales will not allow time for detailed explosion assessments to be carried out at this time. As the spatial variation of explosion loads will not be well represented, it is not recommended that nominal overpressures or dynamic pressures are used as a design basis at later project stages, for the assessment of existing platforms or for high risk or novel installations. Nominal overpressures are defined as peak representative overpressures by installation/module type determined on a non-statistical basis from acquired experience or simulation for a demonstrably similar situation. If it is necessary to calculate blast wave effects in the far field, for example at an adjacent platform, this could be done using one of empirical blast wave propagation methods from a knowledge of the vent areas and the mass of fuel in the gas cloud. The external explosion which may occur as a result of the ignition of a vented unburnt fuel/air mixture is not explicitly included in the approach although in some of the data the external explosion may have contributed to blockage of the vents and increased the overpressures in the combustion region. At later project stages, and for re-assessment of existing facilities it is recommended that a suitably validated phenomenological or a specialist CFD explosion simulation tool is used. A Rule Set defining nominal, space averaged, peak explosion overpressures or nominal overpressures may be developed to assess alternative concepts at early project phases. This could be based on data from previous explosion load simulations for the range of concepts, module sizes, module types and process characteristics.

6.7.2

Factors influencing the overpressure values

The Rule set could also include information on the expected variation of the nominal overpressures with respect to but not limited to a subset of the following factors:

Issue 1

•

Production rate

•

Gas compression pressure

•

Gas composition

•

Number of production trains May 2007

Page 237 of 493


Module area/footprint

•

Confinement measures

•

Congestion measures

•

Aspect ratio

It would be desirable if these factors could be as near as possible independent to aid processing of the base data.

6.7.3

Characteristics of a suitable data set

Some data have been collected on a range of concept types and are given in Appendix A of one of the base documents for this Guidance [6.2]. These data were found to be unsuitable for the generation of reliable nominal overpressures. The overpressures are not defined precisely and may not be representative of the general level of severity of the explosion event simulated. The desirable characteristics of a suitable data set are:

•

The values need to represent space-averaged overpressures over the affected area, they are defined as the average of all simulated (or measured) overpressure peaks within the affected region. It is assumed that in the case of measured overpressures they have been smoothed by time averaging over a window of 1.5 ms.

•

There should be sufficient gauge points to represent the spatial variation of pressure within the explosion.

•

The scenarios simulated should represent the DLB design level explosion for the ductility level event occurring at the appropriate frequency level.

•

A CFD or validated phenomenological simulation method should be used for all the data. Contemporary analysis methods and up to date software should be used.

•

A number of ignition points should be considered preferably with information on the probability of ignition associated with each one. The detail on the model representing the geometry should represent obstacles down to piping of 3” diameter.

•

An indication of the variability of the overpressure peaks throughout the compartment should also be part of the data set.

•

An indication of the form of the overpressure traces (duration, and impulse) should be included.

•

Peak dynamic overpressures at SCEs of Criticality 1 and 2 should be included.

The resulting nominal overpressures, frequencies and durations should then be a good indicator of the expected severity of the design explosion event and the level of risk arising from the explosion hazard.

6.7.4

Bounding (minimum) overpressures and durations

DNV Offshore Standard DNV-OS-A101 [6.38] provides a source of ‘bounding overpressures. (It should be noted that the bounding overpressures represent space averaged peak overpressure values). These values are the minimum overpressures that will be acceptable for design, if they are used, they will need to be justified with respect to ALARP. Issue 1

May 2007

Page 238 of 493

FIRE AND EXPLOSION GUIDANCE Section D600, P9 of these rules [6.38] provides guidance for hydrocarbon explosions. It should be noted that large quantities of ethylene, acetylene and hydrogen require special consideration. The following extracts are taken from this reference: In a ventilated compartment the explosion load given by overpressure and duration is mainly determined by the relative ventilation and the level of congestion. For compartment volumes of up to 1000 m3, with relative ventilation area of about 0.5, stoichiometric gas cloud ignition expected to give approximately 1bar with a medium level of congestion. High congestion levels may increase overpressures by a factors of 2 to 3. Larger volumes also tend to increase overpressures. Design overpressure in a ventilated shale shaker room with less than 1000 m3 volume and moderate congestion may be taken as 2 bar, combined with a pulse duration of 0.2 s (200 milliseconds) unless a more detailed assessment is carried out. Design overpressure on an open drill floor area may be 0.1 bar combined with a pulse duration of 0.2 s unless a more detailed assessment is carried out. The vent area Av may be taken as sum of free opening and blow out panel areas where static opening overpressure is less than 0.05 bar. Durations for explosions is expected to vary from 0.2 s for fairly open compartments to 1 s for quite closed compartments. If panels or walls are intended to give explosion relief by failing a peak overpressure of 2-3 times their failure pressure can still be expected in the compartment. This is only the case if ventilation dominates. For large and congested compartments local overpressures may be greater. Long compartments with length/diameter ratio greater than 3 will tend to give higher overpressures due to long flame acceleration lengths. The effective diameter can be estimated as D = √A where A is the smallest cross-section area and L is the largest compartment dimension. For completely enclosed compartments generally, bulkheads that must survive an explosion will be designed for 4 bar. For process areas on open deck covering not more than 20 m x 20 m with an uncongested arrangement a design overpressure of 0.2 bar with a pulse duration of 0.2 s may be used. Volume blockage ratios (VBR’s) of 0.05 may be considered as not congested, where VBR is the ratio of the blocked volume to the total volume considered. For larger or congested process areas a design overpressure peak of 0.5 bar with a pulse duration of 0.2 s may be used. A volume blockage ratio of 0.05 may be considered not to be congested. See Table D1 in paragraph 617 of the reference [6.38] for a summary of these results.

6.7.5

Other sources of bounding or generic overpressures.

Puttock [6.39] describes a negative feedback mechanism between confinement and congestion that tends to limit the typical pressures within an explosion to an overpressure of 8 bar. If an explosion is completely confined typical pressures will reach 8 bar but there will be only limited flow within the explosion due to the confinement, and therefore little turbulence. Issue 1

May 2007

Page 239 of 493

FIRE AND EXPLOSION GUIDANCE Conversely with a very open layout strong flows and rapid turbulent combustion can result in high localised pressures but the typical space averaged overpressures within the region are likely to be lower than the peaks because hot combustion products will be able to dissipate. Thus the congestion must be considered to account for the phenomena likely to be seen in an offshore gas explosion.

6.8

Impulse and duration related to peak overpressure

It has been observed that faster combustion results in higher peak overpressures but the gas is consumed in a shorter period. This may be used to estimate durations and impulses associated with given peak overpressures. Without undertaking detailed modelling it is not practicable to establish the overpressure time history for the specific situation, however, by establishing the blast duration, the peak overpressure loads can be translated into useable loads for preliminary response calculations. This load time history may be translated into an equivalent static load which is more readily usable in the concept definition and FEED stages. It is recommended that in the absence of project specific data the relationship between impulse and peak overpressure described in Hoiset [6.40] is used to derive a positive duration for the overpressure based on the assumption of a triangular pressure-time history with equal rise and fall times. These relationships are based on CFD simulations of a small number of geometries and should only be considered as approximate example values. The explosion overpressure impulse, I, is given by:I = 0.042 P + 6,500

(Figure 6.6)

The positive phase duration, t+, in seconds is then: t+ = 0.084 + 13,000/ P (Figure 6.7) where

P

is the peak overpressure in Pascals (1 bar = 100,000 pascals)

I

is the impulse in Pascal.seconds

t+

is the positive phase of overpressure duration in the combustion region in seconds.

Issue 1

May 2007

Page 240 of 493

FIRE AND EXPLOSION GUIDANCE Impulse kPas Vs OP Bar 25

Impulse kPas

20

15 Impulse kPas 10

5

0 0

0.5

1

1.5

2

2.5

3

3.5

4

4.5

Overpressure (Bar)

Figure 6.6 - Generic variation of impulse with overpressure The curves given [6.40] in Figure 6.6 and Figure 6.7 may not be applicable for large open areas such as occur on F(P)SOs and Spars, as it was derived for enclosed compartments. These curves do not apply to blast waves from a distant explosion as in this case the impulse may be near zero and the positive phase duration may be much shorter. The blast wave from a distant explosion (>20 m from the vent) will develop into a sharp fronted wave with a negative phase often represented with duration twice that of the positive phase. If an overpressure simulation is available then a point may be positioned on the impulse/overpressure chart in Figure 6.6. This will serve to calibrate the model for the specific situation. A line may then be drawn through this point parallel to the line given. This new line may then be used for extrapolation of nominal impulse and duration.

Issue 1

May 2007

Page 241 of 493

FIRE AND EXPLOSION GUIDANCE Duration Vs Overpressure (Hoiset)

1.6 1.4

Duration (s)

1.2 1 Duration s

0.8 0.6 0.4 0.2 0 0

0.5

1

1.5

2

2.5

3

3.5

4

4.5

Overpressure (Bar)

Figure 6.7 - Overpressure duration relationship Note that the assumption of a symmetrical triangular positive phase will not apply if there are two clear paths for the pressure disturbance to reach the observation point such as would be observed on the deck below an explosion. An external explosion may result in a double peak in the overpressure.

6.9

Design explosion loads

6.9.1

Load cases for explosion response

Two levels of explosion loading are recommended for explosion assessment by analogy with earthquake assessment. They are the ductility level blast (DLB) and the strength level blast (SLB). Low risk installations may be assessed using only the DLB. The ductility level blast is the design level overpressure used to represent the extreme design event. The strength level blast represents a more frequent design event where it is required that the structure does not deform plastically and that the SCEs remain operational. This load case is recommended for the following reasons:-

•

The SLB may detect additional weaknesses in the design not identified by the DLB (robustness check).

•

An SLB event could give rise to a DLB by escalation – this should ideally not occur as elastic response of SLB and supports should be maintained.

Issue 1

May 2007

Page 242 of 493


The prediction of equipment and piping response in the elastic regime is much better understood than the conditions which give rise to rupture. The SLB enables these checks to be made at a lower load level often resulting in good performance at the higher level (strength in depth).

•

The SLB is a low consequence event important for the establishment of operability.

•

This load case offers a degree of asset protection.

6.9.2

Determination of explosion design loads

Overpressure acts directly on loaded surfaces and is available directly from computational fluid dynamics (CFD) and some phenomenological explosion codes. Design explosion loads were in the past derived from a worst credible event assuming a gas cloud of maximal extent with stoichiometric composition ignited at the worst time in the worst position. Usually the ultimate peak overpressure ‘Pult’ derived in this way is far too large to be accommodated by the structure. ALARP arguments are appropriate and can be used to demonstrate that risk has been reduced to satisfactory levels, relying on frequency and risk arguments. Pult will often correspond to an event with an adequately low probability of occurrence. A probability of between 10-4 and 10-5 per year is considered reasonable for the ductility level design event by comparison with the treatment of environmental and ship impact loads which are often considered at the 10-5 level. The assessment principles for offshore safety cases document APOSC [6.41] states that ‘the frequency with which accidental events result in loss of integrity of the temporary refuge within the minimum stated endurance time, does not exceed the order of 1 in 1000 per year’. Earlier versions of the safety code previously issued by NPD (now under the jurisdiction of the Petroleum Safety Authority in Norway) [6.42] gave a limit on TR impairment probability of 10-3 per year. The revised regulations, (available for view on the internet [6.43]) have now been redrafted into a more risk based approach. It is reasonable and conservative to assume that the threat from fires exceeds that from explosions by a factor of 10 to 1 and an impairment frequency of 1 in 10,000 per year is a reasonable estimate for explosion impairment. Hence a target of 10-5 exceedance per year for an explosion event which directly impinges on the TR is reasonable. An explosion event in the process area will be separated from the TR by a barrier or blast wall which should withstand the load and have an impairment frequency of much less than 10 % giving a target frequency for such an event of the order of 10-4 exceedance per year. The space averaged peak overpressure for the compartment is used for determination of the design explosion loads as it is more generally representative of the severity of the event. A local overpressure peak may be used to generate exceedance curves for the determination of load cases for local design of blast wall for instance. Impulse exceedance curves may also be generated which take into account the duration of the load and its peak value are a better measure of the expected response of the target which will be dynamic in nature. The SLB may then be identified from a space averaged peak overpressure exceedance curve, as that overpressure corresponding to a frequency one order of magnitude more frequent or with a magnitude of one third of the DLB overpressure whichever is the greater. The reason for the reduction factor of one third is related to the expected reserves of strength in the structure and the observation that the primary structure will often only experience received loads of this reduced magnitude. Section 8 and its various sub-sections provide more detail of the issues related to explosion loads.

Issue 1

May 2007

Page 243 of 493

FIRE AND EXPLOSION GUIDANCE Figure 6.8 represents an example (simplified) overpressure exceedance diagram. This curve is conventionally plotted with a logarithmic scale for the vertical frequency axis which gives the frequency of per year which the given overpressure will be exceeded. The horizontal axis is a linear scale usually with the peak space averaged overpressure for the combustion region plotted in bar. This parameter gives a good general measure for the choice of design scenarios. Each of these scenarios may have a large range of local peak overpressures and associated durations within it.

Figure 6.8 - Example overpressure exceedance curve – location of DLB and SLB design load cases (Pstr and Pduct) The SLB overpressure, ‘Pstr’ may then be identified as that overpressure corresponding to a frequency one order of magnitude more frequent or with a magnitude of one third of the DLB overpressure, ‘Pduct’ whichever is the greater. The reason for the reduction factor of one third is related to the expected reserves of strength in the structure and the observation that the primary structure will often only experience received loads of this magnitude [6.44, 6.45]. Many other forms of this curve have been produced with various combinations of log and linear axes, this gives the impression that the curves differ in shape which depends on the axis choice. Other forms of curve may be plots of local peak overpressures for a particular location There is some evidence that the curve has underlying exponential distribution characteristics [6.45, 6.46] which gives a straight line when plotted with log-linear axes as in Figure 6.8. The same convention may be used for plotting other measures such as dynamic pressure exceedance curves for a particular part of the combustion region. The dynamic pressures corresponding to the SLB and DLB load cases may then be obtained in the same way by selection of the appropriate frequencies of exceedance. The generation of exceedance curves is discussed in detail in Section 6.10. Issue 1

May 2007

Page 244 of 493


The COSAC risk assessment tool

COSAC [6.47] is a commercially available risk analysis software tool intended for concept evaluation and screening at earl project phases. The program is used by building an approximate model of the various field development concepts from a list of elements so that each concept can be ranked and potential ‘concept stoppers’ can be identified at an early stage. The tool includes an explosion assessment method based on FLACS simulations of more than 15 modules/geometries conducted using the NORSOK procedure to generate an explosion pressure exceedance curve. For a specified solid barrier the model can be used to calculate the explosion pressure for a defined annual frequency of occurrence e.g. 10-4 per year. The model has been developed based on data from ordinary offshore modules and is therefore not recommended for extreme cases.

6.9.4

The PRESTO screening model

Advantica have recently undertaken some work to produce a simple screening model for overpressure prediction. This is based on the Phase 2 and 3 data and proprietary test data. The model includes parameters that characterise the degree of congestion and confinement explicitly. They make no claims for the validity or otherwise of the present version which is still very much at an early stage of development.

6.10

Generating exceedance curves

6.10.1

General

There is currently much industry interest in the generation of curves of the probability of exceeding a specified explosion load at a given location. These curves can relate to overpressure at a point, or averaged over a wall, or other explosion properties such as dynamic pressure or impulse. Exceedance curves are typically plotted on a graph with overpressure plotted on a linear scale on the horizontal axis and annual exceedance frequency plotted on a log scale on the vertical axis. An exceedance curve will always be a monotonically decreasing (discrete) function. Several methods of generating exceedance curves are in use, [6.1]. The range of methods represents the fact that at an early stage of a project the available information may be sufficient only to apply a relatively simple methodology with more complex methodologies applied as the project develops. However, the range is also due to the number of factors that can contribute to an explosion occurring with different methodologies accounting for these factors. The release, cloud formation, ignition and explosion must all be considered in generating exceedance curves. Decisions must therefore be made about how to represent these influences on the explosion. Natural variability, in for example, release or ventilation rate, and uncertainty in both the data and models should be considered. There are methods of extrapolating from a small number of explosion simulations representing differing ignition points to represent various (equivalent stoichiometric) cloud sizes and the expected overpressures [6.17] and Section 6.10.5. An exceedance curve may be constructed using these extrapolated results. Section 6.10.5 presents a simplified method based on the assumption of exceedance curve shape which in theory requires only requires a small number of simulations to be performed. Issue 1

May 2007

Page 245 of 493

FIRE AND EXPLOSION GUIDANCE The other point uses the probability of a release forming a cloud combined with the probability of a late ignition Prexp, corresponding to the zero overpressure exceedance probability. This method may be used only at an early project phase when sufficient information for more sophisticated methods is not available.

6.10.2

Exceedance curves for design explosion load case determination

The process below is a method of medium complexity for the generation of exceedance curves for the purpose of identification of the design explosion events corresponding to the SLB and DLB. It is advisable to consider space averaged peak overpressures for this purpose as they are more representative of the general severity of the load case. The chosen scenarios will themselves give rise to simulations which have large local variations of peak overpressure. The most rigorous and repeatable method of exceedance curve generation is that following the NORSOK procedure [6.8] described later in Section 6.13. It is important to identify the explosion scenarios with the higher overpressures as these will determine the required exceedance probabilities in the required range (10-5 to 10-4 exceedance). Explosions with a frequency of exceedance of greater than 10-3 will also dominate the accuracy of the exceedance curve around the 10-4 exceedance level. The total probability of an explosion gives a method of determining if adequate scenarios have been considered and convergence is being achieved. Figure 6.9 illustrates the sequence of tasks for exceedance curve generation. 1. select leak scenarios and determine release probabilities 2. calculate release rate time history 3. calculate cloud size time history At the highest level of sophistication this would involve consideration of ventilation rates by wind speed and direction by CFD simulation. At a lower level the expected higher explosion overpressures would occur in situations of poor ventilation with the wind from a direction blocked by a barrier or equipment. A simplified method might assume a near constant release rate to generate a series of cloud sizes with equal probability, a workbook approach [6.18] is described in Section 6.4.2 could be used. 4. calculate ignition probability At the highest level the probability of ignition from a continuous source, will be estimated as a time history and will be proportional to the rate of generation of inflammable cloud volume which should be available from a CFD dispersion calculation. At a lower level the ignition probability could be assumed constant irrespective of cloud size but with say 3 widely spread locations for the ignition sources. 5. calculate equivalent stoichiometric cloud size (Section 6.4.4) note the reservations quoted in this section on the accuracy of this step in the analysis process.

Issue 1

May 2007

Page 246 of 493

FIRE AND EXPLOSION GUIDANCE 6. calculate the space averaged peak overpressure discussed earlier in Section 6.7.4. A high level of sophistication method could use CFD for the cases where the highest overpressures are expected with calibrated phenomenological simulations for interpolation between scenarios if required. Alternatively, a Monte Carlo simulation method may be used based on a phenomenological model used such as ARAMAS which generates space averaged overpressures implicitly. Several thousand simulations may be performed for variations of all input parameters governing environmental, release and ignition. The wider range of parameter variations offsets some of the uncertainties in the extrapolation techniques which could be used if a CFD approach with fewer simulations is used. A low sophistication method may use one of the larger cloud size cases with interpolation for smaller clouds using approaches described in Section 6.6.8 and Reference [6.17]. 7. assemble the space averaged peak overpressure exceedance curve from probabilities of occurrence of the overpressures for the scenarios simulated. If local overpressure exceedance curves are needed for a reliability analysis of a blast wall for example these may be generated based on the probabilities for the averaged pressures and transfer functions relating these two values for the chosen location [6.48]. The worst credible scenario assuming a stoichiometric cloud filling the module and ignited at the worst position may not be representative of the general population of explosion events. In addition it will be difficult to determine its probability of occurrence. A representative scenario at around the 10-4 per annum exceedance level or the 10-5 frequency of occurrence level should be used if it can be identified. A simplified method which may be used for the purpose of design explosion load determination, is presented later (see Section 6.10.4). Bruce [6.49] describes a typical methodology for estimating overpressure exceedance distributions with associated confidence bounds. The probability distributions of the input variables are considered in giving these bounds.

Issue 1

May 2007

Page 247 of 493


Figure 6.9 - Overview of probabilistic blast modelling approach [6.49]

Issue 1

May 2007

Page 248 of 493


Generic exceedance curves

Puttock [6.48] describes the possible use of generic pressure exceedance curves designed to give a conservative estimate of the required probability for all modules of one generic configuration. As the worst-case overpressure will vary from module to module the generic exceedance curve is plotted as the ratio of overpressure to the worst-case overpressure. One problem with the use of this type of generic curve is that they do not allow for the fact that the level of overpressure will affect the shape of the plot because if the overpressure is already close to 8 bars it is unlikely to significantly increase. Ratios of a parameter called severity index rather than the overpressure can be used to allow for this. Severity index, S, is based on runs of SCOPE 3 [6.48] and tends to infinity at 8 bars which would correspond to adiabatic combustion of a stoichiometric hydrocarbon without expansion. An expression for S is given as:

S = P.e

(0.4

P E1.08 −1− P

)

Where P is the overpressure in bars, E is the expansion ratio at atmospheric pressure. Note that this approach assumes that P is a typical overpressure, for example over a complete congested region. If P is replaced by S in an expression fitted to some experimental data then at low overpressures the predicted overpressures will be unchanged. If the correlation is used for S and S inverted to get P using the above equation it will automatically be limited in a realistic way to 8 bar. It is however difficult to prove the general applicability of generic curves as their detail is likely to vary between different modules/plants. It is stated that the only feasible way to take into account the complexity of the physical processes in a gas explosion is to use a Monte-Carlo method that requires performing many thousands of model runs to obtain valid statistics. The SCOPE model that only takes a few seconds to run is used for this purpose. Where further detail is required CFD runs are performed using EXSIM. Transform (or transfer) functions that relate the median overpressure produced by SCOPE to features such as localised high overpressures or geometry effects such as shielding or pressure wave reflection are then defined. The method takes account of variations in leak rate, fuel type, wind speed and direction, ignition location and stoichiometry. Flammable gas cloud sizes can be calculated in two stages using EXSIM (ventilation flow followed by dispersion simulation), or using a zone model to predict ventilation flow followed by a random-walk dispersion method. Transform functions at each ‘receptor’ are calculated by running EXSIM for range of initial conditions. The idealisation of the module used in the SCOPE input is adjusted if necessary so that with the module fully filled with gas and ignition at the centre of the module would give the same median overpressure with both models. Example exceedance frequency and exceedance probability curves are given for pressure and impulse in the reference.

Issue 1

May 2007

Page 249 of 493


Mobil North Sea methodology for early design blast analysis

This methodology [6.17] describes four methods to allow designers to select appropriate gas explosion overpressures for use in early stages of the design process when only a small number of simulations have been performed (one for each ignition point considered). The relationship between overpressures for clouds of different sizes and simplifying assumptions about the probability of ignition enable the construction of an exceedance curve for use in identifying design explosion loads in the most sophisticated method described. The guidance given is conservative in certain aspects in an effort to ensure that the estimated blast loads remain firm throughout the design process. Four separate approaches are described in ascending order of complexity. The first two approaches are hazard consequences based while the last two are risk based.

6.10.5

Simplified methods for pressure exceedance curve generation

This method requires that two overpressure/probability of exceedance points are defined. These are then plotted on a graph with overpressure plotted on a linear scale on the horizontal axis and exceedance frequency plotted on a log scale on the vertical axis. The two plotted points are then joined by a straight line to give a simple relationship between overpressure and exceedance frequency. This method is based on the a priori fact that the statistics of random events such as explosions indicate that the intervals between such events will often have an exponential distribution. [6.50]. A recent paper by Yasseri [6.46] has processed the historical data on explosions in the North Sea given by Vinnem [6.51] and has shown that there is a good fit for the data to the exponential distribution. An exponential distribution gives a straight line for the exceedance diagram with the axes chosen. Possible methods of calculating the two required overpressure and frequency points include the following:

•

A point at zero overpressure corresponding to the probability of an ignited gas leak Prexpl.

•

A high overpressure, low frequency event based on the ignition of a full stoichiometric concentration fill of the module Pult and its associated probability.

•

A representative explosion overpressure at an exceedance frequency of 10-4 obtained using the COSAC software.

A suitable representative overpressure may be defined as the average of the highest 20 % of the peaks in any particular scenario. This definition is used to avoid distortion of the resulting curve resulting from the variability of local overpressures. A curve based on local peaks will be specific to the locations chosen.

Issue 1

May 2007

Page 250 of 493

FIRE AND EXPLOSION GUIDANCE Figure 6.8 shows an exceedance curve generated in this way from a sample representative overpressure and frequency of exceedance obtained by simulation. If the sample simulation corresponds to the worst credible case with a full compartment of a stoichiometric gas cloud ignited in the worst position Pult, then the frequency of exceedance is the absolute frequency. The difficulty is the determination of this frequency and it is argued that this case is not a representative point to take. It is preferred to take a representative sample overpressure nearer to the DLB at a frequency of exceedance of between 10-4 and 10-5, however there is then the difficulty of estimating the frequency of exceedance, as there will be some cases where the overpressure exceeds this value each with their own frequency of occurrence.

6.11

Loads on piping and equipment

6.11.1

Load cases for piping and equipment response

Section 3.5.5 identifies three categories of criticality of safety critical elements (SCEs). The dynamic pressure loads should be evaluated on SCEs of criticality levels 1 and 2. SCEs of criticality level 1 and 2 should be assessed against the SLB, SCEs of criticality 1 will be assessed against the DLB as derived in the previous section. If the general level of dynamic pressure loads is not known then it is acceptable to take a load equal to 1/3 of the overpressure at the location for the DLB load case. The duration should be chosen so that the impulse matches that of the overpressure trace. This load must also be applied in the reverse direction. In open areas, such as the decks of FPSOs, these loads should also be applied in the vertical plane. The performance of the structure and SCE’s for these scenarios must then be tested against the appropriate high level and equipment specific performance standards.

6.11.2

Dynamic pressure loads

The explosion loads on equipment items and piping which are classified as SCEs [6.52, 6.53, 6.54, 6.55] must be determined and are referred to as dynamic pressure loads. These may also be obtained from CFD simulation results and consist of:

•

Drag loads (similar to the Morison drag loads experienced in fluid flow) proportional to the square of the gas velocity, its density and the area presented to the flow by the obstacle.

•

Inertia loads proportional to the gas acceleration and the volume of the obstacle.

•

Pressure difference loads.

Drag loads dominate for obstacles with dimensions less than 0.3 m or on cylindrical obstacles less than 0.3 m in diameter in particular in regions of high gas velocity near vents. Both drag and pressure difference loads are significant on objects between 0.3 m and 2 m in the flow direction. Exceedance curves for dynamic pressures may be developed from simulations and used in the same way as for overpressures in deriving design dynamic overpressures.

Issue 1

May 2007

Page 251 of 493

FIRE AND EXPLOSION GUIDANCE The situation in Figure 6.10 represents an explosion in a module compartment. In this example all walls except the West wall are solid. The blast overpressure causes a pressure front to move from left to right from the point of ignition at about the speed of sound in the unburned mixture.

S E

W

N

West wall open

Explosion Vessel

70kN/m Overpressure load Dynamic Pressure Load

Figure 6.10 - Explosion within a compartment [6.56, 6.57] The unburned gas is pushed out of the module through the vented area with a velocity. This velocity will be available directly from a CFD simulation or by the approximate method given in the next section. The air ahead of this front is pushed out through the vent in the West wall over a vessel and pipe work spanning the vent giving the possibility of vessel or piping failure, with further release of inventory and consequent escalation. The gas velocities in this case will occur predominantly near the vent. The magnitude of drag forces on the pipe work (with diameter D typically less than 0.3 m) at any time is given by the drag term in Morison’s Equation. The force should be calculated for engulfment of the obstacle in the burnt and unburnt gas mixture as the burnt gas/air mixture may be travelling at a speed of ten times the speed of the unburnt mixture even though the unburnt mixture is ten times denser. Drag coefficients are given in Figures 4-55 and 4-56 by Cjujko [6.19] and Table 1 [6.53]. A typical time history for the drag load is shown below in Figure 6.11, [6.55].

Issue 1

May 2007

Page 252 of 493


Figure 6.11 - Example dynamic overpressure trace Two peaks are shown corresponding to the peak gas velocities ahead of and behind the flame front. In a vented compartment flow reversal of gases into the compartment could also occur at a later stage in the explosion. This would give a trace with a negative phase. Drag loads are particularly important in open areas such as on the deck structures of an F(P)SO. The gas clouds associated with explosions on FPSOs may be very large and gas velocities up to 500 ms-1 could be experienced. The direction of gas flow may also be very variable for example in the case of the pipe rack of an FPSO acted on by an explosion ignited at low level. Secondary projectiles may be a problem for FPSOs in view of the higher gas velocities. The drag loads may be used to represent the total force on obstacles with in flow dimensions less than 0.3 m. For larger diameter obstacles or vessels, the pressure difference across the vessel will also need to be calculated and added to the drag force above. The IGNs [6.58] state that the validated methods for determination of loading due to blast wind are strictly only applicable to distant explosions: “there is no equally established methodology for structures either within or close to an explosion typical of offshore geometry, in particular in the immediate vicinity of the perimeter of the enclosure where the explosion vents.” These validated methods are based on TNT equivalent explosions with non-turbulent fluid flow at a distance allowing the use of Morison’s Equation to determine the load on a body. Catlin’s paper describes some experimental validations of formulae for both vented gas velocity from a compartment open on one face and the loads on vertical cylinders in the vent area [6.59].

Issue 1

May 2007

Page 253 of 493


Loads on vessels

It is possible to estimate an upper bound to the pressure difference force from an explosion pressure trace [6.19] by assuming or from knowledge of the speed of propagation of the pressure disturbance. If the pressure pulse is considered to propagate with a velocity U then a time interval Δt may be associated with the diameter of the vessel D through:

Δt = D/U The pressure difference across the vessel ΔP may be read from the indicative trace shown in Figure 6.12.

Figure 6.12 - Estimation of the pressure difference across a vessel from a pressure trace This process is conventionally applied for the phase of the explosion where the vessel is in the unburnt air/fuel mix using the appropriate speed of sound. The part of the curve relevant to this calculation is before the peak. Under these assumptions, this same load may be applied after the peak acting in the opposite direction. A time history of drag load may then be estimated. For piping the response to the drag load may be estimated using a single degree of freedom method such as the Bigg’s method described more fully in Sections 8.7.5 and 8.7.6. This same model may be used to estimate the tension effects in one-way spanning blast panels, see the general discussion on response prediction in Section 8.7.

Issue 1

May 2007

Page 254 of 493


Loads on grating

Grating is often used for decking in an effort to allow venting of explosion gases. Tests [6.55] have shown that the force perpendicular to the grating may be calculated from a Morison drag formulation using the cross sectional; area of the grating presented to the gas flow.

6.11.5

Considerations in the use of CFD

In references [6.53] and [6.60] dynamic pressure loads were calculated using the conventional drag formulation given above and directly from CFD simulations, the Direct Load Measurement (DLM) method. In the DLM method, the pressure differential across equipment in each direction is taken from gauge (or measurement) points located on the up and down wind sides of the object and multiplied by the obstacle windage in each direction. It is recommended that this is used for objects greater than 0.3 m in diameter. One problem with this method is that overpressures are generally recorded at the cell centres. This should not be a problem for objects large in relation to the size of the control volumes use in the simulation (3 times the cell dimensions). If the object is large and the gauge points are located at the centres of the object cross section then the computed pressure differential may be multiplied by 2/π to allow for the sinusoidal variation of load direction over the surface of the object. It should also be noted that the gauge points would not capture local pressure increases where the flow stagnates on the object if they are far from the obstacle in relation to the object diameter. This may add short duration loads (durations of a few milliseconds) particularly a high Mach number flows. For intermediate obstacle sizes it is suggested that the CFD numerical grid be locally refined until the object is sufficiently resolved in the flow field. The DLM can then be applied. Alternatively, it is stated that near module vents forces calculated by the DLM and drag methods are similar. Near the centre of a module the loads on obstacles it is recommended in the references that both approaches should be used and the larger of the two loads used for design. It is unlikely that drag loads would in any case be large at these locations so the pressure difference approach is recommended in this Guidance. For the simulations considered during the referenced work, it was stated that the peak drag pressures were about 30 % of the maximum local field pressures and 60 % of the average overpressures experienced within the module. Methods for dealing with multiple objects that contribute drag forces to the total load on an item of equipment are briefly outlined [6.53, 6.60], including a method for dealing with groups of objects that are partially shielded from the blast wind.

6.11.6

Estimation of vented gas velocities

For the situation of a vented compartment open at one end, with the ambient internal pressure and the instantaneous overpressure is known, the velocity of the unburned gas may be estimated using the Rankine-Hugoniot equations for the change in pressure and density across a shock wave [6.59].

Issue 1

May 2007

Page 255 of 493

FIRE AND EXPLOSION GUIDANCE There are only two published circumstances where explosion gas velocities have been measured: 1. The SCOPE experiments executed by Shell where gas velocities were measured directly 2. The Phase 3b tests where an instrumented cylinder was placed in the vent area of the Spadeadam test rig [6.39]. The general view is that in CFD codes the pressure and gas velocity is so closely linked at each point in space and time, that validation of pressure may be sufficient to assume that the gas velocities are being correctly calculated. The asymmetric expulsion of vented gases from a compartment may give rise to out of balance loads or strong shock response.

6.11.7

Strong shock and global reaction loads

The two major sources of out of balance loads from explosions are:

•

Reaction loads from the expulsion of vented gases.

•

Side loads due to the ignition of an external gas cloud which has drifted to one side of the platform – the external explosion.

During a vented internal explosion there may be an out of balance lateral force on the compartment depending on the distribution of vent areas around the module. Initially it seems that the out of balance force on the module will be equal to ΔPA less any net forces on internal equipment, piping and vent obstructions. In fact the time for pressure disturbances to cross the module may be appreciable compared with the load duration and the inertia of the un-burnt products and external atmosphere will affect the net force. The net force on the gas volume contained in the module may also be calculated from rate of change of momentum of the enclosed gas. However, if the local speed of sound is exceeded then the flow becomes ‘choked’ and a second shock wave front is set up at the vent, which will restrict the flow. Obstructions at the vent such as louvers may accelerate the flow locally and induce these standing shock waves. The backpressure for confined flow may be represented by a ‘loss factor’, which represents the loss of momentum encountered by the flow [6.59].

6.12

Reporting template for ALARP demonstration

The following should be considered when preparing the final ALARP justification for the management of explosion hazards: Method of selection of explosion scenarios

•

Available inventories

•

Hole sizes and leak rates

•

Leak locations and directions

•

Wind speeds, directions and ventilation rates

•

Cloud build up

Summary of explosion scenarios considered Issue 1

May 2007

Page 256 of 493


Gas type and concentration

•

Cloud gas concentration, size, shape and location used in simulations

•

Ignition point locations considered

Summary of explosion overpressure results

•

Peak/typical overpressures at a point and over structural panels

•

Peak/typical impulses at a point and over structural panels

•

Dynamic pressures

Method of derivation of design basis

•

Selection of equivalent static pressures – if used.

•

Conversion of ‘typical’ overpressure/dynamic pressure time histories into equivalent triangular form, with justification that this form is appropriate

•

Use of full ‘typical’ overpressure/dynamic pressure time histories

Statement of explosion loads used in design

•

Structure, blast walls, decks

•

Equipment

•

Piping

•

Far field blast

6.13

The NORSOK simulation

procedure

for

probabilistic

explosion

The NORSOK Z-013 standard [6.8] describes a procedure for probabilistic explosion simulations. This procedure is based on an initiative started in 1998 by Norsk Hydro, Statoil and Saga to accelerate and harmonise the development of probabilistic explosion assessments. It is intended for use in detailed analysis of platforms in operation or project phases where the necessary detailed information is available for all influencing design elements. The procedure can be used to calculate exceedance curves for the overpressure and frequencies can be established for unacceptable explosion consequences. The procedure is intended to ‘standardise the analyses so that the risk of explosions can be compared between different areas, installations and concepts, even if the analyses are performed in different circumstances and by different personnel’. The procedure briefly also covers response calculation and consideration of overpressure mitigation methods such as deluge. In early project phases the project must be simplified according to the design information available, but the general structure and principles must be maintained. The amount of equipment is estimated based on equivalent areas in previous studies. Sensitivity studies are used to establish whether minor changes in amount of equipment, pressure relief areas and ventilation will change the gas explosion loads significantly. In cases where low loads are expected or where the structure has high strength (so that larger conservatism can be accepted) the procedure may be simplified provided the conservatism is under control.

Issue 1

May 2007

Page 257 of 493

FIRE AND EXPLOSION GUIDANCE In particular the methods described in the NORSOK standard Z-013 [6.8] represent the most technically rigorous methods available at the time of writing and are the benchmark against which methods used should be gauged. This Guidance is consistent with the underlying philosophy of the procedure but also aims to identify ways by which the volume of computation effort may be safely reduced.

Issue 1

May 2007

Page 258 of 493


7 Response to fires 7.1 Properties of common materials in use offshore 7.1.1

Overview

At normal temperatures steels used in offshore structures are designed to behave elastically, the stress strain behaviour is linear in both compression and tension and beyond yield the slope of the stress-strain flattens markedly. For normal design conditions (i.e. excluding extreme weather for structural steel, fires and explosions) the stress in the steel should be below 60 % of the yield stress. As the temperature rises, the yield stress and the modulus of elasticity both reduce, at a temperature of about 400 ºC the yield stress reduces to about 60% of its value at normal temperatures, and consequently this temperature is often taken as a critical temperature at which the behaviour of the steel changes and failures can start occurring. Concrete is not commonly used offshore but there are about 24 platforms in the North Sea with concrete substructures. The top of the concrete is usually several metres below the underside of the main deck, but it can be subjected to pool fires on the sea surface or the jet fires from risers. Concrete can withstand a pool fire for a significant time, the outer layer of the concrete normally serves to protect the underlying steel from corrosion, but in a pool fire protects the steel and the bulk of the concrete from the effects of fire, at least for some time. In a jet fire the concrete cover can rapidly be eroded, exposing the steel reinforcement to the effects of the flame

7.1.2

Mechanical and thermal

For simple beams or ties, the yield strength at elevated temperature is all that is required. For a compression member the yield and the elevated temperature value for Young’s modulus is required. For a complex FE analysis, the complete stress-strain curves at elevated temperature are required. The most comprehensive source of material properties for the common structural carbon steels is EC3-1-2. (S235, S275, S355, S420 and S460 of EN 10025, EN 10210-1 and EN 10219-1). Many steel grades will be compatible with the European grades. BS5950-8 gives similar information but tends to be less detailed. For other grades of steel, one of the best sources of information is FABIG Technical Note 6 [7.1]. This contains mechanical properties for: Carbon Steels

•

BS EN 10113-3:1993, grades 355M, 420M (based on Helsinki University research), 460M

•

BS7191 grades 355EMZ, 450EMZ

Stainless Steels

• BS EN 10088 grades 1.4301(304), 1.4404(316), 1.4462(2205), 1.4362(SAF2304) The properties of the RQT and TMCR steels tend to be lower than the normal carbon steels. At 400 ºC their relative strength is about 10 % lower. Stainless steels tend to maintain their strength and stiffness at elevated temperatures compared with carbon steels. Issue 1

May 2007

Page 259 of 493

FIRE AND EXPLOSION GUIDANCE For any carbon structural steel, the rate of loss of stiffness is greater than the rate of loss of strength (see Table 7.1). Consequently, for the same load level, buckling will occur at a lower temperature than a failure depending on strength.

Table 7.1 - Reduction factors for strength and stiffness (EC3-1-2) Steel Reduction factor temperature for effective yield strength

Reduction factor for the slope of the linear elastic range

20 ºC

1.000

1.000

100 ºC

1.000

1.000

200 ºC

1.000

0.900

300 ºC

1.000

0.800

400 ºC

1.000

0.700

500 ºC

0.780

0.600

600 ºC

0.470

0.310

700 ºC

0.230

0.130

800 ºC

0.110

0.090

900 ºC

0.060

0.068

1000 ºC

0.040

0.045

1100 ºC

0.020

0.023

1200 ºC

0.000

0.000

It can be seen in the table that the strength of steel falls very quickly. This makes an assessment of the steel temperature very important. At about 500 ºC a 10 % difference in temperature can lead to a 16 % loss of strength. For some heat treated and special steels it may be necessary to carry out tests to establish the necessary properties. This is because the enhancement of properties caused by the heat treatment may be lost if the steel is heated beyond the heat treatment temperature. The mechanical properties given in EC3-1-2 are based on anisothermal tests. In these tests, the steel is first loaded and then heated. The steel responds by expanding due to thermal expansion and elongating due to the stress. As the steel loses strength and thickness the rate of elongation increases until a run-away occurs. From a series of such tests at different stress levels, stress strain curves can be derived for a range of temperatures. The rate of heating is important. The EC3 data are based on steel being heated at about 10 ºC per minute. This corresponds to a 60 minute fire resistance in a building where failure will occur at about 600 ºC. For heating rates between 2 ºC and 50 ºC per minute the EC3 data are reasonable and the effects of creep may be ignored. Because of the effects of creep, if the heating rate is faster, the data will be conservative and for slower heating rates the mechanical properties given by EC3 will be over-estimated. It should however be emphasised that potential heating rates are much faster in fire incidents offshore. In any hydrocarbon fire flame temperatures can be in excess of 1500 ºC and temperatures of close to 1800 ºC have been recorded. The maximum temperature will depend on the size of the fire and the degree of ventilation. Issue 1

May 2007

Page 260 of 493

FIRE AND EXPLOSION GUIDANCE In a hydrocarbon fire, unprotected steel will heat very quickly and will reach temperatures associated with structural collapse in 5 minutes or so. Concrete loses strength at a broadly similar rate to structural steel but loses stiffness at a faster rate. The best reference is EC4-1-2 [7.2] (composite construction). Both BS 5950-8 and EC3-1-2 give the same information on the strength of bolts and welds at elevated temperatures. As these are not well known, the information is shown here in Table 7.2. The yield strength is also shown for comparison.

Table 7.2 - Strength retention factors for bolts and welds Temperature

Strength reduction factor for bolts (tension and shear)

Strength reduction factor for welds

Yield strength

20 ºC

1.00

1.00

1.00

100 ºC

0.97

1.00

1.00

150 ºC

0.95

1.00

1.00

200 ºC

0.94

1.00

1.00

300 ºC

0.90

1.00

1.00

400 ºC

0.78

0.88

0.97

500 ºC

0.55

0.63

0.78

600 ºC

0.22

0.38

0.47

700 ºC

0.10

0.13

0.23

800 ºC

0.07

0.07

0.12

900 ºC

0.03

0.02

0.06

It can be seen that both bolts and welds lose strength at a faster rate than structural steel. However, because of the partial factors used for normal and fire design this effect is not as significant as it might appear (see Section 7.4.2). The thermal properties of the common structural steels are given in EC3-1-2. The thermal properties of concrete are given in EC4-1-2.

7.2 Effects of fire and nature of failures 7.2.1

Standard hydrocarbon fire test

In a hydrocarbon fire resistance test [7.2, 7.3 and 7.4], the gas temperature is increased to 1100 ºC in about 20 minutes and then held constant. The temperature time curve of the ISO and BS hydrocarbon test fires are compared with the standard cellulosic fire in Figure 7.1. Fire resistance tests are generally only useful for comparing the performance of different products under constant conditions. Regulations and specifications will often refer to a performance standard measured in a fire resistance test. Extrapolation to real fire behaviour can sometimes be misleading. Issue 1

May 2007

Page 261 of 493

FIRE AND EXPLOSION GUIDANCE The results of a hydrocarbon fire test are often expressed as H60 or H90 etc.

1200

Hydrocarbon

Temperature (°C)

1000

800

Cellulosic 600

400

200

0 0

30

60

90

120

Time (mins)

Figure 7.1 - Time temperature curves for hydrocarbon and cellulosic fires in fire resistance tests

7.2.2

Jet fire test

A draft ISO standard, ISO/CD 22899-1 [7.5] is being developed to advise on requirements for small scale jet fire tests. It has recently been agreed that there will be a Part 2 giving the background to the test, more clarification on classification and a combination of furnace and jet fire test results etc. The method provides an indication of how passive fire protection materials perform in a jet fire that may occur. Jet fires give rise to high convective and radiative heat fluxes as well as high erosive forces. In the test, a sonic release of a gas (0.3 kg s-1) is aimed into a shallow chamber, producing a fireball with an extended tail. Propane is used as the fuel. High erosive forces are generated by release of the sonic velocity at about 1000 mm from specimen surface. The results from the small scale test have been compared with full scale jet fire test results from four testing establishment laboratories. The test standard gives guidance on the use of the test result and its application to the assessment of passive fire protection material.

7.2.3

Types of failure

7.2.3.1 General Structural failure is any unwanted occurrence and may take any form from excessive deformation to total collapse.

Issue 1

May 2007

Page 262 of 493

FIRE AND EXPLOSION GUIDANCE In a fire, the structure has to carry the applied loads at the time but it also is subject to thermally induced loading which may, for some elements be more severe. The thermally induced loads are caused by restrained thermal expansion. It is also important that the consequences of minor failures on system are analysed with respect to their effects on other systems. For example, a minor structural failure could lead to the fracture of a pipe or breakdown in an electrical system. Another consideration is repair. Has something failed if it does not have to be repaired? Minor residual deformations following a fire may not impair the function of the component or any other component and can probably not be described as failure. A summary table of the failures of the more obvious (safety critical) elements which may give rise to escalation and to which the above issues should be applied may be found below.

Table 7.3 - Safety Critical Element failure or loss of function System or equipment category

Safety Critical Element failure or loss of function

Performance Standard requirement (with respect to fire escalation normally part of survivability characteristics

Primary structure

Failure is direct cause of major (catastrophic) structural collapse

– Resistance to defined fire loads for a given duration (for example, a jet fire direct impingement for a duration 15 minutes - say until process pressure is adequately reduced (to limit the reach of the jet flame). The failure would be when the structure could no longer maintain its load within defined deformation limits whose exceedance would cause further breaches of process integrity or collapse of safety areas or evacuation systems. – Residual strength requirement defined

Secondary structure

Failure allows shifting of load paths and generation of contributory increased loads (ultimately) to primary structure

– Resistance to defined fire loads for a given duration – Residual strength requirement defined

Supporting steelwork for vessels/piping

Failure allows distortion/movement/collapse of hydrocarbon containing vessels and piping with subsequent loss of containment integrity

– Resistance to defined fire loads for a given duration – Limits to movement are defined

Supporting steelwork for equipment

Failure allows distortion/movement/ collapse of rotating equipment/ lifting equipment/ utilities leading to potential loss of containment integrity/ equipment failure/generation of dropped objects/ missiles/ potential loss of power for some safety systems (control, ESD, detection, active protection etc.)


Issue 1

May 2007

Page 263 of 493

FIRE AND EXPLOSION GUIDANCE System or equipment category



Supporting steelwork for accommodation/ control/ muster areas/TR

Failure allows distortion/movement/collapse of areas of key hazard control and places of safety/embarkation for POB

– Resistance to defined fire loads for a given duration – Limits to movement are defined – Limits to loss of airtight integrity defined – Residual strength requirement defined

Supporting steelwork for flooring/ access ways

Failure allows distortion/movement/collapse of access for POB to places of hazard control/safety/embarkation


Vessels/ main piping

Failure leads directly to loss of containment integrity in hydrocarbon containing vessels and piping

– Resistance to defined fire loads for a given duration – Resistance to impact and explosion loads also defined

Vessel appurtenances/ small bore piping

Failure leads to small leaks (loss of containment integrity in hydrocarbon containing vessels and piping) with potential for further fires and explosions

– Resistance to defined fire loads for a given duration – Resistance to impact and explosion loads also defined

Gas detection

Fire from small event may disable systems to detect further escalating events

– Event size and time delay before triggering defined – Generally resistance to fire and other hazard loads impractical, continuing function achieved by redundancy

Fire detection

As above

– Event size and time delay before triggering defined – Generally resistance to direct impingement of fire and other hazard loads impractical, continuing function achieved by redundancy

Blast walls

Blast walls usually have protective requirement with respect to fires as well as explosions, loss of fire resistance integrity following an initial blast will potentially allow spread of fire hazard to other areas

– Resistance to impact and explosion loads defined – Resistance to defined fire loads for a given duration following initial events also defined

Fire walls

Failure leads to loss of control and hence allows unimpeded escalation of the initial event

– Resistance to impact and explosion loads defined (where possible) – Generally resistance to direct impingement of fire and other hazard loads impractical, continuing function achieved by redundancy

Active fire protection systems

Failure leads to loss of control and hence allows unimpeded escalation of the initial event

– Resistance to impact and explosion loads defined (where possible) – Generally resistance to direct impingement of fire and other hazard loads impractical, continuing function achieved by redundancy

Issue 1

May 2007

Page 264 of 493

FIRE AND EXPLOSION GUIDANCE System or equipment category



Passive fire protection systems

Failure leads to loss of mitigation and fire resistance on adjacent systems/steelwork and hence eliminates or impairs any slowing of the escalation from an initial event

– Resistance to impact and explosion loads defined (where possible) – Resistance to direct impingement of fire and other hazard loads may be impractical, continuing function achieved by diversity within suite of safety systems

HVAC

Failure of closure or redirect aspects of HVAC leads to loss of a control system for unignited gas and products of combustion, allowing unimpeded escalation of the initial event

– Resistance to impact and explosion loads defined (where possible) – Resistance to direct impingement of fire and other hazard loads may be impractical, continuing function achieved by diversity within suite of safety systems

7.2.3.2

Loss of compartmentation

Fire spread by loss of compartmentation will increase the likelihood of most types of failure so loss of compartmentation is an important type of failure and within the UK; regulations refer to loss of insulation and loss of integrity. Testing a component in isolation in a fire resistance test may result in acceptance criteria that may be simple to achieve. In the test, a combination of good detailing and a suitable thickness of insulation will normally suffice. However, when a component, such as bulkhead is built into an offshore structure, the interaction between the bulkhead and its boundaries must be considered. Restrained thermal expansion can lead to buckling which may dislodge fire protection material. Boards and thickly sprayed material will be more affected, whilst intumescent coatings will normally be sufficiently flexible. Intumescent coatings will not protect against a loss of insulation. Their activation temperature is generally greater than the limit on temperature rise (140 °C). The biggest problem is in preventing gaps opening up through which the fire might spread. Awareness and good detailing are probably the best ways to prevent this type of fire spread. Designers should be aware of the likely magnitude of any gaps. In some circumstances the use of intumescent mastic may be of use. Frequently compartment boundaries will be penetrated by pipe work or some form of duct. Maintenance of compartmentalisation will normally depend on the performance of a proprietary penetration seal for which there should be suitable test evidence and careful installation and regular inspection.

7.2.3.3 Thermally induced deformation Linear expansion Expansion is difficult to resist and a heated member can exert extremely large forces at its supports. Fully restrained steel will yield at a temperature below 200 ºC, the exact temperature dependent upon the grade of steel. A beam, designed to resist bending, has a relatively large axial resistance and, if restrained, may be affected at some distance from any source of heat. In building fires, damage to bracing members has been observed 40 m away from the fire.

Issue 1

May 2007

Page 265 of 493

FIRE AND EXPLOSION GUIDANCE Buckling Restrained members may buckle to relieve induced compression. For simply supported members this may not cause a problem but, for continuous members, bending resistance at supports may be lost. Buckled steel can cause problems on cooling as the buckling may not be reversed and the steel becomes shorter than its initial length. Connections may be pulled apart. Potentially the tensile force generated is equal to the yield resistance of the member. Failures have been observed in both bolted and welded connections and also in the section itself. Buckling can also occur in any member in compression, when the buckling resistance falls to the level of the applied or design load. The onset of this type of buckling may be exacerbated by axial restraint. However, often, if supporting structure is capable of exerting compressive restraint, then it is also capable of taking up load when a member starts to buckle. This is a complex mechanism which depends on the extent of a fire as well as the structural form. Thermal bowing Any section which is non-uniformly heated will tend to bow. For most sections the free bowing is a simple function of the temperature difference across the section. A 500 mm deep section, 12 m long, with a temperature difference of 300 ºC will bow by about 125 mm. A linear gradient will cause no stress in a steel member. A non-linear gradient will cause longitudinal shear stresses to be induced. In some types of partially protected steel beam, compression flanges can, in the early stages of a fire, go into tension. In a continuous member, thermal bowing will lead to very large induced restraining moments which are added to any existing moments (Figure 7.2). This can lead to failure of connections and buckling of compression flanges and webs. Deformation caused by thermal bowing can cause disruption of services and effect equipment performance.

Increase due to thermal bowing

Figure 7.2 - The effect of thermal bowing on the bending moment in a continuous beam.

7.2.3.4

Load induced phenomena

Bending Beams will generally withstand large deformations before they are unable to support their design load. In fire tests and actual fires deformations in excess of span/20 are common. Continuous beams may be more vulnerable because of the addition of thermally induced moments at their ends. This may make laterally torsional buckling of some cross sections more likely.

Issue 1

May 2007

Page 266 of 493

FIRE AND EXPLOSION GUIDANCE In many forms of construction, as deformations increase, tensile membrane action may become increasingly dominant. In plated construction, this will supplement the bending resistance and can sometimes carry all imposed loads. Often, if a beam supports a plated floor, the beam and plate can act together in fire, although not designed to do so. This can enhance strength and stiffness. Large deformations due to loss of bending stiffness will affect connections, as described above. Tension Tension members will lose strength in direct proportion to the loss of yield strength. Isolated tension members are rare in any structure so, as a tension member loses strength and lengthens under load, loads redistribution tend to occur. Elongation can be significant. At 550 ºC, a tension member carrying 50 % of its normal resistance will elongate by about 1.25 %. This Assumes a stress induced component of 0.5 % and a thermal expansion component of about 0.75 %. For a 6 m length this is 75 mm. Compression A member in compression will fail at a lower temperature (about 80 ºC lower than a bending member at the same load level). This is because the stiffness of carbon steel reduces at a faster rate than the strength. For most compression members, the applied stress in fire may be increased due to restrained thermal expansion, see above.

7.2.3.5

Brittle and ductile failure

Generally, in highly redundant structures, any mode of failure will be ductile as there will be redistribution of load. However, failures such as those caused by induced thermal stresses on welds and bolts will be brittle but may be followed by an immediate redistribution of load to other parts. The consequences of the failure of large elements in redundant structures need careful consideration. For example, Topsides with significant cantilevered decks, which support the TR at the extremity, are prone to progressive local collapse, especially where critical MSF deck braces are required to support the cantilever. Localised failure due to yielding under fire however will in most cases redistribute the gravity loads elsewhere to unaffected areas, except under extreme e.g. riser rupture type scenarios, thus, as damage and local failures accumulate, the final failure may be sudden as redistribution of load becomes impossible.

Issue 1

May 2007

Page 267 of 493


Examples of structures following fire

Figure 7.3 - Tensile membrane action in the web of a beam (Photo by permission of Corus plc, [7.6])

Shear capacity maintained by unsplit side of plate

Tensile force induced on cooling

Fractured end plate

Typical split in connection occurring on cooling Figure 7.4 Failure of a welded connection on cooling

(Photo by permission of BRE)

Issue 1

May 2007

Page 268 of 493


Escalation issues

The discussion of failure leads onto a major issue for the robust design of installations against major accident hazards. The failure of a component or part of a system may give rise to a cascading series of events leading to catastrophic failure or loss of life. A systematic, structured approach to escalation analysis should be adopted to determine if, how and when an event can escalate to endanger personnel. The escalation analysis should comprise:

•

The assessment of potential escalation paths from an initiating event towards a major accident hazard as defined in the Safety Case or towards a “safe” shutdown;

•

Identification of the mechanisms by which that initial event could escalate to impinge on key safety systems or facilities (such that the available safety systems can no longer function to slow or stop the escalation);

•

Evaluation of the probability of each escalation path and the time duration from the initial event.

•

Re-evaluation of the design to minimise damage to or failure of SCEs and produce an ALARP solution

Appropriate consideration should also be given to the actions of key personnel in responding to an incident, taking into account the effects of the hazard under review. In the case of fire, these effects would comprise heat, smoke other products of combustion, the impacts to be considered would be injury, burns, obscuration of vision and impaired breathing and judgement. The growing scale of the incident should be understood and the dynamic of the incident growth such that there were not unrealistic expectations of personnel performance, e.g. speed of running, ability to carry or assist injured colleagues etc. This assessment should include how operators have contributed to the detection of the fires (especially in the case of a Normally Unattended Installation) as well as how they respond. The speed and accuracy of detection will impact the potential escalation paths of the initiating incident and if additional detection information from operating personnel contributes to an accurate diagnosis of the event underway, this should be included in the emergency response assessment. In the UKCS, the requirement for defining Safety Critical Elements is included in Statutory Instrument 1996 No. 913 “The Offshore Installations and Wells (Design and Construction, etc.) Regulations 1996,” [7.7] where Safety Critical Elements means “such parts of an installation and such of its plant (including computer programmes), or any part thereof -

•

the failure of which could cause or contribute substantially to; or

•

a purpose of which is to prevent, or limit the effect of, a major accident.

Issue 1

May 2007

Page 269 of 493

FIRE AND EXPLOSION GUIDANCE It can be seen that equipment or devices that prevent, slow or stop the escalation are by definition safety critical elements. The discussions of acceptance criteria and failure should be linked to the review of methods of prevention (Section 3.2.6), detection and control (Section 3.2.7) and mitigation (Section 3.2.8). The consolidation if these issues will contribute to the definition of the Performance Standards (see Section 3.3) in the context of fire hazards and their management mechanisms. If a major fire occurs then safety of the occupants is the major priority. It is important to give occupants sufficient time, either to escape or to sit it out in the Temporary Refuge until the danger has passed. Depending on the location of a fire, any escape route must be adequately insulated to be tenable. Structurally, deformation leading to disruption of another system, or leading to an escape route or refuge becoming untenable must be considered to be failure. Deformation is controlled by design (computer simulation etc) and by the application of passive protection. For further details on impacts to human beings and therefore understanding the limits to escalation, see Section 7.8.

7.3 Acceptance criteria 7.3.1

General

Structures are designed for several limit states and what is acceptable for one limit state may not be acceptable for another. When considering collapse, deformation may not be considered, but when considering effects on Safety Critical Elements and disruption to production, deformation is clearly important. For fire hazards, acceptance criteria are set for any components tested in a standard fire resistance test. In addition, in critical areas more stringent requirements may be set by the safety authorities or specified by the client. The most straightforward criteria are the failure criteria specified in fire resistance test standards.

7.3.2

Criteria used in standard fire tests

Fire resistance test standards such as BS 476 [7.8], ISO 834 [7.9] or EN 1363 [7.10] use three failure criteria for structural elements They provide a means of quantifying the ability of an element to withstand exposure to high temperatures, by setting criteria by which the load bearing capacity, the fire containment (integrity) and thermal transmittance (insulation) functions can be evaluated. Linear structural elements such as beam only have to satisfy the load bearing criterion as they are do not form a barrier to the spread of a fire. Separating elements, which directly prevent the spread of fire, such as a bulkhead have to satisfy all three criteria. For buildings, as a consequence of European Harmonization, fire resistance is increasingly being expressed in terms of “resistance to collapse” (R), ”resistance to fire penetration (E) and “resistance to the transfer of excessive heat” (I), all of which are describe in more detail below. This terminology may be adopted for offshore structures in due course.

Issue 1

May 2007

Page 270 of 493

FIRE AND EXPLOSION GUIDANCE Resistance to collapse (R) is the ability to maintain load bearing capacity (which applies to load bearing elements only) or the ability not to collapse (non-load bearing elements only). The use of the term “resistance to collapse” can be applied to load bearing and non-load bearing elements and as such is preferred. For loaded beams and floors, failure is deemed to occur when the deflection reaches span / 20 or, when the deflection is greater than span / 20, the rate of deflection exceeds span2 / (9000D). D is the distance from the top of the element to the bottom of the design tension zone. All dimensions are in millimetres. As well as experiencing large deformations beams experience large strains. Tests and calculation have shown that strains in excess of 3 % are common in the bottom of an “I” - beam in a fire test. For steel beams, the application of any of the deformation criteria will have a small effect as the difference between the time to collapse and the time when any of the criteria might apply is small. Fire containment or the resistance to fire penetration (E) is the ability to maintain the integrity of the element against the penetration of flames and hot gases (this applies to fire-separating elements). Integrity failures should be rare in fire resistance tests for essentially steel elements. Problems are more likely to occur in actual fires at junctions between elements. Thermal transmittance refers to the resistance to the transfer of excessive heat (I) and is the ability to provide insulation from high temperatures (this applies to fire separating elements). An insulation failure is deemed to occur when the average temperature rise on the unexposed face of a separating element exceeds 140 ºC or the maximum temperature rise exceeds 180 ºC, whichever occurs first. These limits are to prevent combustion of any material which may be close to the unexposed face. Their origins are unknown and, in many cases, the limits may be excessively conservative. In a fire test an insulation failure will occur because the insulation is not adequate, or, it may occur because the insulation becomes detached, often called a “stickability” failure. Often tests on vertical separating elements are carried out on unloaded, unrestrained elements. Results from such tests must be interpreted with care and the systems tested must be carefully installed.

Table 7.4 - Performance requirements for elements of construction Component Load bearing beams and columns Load bearing floors, walls and partitions non load bearing separating floors, walls and partitions

Requirement R R,E,I E,I

Relationship between criteria used in standard fire tests and actual performance in real fires In the UK, fire tests are carried out on small elements. Beams generally have a span of 4.5 m and columns, which in any case are rarely tested, are 3.2 m high. Wall panels are tested at 3 m x 3 m. Elements in real structures are often many times the size tested or have no associated test evidence. Structurally, there will often be little to learn from a Standard Fire Test and designers must look elsewhere, at the limited evidence available from some large scale tests or rely on FE models. Even if the test is considered to be reasonable, any time measured in the test should not be thought as actual time in any real fire. Issue 1

May 2007

Page 271 of 493

FIRE AND EXPLOSION GUIDANCE In many cases, for a passive fire protection material, the results of fire resistance tests are all the information that is available. Designers must decide whether the heating regime in the test adequately represents the design scenario. If it is important to limit deformation then, interestingly, the “stickability” of the material and its ability to deform is less important than it would be for a case in which large deformations or strains are permitted. Fire resistance test results on passive fire protection tests in the cellulosic fire should be used with extreme care when considering performance in any hydrocarbon fire. A jet fire rating equivalent to an A or H rating has been proposed in the latest draft version of the ISO (22899-1) [7.5], (based on the jet fire test criteria proposed in ISO 13702 [7.11]) specified as: Type of application / Critical temperature rise (°C) / Type of fire / Period of resistance (minutes)

7.4 Methods of assessment 7.4.1

General

There are two possible approaches to carrying out structural analysis for the fire condition. Design codes such as BS 5950-8 [7.12] and EC3-1-2 [7.4] offer simple ways of checking elements. However, the codes were written for building structures and will not always be suitable for highly redundant offshore structures. Alternatively there are various types of finite element analysis available which are capable of analysing large substructures or even the whole structure. It is also possible to simply modify the existing “normal” or cold analysis by adopting elevated temperature material properties. In order to analyse any structure in fire a thermal model is required. For simple linear elements, all that is required is the temperature distribution across the section at the mid point. This may be computed using a 2-D thermal analysis. For more complex elements and whole structures, ideally, the complete temperature history of all parts of the structure is required although some simplification may be possible. In carrying out a thermal analysis, the modelling of proprietary fire protection is not straightforward. For fairly simple insulating materials, it should be possible to obtain a reasonable estimate of the thermal properties. Intumescent materials behave in a very complex manner, as they react differently in different situations. The local thickness of steel and the heating rate are important. When carrying out any analysis, it is necessary to establish the applied loads on the structure. BS5950-8 and EC3-1-2 allow loads to be reduced below the normal design values in fire as it is considered that the probability of fire and full design load occurring at the same time is rare. BS5950 is slightly more conservative than the Eurocodes. For an offshore structure, the partial factors should be agreed between all parties. It is also important to use appropriate mechanical material properties. BS5950-8 and EC3-1-2 effectively specify identical material properties for use in fire. However, BS5950 specifies different strain limits for different types of element and mode of behaviour, the elements referred to comprise composite structures not seen in the offshore industry (steel and concrete arrangements, see Sections 7.5.3 and 7.5.4 for more details).

7.4.2

Partial factors for fire

In determining the structural resistance required, the applied loads on the structure at the time of fire must be calculated. Both BS 5950-8 [7.12] and the Eurocodes allow reductions in some applied loads in fire reflecting the accidental limit state. These reductions, which are for Issue 1

May 2007

Page 272 of 493

FIRE AND EXPLOSION GUIDANCE buildings, are summarised in Table 7.5. For BS 5950-8, the reductions are expressed as factors, for the Eurocodes the reductions are expressed as Ψ1,1 factors. The use of Ψ1,1, rather than Ψ2,1, is expected to be recommended in the UK National Annex to EC1-1-2 [7.13]. In fire, the applied force or moment is given by: Gk + Ψ

fi

Qk ,1

where Gk is the characteristic value of a permanent action Qk,1

is the characteristic value of the leading variable action 1

Ψ fi

is the combination factor for fire situation, given either by (frequent value) or (quasi-permanent value) according to paragraph 4.3.1(2) of EN 1991-1-2 [7.13].

It is expected that, in the UK, the more conservative frequent value, Ψ 1,1, will be used for Ψ fi

Table 7.5 - Applied load reductions in fire BS 5950-8

Eurocode

γf

ψ1,1

Office

0.50

0.50

Escape stairs and lobbies

1.00

0.70

Other (including residential)

0.80

0.50

Storage

1.00

0.90

Snow

0.00

0.20

Wind

0.33

0.20

All

1.00

1.00

Type of load

Imposed

Permanent

Location/type

The values in the above table have been derived for buildings and may not be applicable to offshore structures. They are based on statistical evidence and are almost certainly conservative. It should be possible to derive similar information for offshore structures and subsequently eliminate possible costly over design. As an illustration of what might happen consider wind loading. The design case for wind might be for a once in 50 year’s gust. During a fire, a structure might be vulnerable for a few hours. For the same level of reliability, the wind load might be only 20 % of the 50 year level.

7.5

Methods in structural design codes

7.5.1

Introduction

Many countries have structural design codes for fire and shortly the Eurocodes will be finalised. Almost without exception, these codes are for building structures and may only be of limited use for offshore structures as building structures are generally much simpler than offshore structures with less interaction between different elements.

Issue 1

May 2007

Page 273 of 493

FIRE AND EXPLOSION GUIDANCE An important consideration when assessing structures or structural elements in fire is that, compared with cold, design, large deformations and strains are allowed. The strength of steel is normally expressed as the stress corresponding to 2 % strain, and deformation limits in fire resistance tests are about 20 times greater than might be allowed in cold design. The assessment methods can be used for beams and compression members. Little information is given for plated structures. It is normal to assume that members are unrestrained. Problems relating to expansion and restraint were discussed earlier.

7.5.2

Member analysis

In a member analysis, the applied loads are calculated using the appropriate partial load factors. The end reactions are generally calculated making the same assumptions that were made for the initial design. The effects of thermal restraint and any second order or P-delta effects are ignored. Only load carrying ability is considered so deformations are ignored. For compression members it is normal to consider the possibility that the degree of end-fixity may increase in fire leading to a reduction in effective length. Codes such as EC3-1-2, allow the effective length in fire to be 50 % of the system length, although, in the UK this may be conservatively limited to 70 %. The reduction is based on two factors. Firstly, in a building a column will be constructed as a continuous member and secondly, it can reasonably be expected that the temperature at the ends will not be as high as at the mid-height position. The method is useful for beams or columns which are not heavily restrained and for simple ties.

7.5.3

BS5950-8

BS5950-8 covers both non-composite construction and composite construction (steel acting with concrete). For non-composite all the guidance relates to beams, columns and tension members. It gives some guidance on unprotected steel but this is limited to 30 minutes fire resistance in the standard cellulosic fire and would not normally be applicable offshore. For beams it gives two methods of assessment. The load ratio – limiting temperature method is largely based on fire resistance test results and is principally for I - section beams. The load ratio is the ratio between the member resistance in fire and the normal, cold, member resistance. The code assumes that the strength of a beam can be characterised by the temperature of the bottom flange and that, in some circumstances, a colder top flange will be beneficial. However, a colder top flange is assumed to be supporting a concrete floor. No guidance is given for beams supporting steel plated floors. The second method is based on moment resistance. From knowledge of the temperature distribution across the section and the material properties at elevated temperatures, the plastic bending resistance may be computed. This method is useful for unusual sections but cannot be used without the temperature distribution. Where a comparison can be directly made, this method is slightly more conservative than the load ratio – limiting temperature method. For members in compression, the only method given is the load ratio – limiting temperature method and the information is, again, based on standard fire resistance test data. For compression members with comparatively low slenderness, there is a built in assumption that the column will have an effective length in fire of about 85 % of the assumed cold effective length. BS 5950-8 gives simple interaction formulae to allow the load ratio to be calculated for both beams and columns. Issue 1

May 2007

Page 274 of 493

FIRE AND EXPLOSION GUIDANCE A method for checking concrete filled structural hollow sections is given. However, the method given EC4-1-2 is more robust and is recommended. In a useful annex, BS 5950-8 gives guidance on re-use of steel following a fire and what one should look for when inspecting a building.

7.5.4

EC3-1-2

EC3-1-2 is for non-composite construction only. EC4-1-2 deals with composite construction. For use in the UK (for buildings) both codes will have a national annex. All Eurocodes contain some nationally determined parameters. They also contain some informative annexes. For any country, the National Annex will give values for the nationally determined parameters and guidance on the use of informative annexes. The structural Eurocodes are all written in the same format. The design methods start with tabular data. This is followed by simple design methods and finally there is some guidance on advanced methods. EC3-1-2, however, has no tabular data as the only useful data would be on the protection of steels using proprietary fire protection materials. The bulk of the design information is in the form of simple calculation methods. It concludes with some guidance on advanced methods. The term “simple” is sometimes a misnomer, as a small program or spreadsheet is required. For beams in buildings, EC3 is generally less conservative than BS 5950-8. However, for beams not supporting concrete floors it is very similar to BS 5950 8. EC3 starts from the assumption that beams are uniformly heated. Their bending resistance is reduced by the reduction in yield strength. It then allows an “adaptation” factor to be applied that may take into account of a temperature gradient and, for a continuous beam, colder support conditions. For compression members, EC3 gives a simple method in which a non-dimensional slenderness is calculated which leads to a reduction in the squash resistances. The method is a modified form of all other Eurocode strut formula. EC3-1-2 gives some guidance on members made from sheet steel with class 4 cross-sections. These thin sections rapidly heat up and quickly lose strength. The guidance is for completeness and academic interest. The strength of bolts and welds at elevated temperatures was given earlier in Table 7.2, EC3-1-2 gives some guidance on checking connections in fire. For example, for a bolt, EC3 states:

Fv ,t ,Rd = Fv,Rd kb,θ

γM2 γ M , fi

Where;

kb, θ

is the reduction factor determined for the appropriate bolt temperature from Table 7.2.

Fv,Rd

is the design shear resistance of the bolt per shear plane calculated assuming that the shear plane passes through the threads of the bolt

γM2 is the partial safety factor at normal temperature γM,fi is the partial safety factor for fire conditions Issue 1

May 2007

Page 275 of 493

FIRE AND EXPLOSION GUIDANCE The important point to make is that although the reduction factor from Table 7.2 is lower than for structural steel, the partial factor at normal temperature, γM2, is 1.25 and the factor for fire, γM,fi, is 1.0. Thus the effect of the reduction factors is somewhat ameliorated. Guidance is also given on advanced calculation methods. In this context, this refers to finite element modelling. It states that the model for mechanical response shall take account of:

•

The combined effects of mechanical actions, geometrical imperfections and thermal actions;

•

The temperature dependent mechanical properties of the material;

•

Geometrical non-linear effects;

•

The effects of non-linear material properties, including the unfavourable effects of loading and unloading on the structural stiffness.

EC3-1-2 and EC4-1-2 have their roots in the ECCS Model Code on fire engineering [7.14]. This code also includes information on fires, covered by EC1-1-2. It also contains a commentary on many of the clauses. In due course, conflicting national standards will be withdrawn. At the time of writing, the loading code, EC1-1-2 was published at a full European standard in 2002. EC3-1-2 and EC4-1-2 are undergoing final editing and should be available during 2005. For all three codes, the UK National Annexes are expected in 2007.

7.5.5

Finite element modelling

7.5.5.1 General The use of Finite Element (FE) modelling is now becoming the norm. Packages exist which can carry out both thermal and structural modelling, incorporating Computational Fluid Dynamics (CFD), which will allow the growth and spread of fire to be modelled. Finite element models can range from frame models with simple linear elements to complex models utilising a number of element types, some of these applications are discussed in the following sections. In all examples and applications, the FE package being used should have been validated against test data and the engineers using the package should be trained and preferably experienced in the types of analysis being undertaken.

7.5.5.2

Frame models

Trusses comprising slender members or portal-like structures can be analysed as simple frames, however the analysis should be non-linear and capable of dealing with large displacements. Ideally the models should be 3D as 2D will not pick up some buckling modes.

7.5.5.3

Complex models

Complex finite element models should give the best prediction of structural performance. However, any model is only as good as its input data. There is little point carrying out an expensive FE analyses unless the thermal history is known with a degree of confidence and the design scenarios assumed are reasonable. Issue 1

May 2007

Page 276 of 493


Modified “cold” model

It is sometimes reasonable to use the same structural model as was used for the normal, cold design in fire. Applied loads are appropriately factored and elevated temperature values for yield stress and Young’s modulus are used. For a structure, or parts of the structure, which are not highly restrained or which are not highly redundant the method may give reasonable answers but it is impossible to say whether the results from such an analysis will be conservative or not.

7.5.5.5 Structural modelling Prior to any FE analysis being carried out the conceptual model of the structure should be carefully checked and possibly agreed with any potential certification authority. Consideration should be given to the need to include initial imperfections and whether a dynamic option should be included in the analysis. It is important that any analysis includes all non-linear effects and that it can model membrane action. The sensitivity of any analysis to the mesh density should be investigated (although not necessarily for each job). Experience has shown that FE analyses of the same fire and structural scenario using the same software, carried out by more than one group, can produce widely different results. The differences are often due to differences in the conceptual model. The assumptions regarding boundary conditions must be justified. If a substructure is being analysed, the boundary condition assumptions regarding restraint thermal expansion can greatly affect results. Also, at junction between two elements is there a load path and should adjacent nodes be connected and in what way? Is the mesh sufficiently fine? Is the analysis being carried out by an experienced engineer? These are all very important considerations which must be addressed if the results are to be trusted. In some areas it may be possible to carry out some preliminary “scoping” analyses to get some idea what answers might be expected from the FE. Following any analysis, the results should be carefully examined and anything that looks unusual should be investigated. It may be correct or it may be due to an error in the conceptual model. Compared with an elemental approach, any FE approach based on the same temperature distribution should give more reliable results. However, many FE models will not properly predict localised behaviour such as connection failure due to the need to refine the mesh density, unless the analyst is aware of the possibility of such failure and has made an allowance for it in the model. The main problems in any FE modelling start with the fire. In order to get a reliable estimate of structural behaviour a reliable fire model is required. Often, designers will impose the Standard Fire (hydrocarbon, cellulosic etc) on the structure. This may meet any regulatory requirements but it can never model reality. In any real fire scenario, the heat flux impinging the structure will be different from place to place and will vary in time. Imposing the Standard Fire will not allow effects due to temperature differences to be modelled.

7.5.5.6 CFD Computational fluid dynamics can potentially predict the growth and movement of air, smoke, and flame. CFD is probably more complex than structural mechanics and although, researchers have been working on CFD for many years it is still in its infancy. In building design, it is used to predict smoke movement but many think it is not particularly good at predicting pre-flashover fires. This should be less of a concern for any form of hydrocarbon fire as the pre-flashover phase will be less significant.

Issue 1

May 2007

Page 277 of 493

FIRE AND EXPLOSION GUIDANCE At present, the above cautionary advice for structural modelling, applies even more to CFD modelling. Knowledge of fire and an understanding of what a particular package is doing are paramount.

7.5.5.7 Eurocode requirements for advanced models The structural Eurocodes all contain similar advice on using advanced models. The relevant parts are summarised below: The analysis should include:

•

The effects of non-linear material properties, including the effects of unloading on the structural stiffness and the effects of cooling;

•

Validation of advanced calculation models;

•

The validity of any advanced calculation model shall be verified;

•

A verification of the calculation results shall be made on basis of relevant test results;

•

The critical parameters shall be checked, by means of a sensitivity analysis, to ensure that the model complies with sound engineering principles.

Some of these requirements may appear to be very severe. It is recommended that they need not be followed for every structure analysed but they do emphasise the need to use validated software. Definition and assessment of secondary steelwork In deciding which structural members need to have their performance checked in fire the required performance for the structure for each particular limit state must be considered. All primary elements of structure will need to be assessed and will probably require some form of fire protection. A secondary member is one which, for the particular fire limit being considered, will not cause failure of a primary member or loss of compartmentalisation by its removal. All secondary members require assessment but may not require protection. For example, a secondary beam, spanning between larger primary beams and supporting a plated floor may be sacrificial in fire. For the fire scenario under consideration, deformation of the floor may be unimportant. A steel plated floor system will often be able to act as a membrane and not require additional support. The beam may not be critical for giving restraint to the primary beam. However, in a severe fire heat may be conducted along an unprotected beam into the primary beam and thus reduce the fire resistance of the primary beam. For practical reasons it might be better to protect the entire secondary beam rather than simple coating the ends. Secondary members, which when cold, restrain a primary member may require fire protection to continue fulfilling this function when hot. However, experience has shown that at the reduced applied loads in fire, the restraint may not be necessary. For example, loads may be resisted by membrane action and the restraint may not be required. It is important to consider that it does not follow that a member which carries load will always be required in fire. The function of all members should be looked at. Only members which may fail or deform in fire leading to a performance requirement not being met should be considered for protection. Simple design methods are not able to provide information on whether secondary members require special consideration. Only a full non-linear FE analysis will provide this information. Issue 1

May 2007

Page 278 of 493

FIRE AND EXPLOSION GUIDANCE 7.6 Attachments and coat-back An unprotected secondary member attached to a protected primary member will allow heat to be conducted into the primary member and may reduce its fire resistance. Most operators’ specifications require a length of any attachment to primary steelwork protected with passive fire protection to be similarly protected. The attachment acts as a heat conductor into the primary steelwork. Hence, it can introduce a localised hot spot at its connection with the primary member. The extent of the hot spot depends on the relative geometries of the primary member and the attachment. The purpose of the coat-back is to reduce heat conducted through the attachment into the primary member and hence limit the extent and severity of the local hot spot. In this way, the potential of premature failure can be avoided. The coat-back length needs to be adequate to achieve this objective. A joint industry study [7.15] of the effects of coat-back on the primary member temperature demonstrated the following:

•

The required coat back length should be determined based on the local average temperature which can be tolerated in the primary member at the attachment location. As the coat-back temperature increases this temperature reduces. However, beyond 150 mm, any further reduction is small.

•

The ratio of the cross sectional area of the attachment to that of the primary member was found to have a significant influence on the temperature. The ratio of the section factors (Hp/A) has secondary significance.

•

The effect of the attachment on the temperature increased with increasing fire resistance period. Thus, to maintain the same temperature in the primary member a longer coat-back length would be required for a 2 hour duration than for 1 hour.

•

Within the limits of the study, it was found that the section shape (of both the primary member and attachment) had negligible effect.

•

The properties of fire protection material have a small effect on coat-back length.

7.7 Process responses 7.7.1

General

A key requirement for any design is knowledge of the quantity, composition and properties of the fluids to be processed and of the associated operating conditions (temperature, pressure, flow rate etc.). The section is primarily concerned with the response of pressurised systems to fire. In a fire, a pressurised system (e.g. vessel, pipeline or heat exchanger) will fail through weakening of the containment material with temperature and time and/or over-pressurisation caused by heating up the fluid contents. Generally, offshore systems are fitted with pressure relief systems to prevent over-pressurisation and blowdown systems to prevent loss of containment.

Issue 1

May 2007

Page 279 of 493

FIRE AND EXPLOSION GUIDANCE Relief systems automatically release the contained fluid if the fluid pressure within the system exceeds the system’s lowest design pressure. These systems usually consist of relief valves or bursting discs and they are designed to initiate at the set pressure without the intervention of the operator. Blowdown systems are mechanisms for release of the vapour content from the system as a result of operator action or as part of automatic control sequences. A system is normally blown down as part of a planned shutdown or an emergency such as confirmed fire that may weaken a plant component which would otherwise fail at an operating pressure below the relief system set pressure. In both relief and blowdown systems, it is necessary to dispose of the fluid safely, usually by burning it in a flare stack or venting to atmosphere. There are numerous references that discuss relief devices and relief sizing; examples are Parry (1992) [7.16], DIERS (1992) [7.17], CCPS (1998) [7.18] and the Energy Institute (2001) [7.19]. Roberts et al. (2000) [7.20] have reviewed the literature available (up to 2000) on the response of pressurised process vessels and equipment to fire attack in regard to the new data available since publication of the IGNs [7.21] and the remaining gaps in knowledge.

7.7.2

Relief

Traditionally, API 520 (2000) [7.22] has been used to size pressure relief valves for nonreactive systems using heat inputs derived from the fourth edition of ISO 23251:2006 [7.23]. These heat inputs have not been changed in the fifth edition of ISO 23251:2006 although it is now recognised (e.g. Energy Institute, 2003) [7.24] that more severe fires can occur than those assumed by API. It should be recognised that pressure relief will not protect a vessel or pipeline from failure if there is a high heat load to wall in contact with gas or vapour is this will rapidly heat up to a temperature where the steel weakens. However, if the vessel/pipeline can be prevented from failure due to weakening, e.g. by PFP (or deluge although it is not currently taken into account), then the pressure relief valve can be effective under fire loading providing that the possibility of two-phase flow is adequately considered. There are a considerable number of standards for relief valve sizing e.g. API 520, NFPA 30 [7.25] and NFPA 58 [7.26] (for LPG) and ISO 4126 [7.27]. These were reviewed by the Energy Institute (2001) [7.19] and recommendations are made, based on experimental data, for the safe and optimum design of relief systems. Their publication also goes into detail on which is the most appropriate relief device for the different situations. In particular, they consider the advantages and disadvantages of using:

•

Conventional spring-loaded relief valves;

•

Balanced relief valves;

•

Air assisted relief valves;

•

Buckling pin valves;

•

Bursting discs; and

•

High integrity pressure protection systems.

They provide advice on relief system design, sizing of relief system systems and design of flare and vent systems. In general, the recommendations complement those of API 520 and ISO 23251:2006 but, in the specific case of two-phase discharge, they suggest that the API method may not be adequate, particularly in the case of high-pressure discharge. This conclusion is based on experiments involving the two-phase discharge of mixtures of natural gas, propane and condensate through orifices and relief valves.

Issue 1

May 2007

Page 280 of 493


Relief sizing

The method of relief sizing depends on the nature of the fluid being relieved. API 520 (Part 1) and ISO 23251:2006 give equations to calculate the discharge areas for pressure relief devices on vessels containing super-critical fluids, gases or vapours and for non-flashing liquids. The Energy Institute (2001) have reviewed these equations and suggest that they give similar results to BS 6759 [7.28] and ISO 4126 [7.27] and hence any of these standards may be used. On the basis of comparisons with experimental data, the Energy Institute (2001) suggests that the homogeneous equilibrium model (HEM) gives the best predictions for two-phase relief flows and is preferred to the API method. They suggest that the HEM method deals naturally with cases where the flow upstream is gaseous and where condensate is formed. These cases may not be calculated accurately with the API method. Since both the API method and the pure HEM method involve flash calculations, they consider that there is little benefit from the simplification represented by the API method. The Energy Institute gives details of application of the HEM method. Whilst the HEM method for two-phase relief has been validated by tests, there is still no recognised procedure for certifying the capacity of pressure relief valves in two-phase service.

7.7.4

Blowdown

The emergency depressurisation of process vessels is complex and the behaviour of the process vessel during depressurisation varies depending on the vessel contents and the conditions of the vessel. During depressurisation at ambient temperature, the temperature of the vessel may drop dramatically as the contents are released, leading to the need to consider the minimum design temperature requirements of the vessel. At the same time, however, if the vessel is exposed to an engulfing fire, the behaviour of the vessel will be very different and the pressures and temperatures experienced will significantly differ from those normally considered. The design of depressurisation systems must therefore address both the depressurisation and also the characteristics of any impinging flame, which may be the cause of the emergency depressurisation. The Energy Institute (2003) [7.24] performed a survey of methods used by industry for protection against severe fires and, from the responses and information received, concluded that:

•

There is little consistency in the design methodology used, even within a single company;

•

Some said they had limited in-house expertise and engaged a specialist design contractor; and

•

Some applied API RP 521 (1997) and assumed that by designing to that code, the risk was adequately addressed.

The revised version of API RP 521(2005) recommends that a vapour depressurising system should have adequate capacity to permit reduction of the vessel stress to a level at which stress rupture is not of immediate concern. For sizing, this generally involves reducing the equipment pressure from initial conditions to a level equivalent to 50 % of the vessel design pressure within approximately 15 minutes. This criterion is based on the vessel wall temperature versus stress to rupture and applies generally to carbon steel vessels with a wall thickness of 25 mm or more.

Issue 1

May 2007

Page 281 of 493

FIRE AND EXPLOSION GUIDANCE Vessels with thinner walls generally require a somewhat greater depressurising rate. It should be noted the blowdown systems are designed for vapour only flow. If the rate of depressurising is increased, there is an increased likelihood of two-phase flow occurring with consequences to the method of sizing calculation used and the need for the knockout pot in the flare header to be sized for this two-phase flow. The required depressurising rate depends on the metallurgy of the vessel, the thickness and initial temperature of the vessel wall, and the rate of heat input. For multi-component fluids, these need to be calculated over a series of time intervals that adequately take into account changes in the nature of the fluid, e.g. the latent heat of vaporisation. The recommendations in ISO 23251:2006 are typical for conditions in a refinery or chemical plant. However, they are not intended to cover all fire scenarios, e.g. impinging jet fires or confined fires, foreseeable for offshore installations. Gayton and Murphy (1995) [7.29] suggest that in more severe fires, rupture can occur well within the 15 minute criterion used by API. Roberts et al. (2000) [7.20] discuss applications of the Shell BLOWFIRE program to give vessel wall temperature-time relationships as input to the ANSYS finite element program predicting thermal mechanical response of a second stage separator with a wall thickness from 16 to 20 mm. The BLOWFIRE predictions were that after an initial pressure drop on opening, the pressure could then increase and the ANSYS programme suggested that failure could occur at 6 minutes. It was suggested that the worst case might be partial fire engulfment where local heating of the shell causes local material expansion and the expanding material pushes against colder, unheated sections, leading to premature buckling and an increased probability of failure. The general implication is that process plant fitted with protective systems designed to API RP 521 or a similar standard may be insufficient to prevent failure of the pressure system before the inventory has been safely removed in a severe fire.

7.7.5

Blowdown system design

As indicated above, the ISO 23251:2006 approach to the design of blowdown systems covers most of the key aspects but may underestimate the heat load in some credible offshore fire scenarios and may not be accurate if there is two-phase flow. The Energy Institute [7.19] recommend that the Gayton and Murphy [7.29] “fire risk analysis” approach is adopted at least to confirm the expected thermal loads and that the HEM method is used if two-phase flow is anticipated. The Energy Institute summarised the Gayton and Murphy approach.

Issue 1

•

For each item of equipment, define the type of fire (pool, jet, partial or total engulfment) likely to affect it.

•

Calculate the rate of heat input appropriate to that type of fire.

•

Calculate the rate of temperature rise of the vessel wall neglecting heat transfer to the contents. This simplification is appropriate for jet or other fires, which might affect only a small area of the vessel. More complex methods can allow for heat transfer to the contents.

•

Estimate the time to vessel rupture. From this temperature-time profile prepare a yield –stress-time profile and a corresponding rupture pressure-time profile. Compare this to the actual pressure vessel versus time for the required blowdown time.

•

If the time to rupture does not meet the established safety criteria (such as time to evacuate), then design changes may be necessary to improve the vessel protection. These may be a reduction in blowdown time, or application of fire protection insulation, or changes to the plant layout to reduce the fire exposure. May 2007

Page 282 of 493

FIRE AND EXPLOSION GUIDANCE The information given in this Guidance allows the simplified vessel wall approach to heat transfer to be followed but, if heat transfer to the contents is taken into account, sophisticated modelling is required. However, whilst there are validated models for blowdown under ambient conditions (e.g. the BLOWDOWN model), there appear to be no experimental data on blowdown under fire loading and hence there are no validated models. However, LPG tank pool fire (Moodie et al., 1998 [7.30]) and jet fire data (Roberts and Beckett, 1996) [7.31] has been used to partially validate models, e.g. BLOWFIRE, that are designed to cover a range of discharge devices i.e. the models have been used to predict the pressure relief results. API [7.23] and the Energy Institute [7.19] give the equations for calculating the blow down orifice. In 2003, the Energy Institute published their interim guidelines for the design and protection of pressure systems to withstand severe fires [7.24]. In this publication, the heat transfer to the vessel is split in terms of radiative and convective fractions and the heat transfer to the vessel contents is discussed in a similar way (see Section 5.5). They give an iterative procedure based on calculating, for each process segment (isolatable section) and each time step:

•

Pressure;

•

Temperature in all fluid phases;

•

Fluid composition in each phase;

•

Flow rate through the orifice;

•

Liquid levels;

•

Temperature in the metal;

•

Temperature downstream of the orifice;

•

Heat transfer at all interfaces; and

•

Stresses to which the pipes and equipment are exposed.

These are related to the:

•

Acceptance criteria for failure;

•

Given total capacity of the flare system;

•

Method for initiating depressurisation (manual or automatic); and

•

Time delay for initiation of depressurisation.

The Energy Institute approach is based on that of Hekkelstrand and Skulstad (2004) [7.32]. They have refined their approach with the emphasis on using fast depressurisation making the maximum use of the flare stack capacity and on minimising the use of passive fire protection.

7.7.6

Failure criteria

In order to know what measures to take, if any, in protecting an object against fire, it is necessary to know the maximum acceptable temperature of the object and the minimum allowable time to reach this temperature. Different references suggest different critical temperatures. Some of those in most common use are summarised in Table 7.6. Issue 1

May 2007

Page 283 of 493

FIRE AND EXPLOSION GUIDANCE Table 7.6 - Commonly used critical temperatures Temperature (Celsius) 550 - 620

Use Structural steel onshore

427

LPG tanks (France and Italy)

400

Structural steel offshore

300

Source

Criteria

ASFP, 2002 (BS 5950)

Temperature at which fully stressed carbon steel loses its design margin of safety

ISO 23251:2006 (1997)

Based on the pressure relief valve setting

ISO 13702, 1999

Temperature at which the yield stress is reduced to the minimum allowable strength under operating loading conditions

LPG tanks (UK and Germany)

LPGA CoP 1, 1998

Integrity of LPG vessel is not compromised at temperatures up to 300 ºC for 90 minutes.

200

Structural aluminium offshore

ISO 13702, 1999

Temperature at which the yield stress is reduced to the minimum allowable strength under operating loading conditions

180

Unexposed face of a division

ISO 834 BS 476

Maximum allowable temperature at only one point of the unexposed face in a furnace test

140

Unexposed face of a division

ISO 834 BS 476

Maximum allowable average temperature of the unexposed face in a furnace test

45

Human skin

40

Surface of safety related control panel

Hymes et al., 1997 ISO 13702

Pain threshold Maximum temperature at which control system will continue to function

Failure of a steel component will occur at the time at which the superimposed stress exceeds the material strength and/or deformation limit. Knowledge of the time to failure is critical in deciding on the remedial methods to be applied to delay failure. The time to failure of a vessel or pipe work depends on the severity of the fire, the extent and type of fire protection, and the pressure response and can vary between a few minutes and a few hours. The Energy Institute (2003) [7.24], considered three calculation methods:

•

Ultimate Tensile Stress (UTS) with a safety factor;

•

Flow stress (combining UTS and elongation stress); or

•

Creep rupture stress (where both temperature and time are taken into account).

In theory, the most appropriate failure criterion is the creep rupture strength, rather than the tensile strength since, as the time to rupture goes to zero; the creep rupture strength becomes equal to the tensile strength. However, in view of the complexity of creep rupture calculations (see, for example, Benham et al., 1996 [7.33]), tensile failure criteria are often used. In severe fires, the rate of temperature rise in the wall above the liquid level or in a gas/vapour only system is very high (of the order of 100 to 200 K min-1 depending on the steel thickness) and the material strength falls rapidly once the temperature exceeds 500 °C. In these circumstances, where the time involved is very short, the use of UTS may be acceptable if used with an appropriate safety factor.

Issue 1

May 2007

Page 284 of 493

FIRE AND EXPLOSION GUIDANCE However, BS 7910 (1999) [7.34] suggests that the proximity to plastic collapse should be assessed by determining the ratio of the applied stress to the flow stress, where the flow stress is defined as the average of the yield and tensile stresses. Use of a flow stress of the average of, say, the 0.2 % elongation stress and the UTS would be a more conservative measure. However, if the rate of temperature rise is much slower, e.g. with a system protected by PFP, it is more appropriate to use the creep rupture stress. No consensus was reached within the Energy Institute working group on which method of assessing stress is the most appropriate for response to severe fires. It was stated that the ambiguity remains because of the lack of validation data. Offshore vessels tend to be of a more complex design than storage vessels and will have stress raisers such as:

•

Different thicknesses of material;

•

Inlet and outlet connections with constraining piping, manways etc;

•

Different types of weld materials and configurations;

•

Reaction forces during emergency depressurisation;

•

Vapour-liquid interface.

The Energy Institute states that it is not clear which of these features are critical in assessing failure or to what degree, if any, current failure criteria are conservative. Experiments are required to assist in the validation of models intended to assess such features. Unless the failure criteria are properly set, it is difficult to see how time to failure or realistic blowdown rates can be properly set. Data from jet fire trials (170 – 190 kW m-2 incident heat flux) on pipes pressurised with nitrogen to 85 to 90 % of their design pressure endeavoured to take the pipes to failure and determine Equation 5-7 (see their failure criteria. The modelling of the heat transfer to the pipe used Section 5.3.2) and found good agreement with the measured values for small pipes but found that the model overestimated the temperatures above 600 ºC for 250 mm pipes. It was found that pipe failure was adequately predicted by comparing the equivalent stress (von Mises) with the UTS. However, it was noted that the pipe corrosion allowance should not be used when making the calculations and that good high temperature UTS data was needed. Hekkelstrand and Skulstad (2004) [7.32] have incorporated these results in the latest edition of their guidelines. They imply that the method may be applicable to pressure vessels containing vapour and liquid but the complexities identified above are not explicitly considered. They also provide data on the high temperature properties of steels. Data are also available from Burgan (2001) [7.35] and Billingham et al. (2003) [7.36]. Following reviews undertaken by SCI, non-linear finite element analysis permits the rupture calculations of a piping system to be based on more accurate methods which accounts for the reserve strength inherent in many design codes. It also overcomes the approximations that have been identified with the use of simplified methods.

7.7.6.1

Design accidental loads

Design Accidental Loads (DAL) are loads for those accidental events where the associated risks exceed the risk tolerability criteria. Therefore, the designed facility should successfully resist the DAL. This would require a lengthy iterative approach whereby a QRA is carried out first to identify those events and loads that cause the exceedance of risk tolerability criteria. Therefore, an approximate approach has been used which defines DAL as being associated with those events that have the order of magnitude of initiating frequency greater or equal to the tolerable outcome frequency. For example, when the tolerable outcome frequency is 5 x 10-4, the DAL are those loads with the initiating event frequency of 10-4 and higher. Issue 1

May 2007

Page 285 of 493

FIRE AND EXPLOSION GUIDANCE The requirements for successful resistance of a facility to DAL are expressed in the form of performance standards. Typically, the performance standard would state that a pressure vessel should survive and remain functional during a postulated fire scenario. Again, in the terms of engineering acceptance criteria this means that applied stress in the vessel is not to exceed a defined allowable stress throughout the duration of a fire and thereafter.

7.7.6.2

Link between engineering acceptance criteria and QRA

As implied by the above, the link between engineering acceptance criteria related to pressure systems and QRA may be made using the following approach:

•

Rule sets in a QRA are set to reflect the standards to which safety critical systems are to perform, e.g. no escalation of the initial fire event in an area.

•

This rule set assumes that isolation and depressurising systems, and a dedicated deluge cooling system are functional, available on demand and survive the initial fire (performance standards).

•

The systems are designed to meet the normal engineering acceptance criteria for stress, deformation, temperature etc.

•

DALs are determined for the systems whose risk, calculated by QRA, exceeds the risk based performance standards.

•

The pressure systems are redesigned to resist the DALs.

Before formal industry guidance could be given on such links, guidance is needed on the rule sets to use in QRA, the determination of DALs and appropriate engineering acceptance criteria.

7.8 Personnel 7.8.1

General

Fires have the potential to cause severe harm and death to personnel offshore as a result of the evolution of both heat and toxic combustion products. This potential is present both in the immediate vicinity of the fire but also through transport of hot products at remote locations through the action of buoyancy and wind. Inhalation of toxic and irritant smoke is the largest single cause of fatalities in both onshore and offshore fires. The objective of any system to mitigate the effects of fire on personnel must be to remove the fire hazard either through fire extinguishment, reduction of the received insult or separation of personnel and fire hazard. This section outlines the main issues to be considered in defining and quantifying the fire hazard effects on personnel offshore and what preventive measures may be available to a designer to minimize this hazard.

Issue 1

May 2007

Page 286 of 493


Characteristics of fires relevant to human response

7.8.2.1

Hazards of fire to personnel

The fires which can occur offshore are many and varied. The major concern lies with the process fluids themselves. These can give rise to fireballs, vapour cloud, jet, or pool fires. However, other fuels are present on the plant such as plastics, hydraulic fluids, cabling, seals, paints, etc. These may become involved in the later stages of a process fluid fire or be the main fuel consumed. General fires, not specific to the chemical process industry or offshore, involving the structure and contents in the accommodation, control rooms and other occupied buildings on the installation must also be considered. All these fires produce heat in the form of radiant and convective fluxes. In particular exposure to high radiant heat fluxes can produce severe burns to the skin and even ignite clothing. Smoke is also produced. Here smoke is taken to comprise the airborne solid and liquid particulates and gases evolved when a material undergoes pyrolysis or combustion together with the quantity of air entrained or otherwise mixed into the mass. Smoke contains a complex mixture of:

•

Asphyxiant gases such as carbon monoxide and hydrogen cyanide which can cause partial/full incapacitation and death.

•

Irritant products (gases and aerosol) which at low and medium exposures cause partial incapacitation thus hindering evacuation, while at high exposures may lead to delayed death. The main irritants are acid gases for example hydrogen chloride and low molecular weight aldehydes such as acrolein and formaldehyde. These materials attack the eyes and respiratory tract.

•

Particulates sometimes referred to as soot. These particulates may be either non-irritant or irritant. In the former case vision is obscured making way finding difficult, while the latter, as well as impairing vision, can also again act as an irritant to the eyes and respiratory system. Both make evacuation from the scene of the fire more difficult.

The combustion product plume will also be at elevated temperature. Movement beneath or within a smoke layer may result in exposure both to radiant and convective heat fluxes. Such exposure may give rise to hyperthermia and skin burns while inhalation of hot products may result in burns to the respiratory system. Finally the lack of oxygen in the fire plume may induce a condition known as hypoxia. This can cause dizziness and ultimately loss of consciousness. Movement of a smoke plume around the installation under the combined influence of the wind and inherent buoyancy must also be considered since its influence may extend beyond the immediate vicinity of the fire. The potential for smoke movement must always be considered; particularly when the identification and design of escape routes and muster points is undertaken. This is a difficult area which can only be approached using models based on computational fluid dynamics or physical modelling. Experience with the applications of both these techniques to smoke movement remains however very sparse and the conclusions should be treated with caution.

Issue 1

May 2007

Page 287 of 493

FIRE AND EXPLOSION GUIDANCE 7.8.2.2 Specification of fire hazards The heat hazards from a fire are expressed in terms of heat flux and temperature. Thus the dimensions, shape and surface emissive power of the flame can be used to compute a received radiant heat fIux generally in kW m-2 to personnel in the vicinity. The temperature and emissivity of the combustion gases allows specification the thermal environment to which personnel might be exposed if they must enter the fire plume. In general the production of toxic and irritant species in a fire is expressed as a yield - the amount generated per unit mass of fuel burned. This product is then mixed with air entrained into the fire plume and the hazard of asphyxiant and irritant gases and liquid irritants is expressed as a concentration in air, either in volume or mass terms as ppm or mg l-1 respectively. There does not appear to be a standard form for specifying the smoke hazard. Several may be encountered. It can again be quantified as a mass concentration of product in the fire plume or alternatively in terms more closely related to the hazard presented by smoke - a loss of visual capability. Some parameters used include visibility – the distance in metres at which unilluminated objects can be seen through smoke, an obscuration (%) – the amount of attenuation of light over a given path, or an optical density. The latter is alternatively defined in terms of either natural (De) or common (D10) logarithms: De = -loge(I/I0) = KCL ................................................................... Equation 7-1 D10 = -10log10(I/I0) = (10/2.303) KCL ........................................... Equation 7-2

Where I and I0

are the light intensities with and without smoke,

C is the mass concentration of particles, K is the specific extinction coefficient, and L is the path length through the smoke. K is a property of the type of smoke and depends on its size distribution and optical properties. There are limited data available though some measurements for flaming and non-flaming fires involving plastics suggest figures of 7.6 and 4.4 m2 g-1. The product of K and C is known as the extinction coefficient and has dimensions of m-1.

It has been shown that the optical density expressed as a unit path length (D10/L (dB m-1)) correlates reasonably well with general visibility through smoke with an optical density of 1 dB m-1 corresponding to a visibility of ~10 m. Smoke production is often specified in terms of the volume in m3 s-1 of unit optical density smoke issuing from a fire. A further smoke measure often quoted is the mass optical density, Dm. This is more easily measured in experimental tests and is related to the optical density measured in a volume flow of combustion products V, resulting from a mass loss of smoke producing material ΔM: Dm = D10 V / 10 L ΔM ................................................................... Equation 7-3

Issue 1

May 2007

Page 288 of 493

FIRE AND EXPLOSION GUIDANCE 7.8.2.3 Typical hazard levels offshore Two distinct types of fire are likely to occur offshore. The majority will result from releases of process fluids and involve flammable liquids and gases. These will be characterized by an absence of growth and decay phases so that they will reach their full potential output soon after ignition but most will occur in well-ventilated open conditions. Hence the general levels of toxic species and smoke production will be low. Indeed some fires, for example methanol and natural gas will produce little if any smoke. The major hazards from these fires will result from the high heat fluxes generated. The exceptions to such a rule are large pool fires involving the heavy hydrocarbons such as crude oil, which may produce copious quantities of dense smoke and the situation of significant confinement which restricts ventilation. In these circumstances (vitiated fires), the lack of oxygen in the combustion zone leads to an increase of incomplete products of combustion including carbon monoxide and smoke. It has been noted that the levels of species production for under-ventilated confined fires can be parameterized in terms of the equivalence ratio, defined as the fuel air ratio relative to stoichiometric conditions and data have been presented which suggest that for solid phase fires the rates of production of incomplete products may increase by factors of ~5-10 over the well-ventilated situation. Experimental measurements have indicated concentrations of oxygen, carbon monoxide and smoke of 12 %, 2 % and 2.0 g m-3 respectively for confined jet fires where for such fires without containment carbon monoxide concentrations <0.1 % might be expected. Both experimental and theoretical studies have focused on the heat hazards from such fires and there are considerable data on such issues (see Section 5.2 for discussions about combustion effects). There are little data on the typical species output levels for fires involving offshore process fluids. Fires offshore may also involve solid phase fuels. These are present in a wide range of locations. They may include cabling, seals, building materials and building contents including accommodation modules and control buildings. Some of these materials have the potential to produce heavy yields of smoke, toxic and irritant products, for example aromatic polymers such as polystyrene and polyurethane foams. Such fires are likely to conform to the general character of compartment fires observed onshore with distinct initiation and growth phases leading to flashover and a fully developed fire. From the toxic hazard viewpoint there are a number of specific fire types which may occur in isolation or as stages during the course of a developing compartment fire which are of particular concern and which specific toxic threats. These are non-flaming fires which occur during the initiation phase of a fire.

•

Flaming fires which are characterized by rapid growth.

•

Small flaming vitiated fires which may occur if a fire does not grow to flashover as a result of lack of ventilation.

•

Fully-developed or post flashover fires.

A classification of the toxic hazards represented by these fire types is summarized in Table 7.7. These will vary with the fuel involved, particularly the mix of irritants and the level of smoke but can be taken as a general guide.

Issue 1

May 2007

Page 289 of 493

FIRE AND EXPLOSION GUIDANCE Table 7.7 - Summary of toxic hazards presented by solid phase fires

Fire

Rate of growth

CO2/CO ratio

Non-flaming/ smouldering

Slow

~1

Toxic hazard

Temperature

CO 0-1500 ppm O2 15-21%

400 °C

Irritants Little smoke Small flaming

Rapid

1000 down to 50

CO 0 –1% CO2 0-10% O2 10-21% Irritants, heat, smoke

Small vitiated flaming

Rapid then slow

<10

CO 0.2-4% CO2 1-10% O2<12% Irritants, heat, smoke

Fully-developed/post flashover

7.8.3

Rapid

<10

CO 0-3% HCN 0-500 ppm Irritants High temperatures Dense smoke

800 °C

Harm criteria

7.8.3.1 The developing hazard from the fire The influence of any developing fire on potential victims can be considered in three phases:

•

The first comprises a period when the fire is growing but before the victim is affected by the stimuli from the fire - heat and smoke. During this phase the victim has the full capacity and opportunity to escape and the main factors determining survival are concerned with detection and response to alarms.

•

The next phase is the period of exposure to heat and smoke. The effects of increasing exposure to heat and toxic products increasingly hinder a victim’s escape capability and induce growing incapacitation. Escape will become increasingly problematic. At some stage a stage of full incapacitation will be reached.

•

The third phase will result from prolonged exposure to heat and combustion products and will result in serious injury or death.

Hydrocarbon fires involving process fluids may not exhibit the first of these phases. From this analysis four major stages can be identified. The times at which these stages are reached are critical to an individual’s survival. 1. Time to and level of partial incapacitation. The onset of partial incapacitation hinders escape, reducing an individual’s evacuation speed increasing exposure to fire and the chance of more serious consequences. Issue 1

May 2007

Page 290 of 493

FIRE AND EXPLOSION GUIDANCE 2. The time at which onset of full incapacitation occurs is important since it removes any chance of self-rescue. The individual is then entirely dependent on outside assistance. 3. The time for occurrence of serious injury. 4. The time at which death occurs.

7.8.3.2 The process by which occupants escape The is dependent on factors such as detection, provision of alarms, response to alarms, length and design of escape routes, age profile of the population, level of training, knowledge of the environment and physiological response to exposure to heat and smoke. Again these factors can be expressed in terms of characteristic times. Thus there is a time to detection of the fire, a pre-movement time before escape action begins and a time to reach a place of safety determined by the length of the evacuation route and the evacuation speed.

7.8.3.3 Outcome of an evacuation The outcome of any evacuation depends on the manner in which the hazards develop. A successful evacuation requires that; tu < te ............................................................................................ Equation 7-4

Here tu is the time from the start of the fire at which conditions become untenable. This may be the time for full incapacitation should external rescue not be possible or the time to serious injury or death if external intervention is available. te is made up of a sum of various component times. For example: te = td + tpm + ts ............................................................................ Equation 7-5

where td

is the time to detect the fire,

tpm is the pre-movement time and ts

7.8.4

is the time required to attain a place of safety or removal of the fire hazard.

Human response to fire effects

7.8.4.1 Effects of heat General A number of reviews have been produced adequately summarizing the basis of radiative transfer relevant to hazard analysis and the hydrocarbon processing industries, others have concentrated on the effects of radiation on humans. Thus Hymes et al (1996) [7.37] has produced a comprehensive study; along with other studies, these provide suitable methodologies for computation of the radiation received from flames and assessment of its effect on man. Significant casualties resulted from exposure to radiation during the Los Alfraques Campsite and Lowell Gas Company incidents

Issue 1

May 2007

Page 291 of 493

FIRE AND EXPLOSION GUIDANCE Radiative transfer This depends on the source and the intensity of radiation falling on the target. The former can be specified in terms of the flame shape and dimensions and the total radiated energy or its surface emissive power. The latter can be computed using a suitable model. The simplest of these is the point source model which approximates the flame by a point source located at the actual centre of the real flame. The target is then regarded as located on a sphere with a radius given its distance from the flame centre. The received flux is then given by:

q = τ Qr cosθ / 4 π R2 ................................................................... Equation 7-6 Where Qr is the total radiative energy from the fire,

θ R

τ

is the angle between the normal to the target and the line of sight from the target to the point source location, is the distance from the point source to the target and is the atmospheric transmissivity and accounts for attenuation of radiation by the atmosphere.

Alternatively the widely used method of view factors can be used. In this model the received flux is given by:

q = ϕ E τ ....................................................................................... Equation 7-7 Here E is the flame surface emissive power and ϕ the view or configuration factor. This is a geometrical factor depending on the target location and orientation relative to the flame and the flame dimensions and shape. ϕ takes values between 0 and 1. Lees (1996) has parameterised several view factors relevant to process safety in terms of the geometry of the situation. More complex computationally-based models used within computational fluid dynamics suites are also available for the computation of radiation fields. Beyler has provided a methodology for calculation of the transmissivity τ.. He has shown that it depends principally on water vapour concentration in the atmosphere (in general, at distances < 100m, and relative humidities up to 50 %, τ. > 0.7). For lower humidities and for targets closer to the source, τ. = 1 would be a reasonably conservative assumption. Burn injuries Burn injury correlates closely with skin temperature and the severity of burning increases with failure of the blood supply to remove heat incident on the skin. The severity of burns has been previously classified in terms of degree as indicated in Table 7.8 below.

Table 7.8 - Burn severity classification Burn type

Issue 1

Characteristic

First degree

Persistent redness

Second degree moderate

Some blistering

Second degree deep

Full blistering

Third degree

Charring

May 2007

Page 292 of 493

FIRE AND EXPLOSION GUIDANCE The terms second and third degree have largely given way to characterization in terms of depth For example moderate second degree burns affect only the surface layers whereas deep second degree burns penetrate into the dermis. Third degree burns destroy both the surface and underlying layers. Those with first degree burns are expected to escape quickly since movement should not be impaired. With second degree burns any exposed skin will be uncomfortable and simple escape tasks such as donning survival gear or turning handles may become difficult. Escape becomes increasingly problematic as the depth of second degree burns increases. However unassisted escape is still possible. The response of third degree burn casualties is difficult to predict. Fine control of injured extremities may be impossible and the act of escape will probably incur further injury. Individuals with third degree burns should be considered casualties who cannot escape unaided. Prolonged exposure to high radiant intensities and extensive third degree burning results in death. Injury due to exposure to short but strong pulses of thermal radiation may be correlated in several ways; the most appropriate factor is the thermal dose – the product of radiation intensity and time. However, it has been found that this underestimates the effects of high intensities and that a better correlation is obtained if injury is with a dose, D, in the form: D = I4/3 t........................................................................................ Equation 7-8

Where t is the time in seconds, and I is the radiant intensity in kW m-2, this gives D in thermal dose in units of (kW m2)4/3 s. Table 7.9 shows the spread of selected experimental burn data for infra-red radiation correlated with the severity of injury. The degree of variability is high.

Table 7.9 - Summarised burn data for level of injury with threshold dose Infra red radiation thermal dose TDU (kWm2)4/3 s

Harm caused Mean

Range

Pain

92

86-103

Threshold first degree burn

105

80-130

Threshold second degree burn

290

240-350

Threshold third degree burn

1000

870-2600

Fatality criteria similarly based on the thermal dose can be derived for hazard analysis purposes. An alternative approach to deriving the level of fatality is the use of probit functions. Unlike linear harm functions they account better for extremes of injury and the variable response of a population. They are based on the statistical normal distribution. The probit function, Y, takes the form: Y = a + b loge V ............................................................................ Equation 7-9

V is the thermal dose in (kW m2)4/3 and a and b are constants derived by a fit to data. A number of probits have been developed as shown in Table 7.10.

Issue 1

May 2007

Page 293 of 493

FIRE AND EXPLOSION GUIDANCE In Table 7.10, the thermal dose used in the Lees probit included a multiplier to account for the variation of exposed skin area. Thus for a normally clothed population a factor of 0.5 was included while the factor rose to 1.0 to account for ignited clothing. This demonstrates the importance of protective clothing. The probit function can be converted to a mortality rate. The problem with the probit approach is that there is never likely to be a sufficiently large sample of injuries from a well-defined event to validate a particular probit or that the normal distribution is appropriate to this situation.

Table 7.10 - Probit equations for the fatality effects of thermal radiation. Probit equation constants Source a

b

Eisenberg et al

-14.9

2.56

Tsao and Perry

-12.8

2.56

Lees

-10.7

1.99

The extent of exposed skin has an important effect on survivability in high radiation environments. Thus reducing the burned area as a result heavy duty, well designed and specified clothing can provide significant mitigation. Even without a hat and gloves an individual wearing a one piece long sleeved overall and shoes will have an exposed body area of <20 %. With only the hands, face and neck exposed this is further reduced to about 15 %. Such exposures, even with full depth burns, significantly reduce the level of fatality. The issue is then to avoid ignition of clothing. This issue is not well understood and further work is required. For example Hymes (1996) [7.37] has examined the ignition properties of various grades of clothing and counter intuitively he has predicted that fire retardant cotton will ignite more easily than other clothing types. All useful clothing, for example man made fibres may melt and as a result may increase exposure by melting on to the skin. Hyperthermia Simple hyperthermia involves prolonged exposure (>15 minutes) to heated environments at temperatures too low to cause burn injury. This means temperatures below 120 °C and 80 °C in dry and saturated air respectively. The main effect is a gradual increase in core temperature. When this is raised to 40 °C consciousness becomes blurred, temperatures above 42.5 °C cause death in minutes. The time taken to reach such a state depends on a number of factors including the heat flux exposure, level of activity, air movement, humidity and amount of clothing. The latter may reduce tolerance since it restricts mitigating evaporative cooling. This suggests that at temperatures above about 100 °C exposures in excess of a few minutes should give concern particularly in conditions of high humidity and if the subject is working hard as might be expected if evacuating from a fire. Convective heating Above about 120 °C skin burns become increasingly likely. Clothing may provide some protection but at temperatures around 200 °C pain levels become intolerable after a few minutes due to burns. If temperature and humidity are sufficiently high to produce facial skin burns they will also cause internal burns to the respiratory tract. Dry air at 300 °C will cause burns to the larynx in a few minutes and breathing air at temperatures down to 120 °C will be painful and potentially cause incapacitating burns.

Issue 1

May 2007

Page 294 of 493

FIRE AND EXPLOSION GUIDANCE Humid air, steam or high heat capacity smoke may be dangerous at temperatures around 100 ºC causing severe burns throughout the respiratory tract. Indeed there is some data to suggest that the highest temperature of breathable 100 % saturated air is as low as 60 °C. Clearly in a fire there will be significant water produced this is an important area for further study. In practice heat flux and temperature tenability limits intended to protect victims from incapacitation from skin burns should be adequate to protect from burns to the respiratory tract. Conducted heat The handling of hot objects can produce pain and severe burns. For metals for a few seconds exposure at temperatures or 50 °C to 60 °C, 60 °C to 70 °C and ~80 °C can produce discomfort, partial thickness and full thickness burns respectively.

7.8.4.2 Effects of smoke The human response to some smoke constituents (e.g. CO) can be described in terms of an accumulated toxic dose given by the product of concentration and time. The effect thus builds over time. W = Ct.......................................................................................... Equation 7-10

Where W is a constant dose and t is an exposure time. The units of W are generally ppm min. The effect of other constituents including most irritants is concentration dependent and the effects are felt immediately. The response to other materials such as carbon dioxide and low oxygen concentrations is a combination of dose and concentration. The concept of a fractional effective dose (FED) has been introduced to allow the combined effects of combustion product mixtures to be examined. For FED the Ct product for small periods of time during exposure are divided by the Ct product dose causing the toxic effect. This can be done for a number of components. The fractional doses are then summed until the fraction reaches unity when the toxic effect is predicted to occur. Thus: FED = Dose received at time t (Ct)/Ct dose to cause incapacitation or death Similar calculations for a fractional incapacitating dose (FID) and fractional irritant concentration (FIC) can be carried out. A FID or FIC =1 generally indicates a state of partial incapacitation. Full incapacitation is predicted for a FID or FIC ~ 3-5. The effects of many fire plume constituents are felt in the lung so the rate of breathing is important. This is dependent on activity. Thus for an average man running or walking uphill as might be expected in an escape situation the rate of breathing increases almost 6 fold. Similarly some plume constituents, notably carbon dioxide produced in all fires, produces a three fold increase in breathing rate at concentrations of about 5 %. The effects of some of the different plume constituents are known to be additive. Thus those of CO and HCN are and CO2 increases up take of these products in proportion to its effect on the breathing rate. Similarly the effects of oxygen hypoxia are considered directly additive to the combined effects of CO and HCN. However, the asphyxiant effect of CO2 acts independently of other gases. The effects of irritants are considered additive.

Issue 1

May 2007

Page 295 of 493

FIRE AND EXPLOSION GUIDANCE The effects of some of the main smoke constituents are:

Carbon monoxide: CO causes suffocation by blocking oxygen transport in the blood haemoglobin. The effects are dose dependent but take up is dependent on breathing rate. For a normal adult at rest or partaking in light activity full incapacitation occurs after about 21 or 5 minutes respectively at 5000 ppm. Death will occur at a concentration of 12-16000 ppm for a 5 minute exposure. Hydrogen cyanide: The effects of hydrogen cyanide depend partly on uptake and dose. The effects increase from zero at about 80 ppm to loss of consciousness and full incapacitation in a few minutes at 180 ppm. Low oxygen hypoxia Again the effects of lack of oxygen are both concentration and does related. The main effects are felt at concentrations below about 14%.Thus: >14 % No significant effects 14.4-11.8 Slight effects on memory, reduced exercise tolerance 11.8-9.6 % Severe incapacitation, lethargy <9.6 % Loss of consciousness, death

Carbon dioxide: The asphyxiant effects of carbon dioxide are only felt at high concentrations above about 5 % and then follow a dose response relationship. Below this figure the main effect is of hyperventilation which acts to increase the uptake of other gases. At concentrations of 6-7 % individuals suffer severe respiratory distress and dizziness. Loss of consciousness occurs at concentrations between 7 and 10 % Irritants: Irritants produce two levels of harm: 1. Sensory irritation pain to the eyes, respiratory tract and lungs to some extent. 2. An acute pulmonary response including edema and inflammation in the respiratory system. This may lead to death 6-24 hours after exposure. The former is concentration dependent while acute damage only occurs above a threshold concentration and then is dose dependent. The main irritants are acid gases including HCl, SO2 and NOx and simple aldehydes such as acrolein and formaldehyde. There is little data on irritants for humans. Some data for HCl and acrolein indicate disturbing irritation to the eyes and upper respiratory tract occurs at concentrations of 75 - 300 and < 5 ppm respectively. Acute pulmonary response may be induced by exposures in excess of 12000 and 500 ppm for five minutes respectively.

Particulate smoke: Smoke can be either irritant or non-irritant. Smoke causes disorientation and thus acts physically to reduce escape speed. They make way finding difficult and reduce the visibility of escape signs. Studies have shown that walking speed is reduced from 1.2 to 0.3 m s-1 for non irritating smoke. There is also a psychological effect in that some individuals will not try to evacuate through smoke at a density in excess of 0.33 m-1. The effects of irritating smokes are even more pronounced. Such smokes with densities of only ~0.2 m-1 reduced walking speeds to 0.3 m s-1.

Issue 1

May 2007

Page 296 of 493


Vulnerability/harm criteria

7.8.5.1 Effects of heat Radiation A recent study has taken account of the special features of the offshore environment including its isolation, the age profile and fitness of the population, state of dress etc and recommended that the criteria given in Table 7.11 are the most appropriate.

Table 7.11 - Thermal dose harm criteria from radiation Harm caused

Thermal dose, (kW/m2)4/3s

Escape impeded

290 (See also Table 7.9) At permissible radiation design levels of 9.46 kW m-2 and 6.31 kW m-2 , a dose of 290 (kWm-2)4/3s is reached in 14.5 and 25 seconds respectively)

1-5 % fatality

1000

50 % fatality (to front and back only)

1000

50 % fatality

2000

100 % fatality

3500

Convected heat The toleration of a hot environment depends on the level of activity, extent of clothing and level of humidity. Temperatures above 120 °C will produce both skin and internal burn injuries. For air with a humidity <10 %, the existing work suggests a relation for time to incapacitation in a hot environment of tI = 5.107 T-3.4 ............................................................................... Equation 7-11

Thus temperatures of 100 and 60 °C would cause incapacitation in a matter of some 8 and 45 minutes respectively. The time to incapacitation in air with higher water vapour contents is not well defined. It will be significantly less that those obtained from Equation 7-11 but no data exist to allow its determination with certainty. This is particularly important for fires offshore where there is likely to be significant quantities of water both produced in the fire and used for fire fighting.

7.8.5.2 Effects of smoke• Asphyxiant gases Existing knowledge suggest that the tenability limits given in Table 7.12 for asphyxiant gases are appropriate for design purposes.

Issue 1

May 2007

Page 297 of 493

FIRE AND EXPLOSION GUIDANCE Table 7.12 - Tenability limits for incapacitation and death from exposure to common asphyxiant gases 5 minute exposure

30 minute exposure

Gas Incapacitation

Death

Incapacitation

Death

CO

6-8000 ppm

12-16000 ppm

14-1700 ppm

2500-4000 ppm

HCN

150-200 ppm

250-400 ppm

90-120 ppm

170-230 ppm

Low oxygen

10-13 %

<5 %

<12 %

6-7 %

CO2

7-8 %

>10 %

6-7 %

>9 %

Some currently accepted 30 minute LC50 values for CO and HCN are 5700 and 165 ppm respectively. Irritants Two irritant gases have been taken as examples, acrolein and HCl. Existing knowledge suggests that the tenability limits given in Table 7.13 for these gases are appropriate for design purposes. Two levels of sensory irritancy are given; Level a) is for unpleasant and severely disturbing eye and upper respiratory tract irritation, Level b) represents severe eye and upper respiratory tract irritation with severe pain. For death the levels represent concentrations at which there is a danger of death occurring during or immediately after exposure. Concentrations are in ppm.

Table 7.13 - Tenability limits for sensory irritation or death from irritant substances. Sensory irritation

Death, minutes

Gas Acrolein HCL

a

b

5

10

30

1-5

5-95

500-1000

150-690

50-135

75-300

300-11000

12-16000

10000

2-4000

Smoke The ability to evacuate through smoke is dependent on a number of factors including knowledge of the environment, levels of illumination (particularly of signage) and irritancy of smoke. Suggested tenability limits based on ability to evacuate can be set in terms of optical density and set at 0.2 and 0.08 m-1 for small and large spaces respectively. Hazards from fire protection systems Possible interactions of fire with active and passive protection systems must be considered. For example water mist and deluge systems will produce copious amounts of steam which will add to the obscuration provided by smoke and hinder escape. Also humid air enhances the effects of hyperthermia and when inhaled can significantly increase the severity of internal burns to the respiratory tract. Issue 1

May 2007

Page 298 of 493

FIRE AND EXPLOSION GUIDANCE Passive systems may also present hazards. Intumescent materials rely on chemical reaction for their action and generate fumes. These fumes or their decomposition products may present a hazard. Similar considerations apply also to binders used in other passive systems. Many materials when treated with fire retardants are capable of resisting small ignition sources but when faced with a large igniting fire can burn readily. The treatments themselves then add significantly to the rate at which smoke is produced and the composition can be particularly irritant and toxic. Evacuation and mitigation If the hazard cannot be removed then some means of separating the hazard and personnel must be provided. This will generally be through evacuation of occupants by means of safe, protected evacuation routes to a safe haven or temporary safe refuge. Platform layout can make a major contribution to this. Careful consideration must be given to the design and routeing of evacuation paths. Their length must be kept to a minimum and they must be routed away from high hazard areas. Should they be likely to be subject to fire attack they must be protected with fire walls suitable for offshore duty or water protection systems? The evacuation routes should maintain their integrity for a time sufficient to allow even injured personnel to reach a location of safety. If likely to suffer from smoke logging consideration should be given to other methods of way-finding. There are no particular guidelines for evacuation routes off shore. However CIA guidance for onshore situations, suggests that evacuation routes should not suffer incident radiant heat fluxes in excess of 6.3 kW m-2. There are also general requirements relating to evacuation routes in public buildings and industrial premises. Under UK legislation and as a matter of good practice, there is a need to provide temporary refuges to serve as muster points prior to evacuation of the facility. There are no particular guidelines for the design of such structures offshore. However, they are required to allow staff to muster, assess the emergency and allow execution of the emergency plan. The requirement is that the chance of loss of a TR, within the stated endurance time, will not exceed 1 in 1000 per year. Thus there is a need to design fire resistance into the structure. Those walls likely to be exposed to fire must be protected in such a way, either by insulation or water deluge, as to provide this resistance. The prevention of smoke ingress must be considered and any ventilation system should include a means to close off relevant air intakes. Similarly a means must be provided to seal doors and other openings such as cable routes and other services. There is currently much activity in the development of evacuation models. Traditionally evacuation has relied on simple hydraulic formulations of people movement to derive travel speeds. These have been corrected for travel through smoke, the use of stairs etc, and the difficulty of route finding and an evacuation time obtained from simple combination with the length of the route. More complex models are now available which take account of the response to alarms, other pre-movement aspects and the varied response of a population to the threat of fire. They have been applied to a variety of situations and potentially they may be applied offshore particularly to the design process to calculate a time for all personnel to reach a place of safety for different plant layouts and fire scenarios. A key issue to consider in developing evacuation and mitigation strategies to protect personnel is the provision of Personal Protection Equipment that can supplement the fire protection and other mitigating measures discussed in Sections 3.2.8 and 10.3.

Issue 1

May 2007

Page 299 of 493

FIRE AND EXPLOSION GUIDANCE The provision of equipment will consider suitable clothing, e.g. fire resistant coveralls as a minimum requirement and should also consider whether breathing apparatus is required. Various models covering types and durations are available on the market and the requirement should be determined by the hazard and the function of the team to which they are being supplied. For example, for normal operating teams who are making their way to safer muster areas prior to disembarking will need lightweight equipment of short duration. Emergency Response teams who may be required to recover colleagues in the early stages of an incident will require longer duration sets. Dedicated fire-fighting teams will require specialist fire-fighting suits and will be trained to use the full range of portable fire-fighting equipment on the installation. This equipment should have been specified to be suitable for the range of hazards that the team are expected to respond to, for example, rescue teams for helicopter crashes.

Issue 1

May 2007

Page 300 of 493


8 Response to explosions 8.1

Overview of explosion response

This Section deals with the methods of analysis of the response of structures, piping and safety critical elements (SCEs) to explosion loads. The Section is based on a basis document developed in an earlier phase of this project, [8.1]. Over the last ten years, many structures have been designed to resist uncertain explosion loads by the calculation of the capacity of the structure and the SCEs and the demonstration of robustness in the structure as reflected in an insensitivity of response to variations in load. This approach is to an extent scenario independent and may give added protection against unidentified scenarios and in particular combined fire and explosion scenarios. The ‘robustness’ approach is valuable and should be considered in addition to the more rigorous probabilistic methods described in this Guidance. Due to the extreme nature of the ductility level blast (DLB) loads, it is essential to prevent overall structural collapse but local failure may be tolerated as long as it does not lead to an unacceptable escalation through progressive collapse, leakage of inventory or failure of SCEs. This places considerable emphasis on the requirements for structural and equipment robustness, i.e. ensuring that systems can absorb significant amounts of energy and be able to redistribute internal forces via the provision of adequate alternative load paths. One way of achieving structural robustness is to prevent premature failure by buckling and shear failures which may produce brittle, as opposed to ductile response. Adequate connections to adjoining members will ensure the ability to redistribute load and enable the structure to mobilise its ultimate capacity. The goal of robustness ensures that the structure has the ability to absorb some of the uncertainty in the loading to which it may be subjected. A review of the research in the area of response to explosion loads since the generation of the Interim Guidance Notes [8.2], or has been carried for this Guidance [[8.1].

8.2

Information required for explosion response calculations

8.2.1

Information from the explosion load simulations

•

For High risk installations, information will include:

•

Pressure exceedance diagrams for each combustion zone.

•

Identified strength level blast (SLB) and ductility level blast (DLB) load cases – these should include special distributions of peak overpressure and overpressure time histories at critical locations.

•

SCEs and their criticality levels

•

Dynamic pressure exceedance curves for SCEs of criticality 1 for the DLB with time histories of dynamic pressures at these locations.

•

Dynamic pressure exceedance curves for SCEs of criticality 1 or 2 for the SLB with time histories of dynamic pressures at these locations.

Issue 1

May 2007

Page 301 of 493


Other overpressure and dynamic overpressure information for significant scenarios with similar frequency, where the loading pattern differs appreciably from the design explosion events. If this is not available then a range of likely durations should be supplied.

If exceedance curves are not generated then the probabilities associated with the design explosion events should be available. If time histories are not supplied load durations and general shape of the load time histories should be supplied. Low and some medium risk installations will only require the information for the ductility level blast explosion loads. A comparative assessment method may be used drawing on past experience from a demonstrably similar structure geometry and scenario. The nomination of a typical installation to represent a fleet of platforms is acceptable.

8.2.2

Other information from non-structural disciplines

The project should also supply:

•

High level and system specific performance standards for evaluation of the results of the assessment.

•

Layout drawings, including process, escape routes, muster areas, the TR, the SCEs and their support structures

•

Any structural drawings and the location of tall structures which may become a hazard during escalation.

•

Details of the assumptions for detection, control and mitigation systems, location and required availability.

•

For dynamic response analyses, the location and masses of all major items should be supplied.

•

Further exceedance curves will be required from the explosion specialists for dynamic pressure loads, to enable the dynamic pressure loading on pipework to be developed.

In order to determine the loading on large items of equipment or vessels, the required items can be identified to the explosion specialist for direct load extraction from the CFD model for various explosion scenarios. Alternatively, a less accurate, but less time consuming method for the explosion specialist, is to provide generalised pressure-time histories for the equipment locations, together with the speed of travel of the pressure wave. The structural engineer then determines the maximum pressure difference between locations of known separation, having determined the time taken for the wave to travel that distance. If the general level of dynamic pressure loads is not known then it is acceptable to take a load equal to 1/3 of the smoothed peak overpressure at the location for loads on the relevant SCEs and piping. The duration should be chosen so that the impulse is matched to the positive phase of overpressure trace. This load must also be applied in the reverse direction. In open areas, such as the decks of F(P)SOs, these loads should also be applied in the vertical plane.

8.2.3

Overpressure load considerations

Design explosion loads represent only one of many scenarios and the reliance on a particular overpressure time history or spatial distribution of overpressure is not advised. Issue 1

May 2007

Page 302 of 493

FIRE AND EXPLOSION GUIDANCE That the detail of a given load distribution is only one of many possible scenarios also implies that reliance should not be put on the apparent result that some parts of a blast wall for instance seem to receive less load than others; a different ignition point may give rise to a different distribution of load. It is therefore not acceptable to design adjacent areas to different pressures without justification. The structural engineer should develop the idealised pressure-time histories for various pulse durations in order to capture the range of dynamic response for the various components of the system to be designed or assessed or preferably use a representative range of overpressure time histories directly if they are available. If a range of pressure time histories is not available then extrapolation of the range of durations supplied should be investigated. The peak pressure/duration relationships [8.3] given in Section 6.8 may be used to estimate the peak overpressure for shorter duration loads. The peak averaged overpressure is plotted against impulse in Figure 5.6 of Chapter 5 from work by Hoiset et al, [8.3]. The design overpressure of a panel will need to be greater than that for a section of a blast wall which will in turn be less than that for a whole wall. The pressure disturbance is of finite extent relative to the target and hence the averaged pressure will vary with target dimensions. The explosion load specialist may supply a lower level of design load for an extended structure (deck or wall) than for a blast wall; there are simple methods for deriving scale factors, [8.4]. The approach should be applied with care as the direction of travel of the overpressure pulse relative to the target affects the way the pulse is reflected. The approach is suitable for large deck areas or if sufficiently detailed information on the loading pattern is available. In modelling the response of a structural frame, it is conservative not to model the cladding or plate as the shear restraint from such surfaces may be overestimated. The overpressure load on a plate may be applied directly to the bounding members of the plate using the ‘area tributary method’. For example the loads on a square plate may be applied to the bounding framing members with one quarter on each, for a rectangular plate the members on the long edges would receive a load proportional to the triangular area joining the edges with the plate centre.

8.3

Response considerations

8.3.1

Elastic dynamic response

Most of the loads resulting from an explosion are dynamic in nature hence dynamic response must be considered unless some form of equivalent static load can be justified. This section deals with elastic dynamic response where the primary structure remains elastic during the explosion event. This may be a system specific performance standard for the primary structure of the temporary refuge (TR) for example. Component response is considered further in Section 8.7.5.1 where the Biggs method [8.5] is discussed. The response of a structure to a dynamic load is commonly characterised by the ratio of the load duration ‘td’ to the natural period ‘T’ of the structure. Depending on the value of this ratio, three response regimes are defined, denoted as either:

•

Impulsive

•

Dynamic, or

•

Quasi-static.

Issue 1

May 2007

Page 303 of 493


Table 8.1 is a modified version of the one in the IGN [8.2] to reflect more recent work published in NORSOK [8.6] and summarises the influence of the loading characteristics on response in the three regimes.

Table 8.1 - Regimes of dynamic response Impulsive td/T < 0.3

Dynamic 0.3< td/T < 3.0

Quasi-static td/T >3.0

Peak Load

Preserving the exact peak value is not critical

Preserve peak value – the response is sensitive to increases or decreases in peak load for a smooth pressure pulse

Duration

Preserving the exact load duration is not critical

Preserve load duration since in this range it is close to the natural period of the structure. Even slight changes may affect response.

Not important if response is elastic, but is critical when response is plastic.

Impulse

Accurate representation of impulse is critical.

Accurate representation of the impulse is important.

Accurate representation of impulse is not important.

Rise Time

Preserving rise time is not important.

Preserving rise time is important; ignoring it can significantly affect response.

This table assumes that there is some identifiable natural period for the structure, which indicates that a single degree of freedom (SDOF) idealisation of the structure is possible. Multi-degree of freedom (MDOF) systems may have a large number of modal periods associated with them, although it is often possible to identify a mode or shape of response with each modal period. If the loading is impulsive much higher peak loads can be tolerated than the static capacity of the target. The limits specified in Table 8.1 above have been changed to correspond to those in the Norsok standard [8.6]. The impulse duration ratio at the impulse to dynamic boundary has been reduced from the 0.4 and 2.0 values given in the IGN. The dynamic amplification factor ‘daf’ (dynamic/static response) does not approach unity for a triangular load pulse until a value between 5 and 6 is attained. It is important to note that although the load duration may be long, the rise time may be short and this can cause significant dynamic amplification as may also be seen in Figure 8.1 from Clough and Penzien [8.9], (reproduced below) for the sharp fronted pulse shape.

Issue 1

May 2007

Page 304 of 493


Figure 8.1 - Shock spectra (elastic response)

8.3.2 Idealisation calculations

of

overpressure

time

histories

for

response

For some design applications a simplified form of pressure-time history is required. The usual method is idealization of the pressure time history into a triangular form with a positive phase only, Figure 8.2 [8.2] shows the conventional idealization of a pressure trace.

Issue 1

May 2007

Page 305 of 493


Figure 8.2 - Idealised pressure trace for a hydrocarbon explosion For determination of deck response to an explosion from below, it is important to represent the negative phase of the loading to enable the calculation of rebound. This form is not characteristic of far field blast waves outside a compartment. A typical trace for this case is shown in Figure 6.4. The single peak idealization shown in Figure 8.2 will not apply when external explosions are involved or when there are two paths to the observation point or in some cases of explosions in the moonpools of F(P)SOs. There are also concerns that the sharp changes in slope in the idealization introduce spurious frequencies into the exciting force and that it is preferable to use the original pressure traces from CFD or use some spectral approach. These topics remain under investigation. Published guidance, [8.8], discusses the accuracy of various methods of idealization of pressure pulses.

8.3.3

Equivalent static loads

During early design stages, the use of equivalent static explosion loads is generally acceptable to allow progression of the primary structure design using a global static overpressure. It is important that consideration is given to the impact of the dynamics on these loads. The use of Figure 8.1 is only applicable when elastic response is expected and the structure does not yield locally. For plastic deformations the dynamic amplification factor has a restricted meaning, as a static load which causes yielding would deform the structure without limit.

Issue 1

May 2007

Page 306 of 493

FIRE AND EXPLOSION GUIDANCE A Dynamic Amplification Factor (DAF), γ, should be calculated for all loaded members such that the equivalent static load, Lstatic, is related to the peak dynamic load, Lpeak, by: Lstatic = γ Lpeak For single structural components γ may be as much as 2, for typical large structures such as module and topside structures, the natural periods are likely to be longer with DAFs less than one. An equivalent static load may be obtained from consideration of the modes of response of a MDOF structure and by choosing the mode (and modal period) corresponding closely to the expected shape of the response if this is available. A DAF may then be calculated for this form of response. Another technique is to perform a simplified dynamic analysis and find an equivalent static load distribution which gives similar displacements to the peak dynamic response. This only applies for elastic response but may enable code, utilisation or unity checks to be performed using conventional software. The DAF obtained for an extended structure and the appropriate design load may not be applicable for member or local checks. For plastic deformation a time history simulation may be used to estimate the DAF including plastic response using Biggs’ method described later in Section 8.7.6. For example consider an explosion overpressure of 1.5 barg with a duration of 150 ms as the design load condition. A triangular profile may be appropriate as shown in Figure 8.2. This can then be translated into transient dynamic response as shown in Figure 8.3.

Issue 1

May 2007

Page 307 of 493

FIRE AND EXPLOSION GUIDANCE Transient Dynamic SDOF Response 0.0025

Static Response

Displacement (m)

0.0020

Dynamic Response

0.0015

0.0010

0.0005

0.0000 0.000

0.050

0.100

0.150

0.200

0.250

0.300

0.350

0.400

Time (second)

Figure 8.3 - Sample SDOF dynamic response The example presented here indicates that a dynamic amplification factor of 1.125 for a scenario with a duration of 150 ms and for an element with a natural period of 50 ms. For a scenario with load duration 50 ms or for a member with natural period of 150 ms the corresponding DAF would be about 1.9. The equivalent static load is that would cause similar response to the blast impulse. This equates to static overpressure loads between 1.68 bar and 2.85 bar for the static design load conditions. The method could be refined to take account of the variation of impulse and duration with peak overpressure given in Section 6.8.

8.4

Material properties for explosion response

8.4.1

General

The expected large deformations resulting from an explosion and the dynamic nature of explosion loading mean that strain rate and strain hardening of the material may occur locally. A brief summary is presented here of a more detailed treatment of material properties [8.1], further more detailed information is available [8.9 and 8.10].

Issue 1

May 2007

Page 308 of 493


Static material properties

8.4.2.1

Overview

In a design or assessment project, if detailed and precise material data are available, potentially a more economical design can be achieved. However in most design situations the engineer will typically have to rely on generic data specified in the relevant standards. In the special case of brown-field projects mill certificates for the employed steels should be available. As a minimum these certificates will contain useful experimental results obtained from tensile coupon tests on the yield strength, the tensile strength and the rupture elongation of the steels. It should be emphasised that when performing a structural analysis the materials are often assumed to have a limiting strain well below their fracture strain. The reason for this is partly to allow for deficiencies in the adopted analytical modelling tools, and partly to allow for variations not explicitly covered in the geometric and physical description of the structure. As an example the influence of specified tolerable variations in the dimension and mass of the structural components as well their alignment are seldom incorporated into the analytical model. Also local buckling of compression elements and localised necking of tension elements are in general not automatically captured, except by the most sophisticated and detailed of the analytical tools. According to the IGNs [8.2], the limiting strain can be set to 5 % for a member in tension as well as for a member in bending or compression with a plastic cross-section. The quasi-static stress-strain curve for a typical structural steel specimen tested in accordance with standard tensile test procedures, such as those described in BS EN 10002-1:2001 [8.11] is typically characterised by four distinct phases: 1. from the onset of loading, until reaching the upper yield stress, the stress-strain behaviour of the specimen is nearly linear elastic with a modulus of elasticity of about 205,000 Nmm-2. 2. hereafter, it follows a rather sudden stress drop down to a lower yield stress, 3. where it remains for a while as the deformations continues to develop, until 4. strain hardening to rupture. With respect to the upper yield it is known that stress concentrations and welding both have a tendency to reduce if not remove it. However, for the purpose of designing connections and supports against dynamic loading, ignoring the upper yield stress could prove unsafe. In contrast, when designing the individual structural members it is safe to ignore the upper yield stress. The yield plateau, which typically terminates at strains at least 10 times larger than the initial yield strain, is followed by a phase of strain hardening at a continuously diminishing rate until reaching the ultimate stress-strain point. It is interesting that according to the guidelines given in the EC3 Part 1.2 draft code for structural fire design the ultimate strain of structural steel can irrespective of the temperature be set to 15 %.

Issue 1

May 2007

Page 309 of 493

FIRE AND EXPLOSION GUIDANCE The specific and current mechanical requirements to structural steels to be used in the fabrication of fixed offshore structures are given in material standards [8.12]. This standard, (which has superseded the recently withdrawn BS 7191: 1989) specifies the requirements to variations of the steel grades S355, S420 and S460. These steels are all suitable for installations in the North Sea sector. Typical limiting values for some of the mechanical properties specified in EN 10225 for grade S355, S420 and S460 steel are listed in Table 8.2.

Table 8.2 - Mechanical properties typically specified for structural offshore steels Reh

Rm

Af

N/mm2

N/mm2

%

S355

355

470- 630

22

S420

420

500-660

19

S460

460

530-720

17

Name

It should be noticed that the minimum yield strength Reh refers to the upper yield strength. The requirements to the tensile strength Rm is given in terms of an upper and a lower limit, and the ductility in terms of a minimum rupture strain Af. The rupture strain is measured over a gauge length of 5.65 S0 , where S0 is the original cross-sectional area of the test piece. In situations where the yield phenomenon is absent the yield strength should replace this parameter with the 0.2 % proof strength Rp0.2. It should be emphasised that the actual yield strength of steel frequently is significantly larger than its guaranteed minimum value. In the case of the high quality offshore steels tested [8.13] the upper yield strengths were measured to be up to 26 % larger than their guaranteed value, with an average of about 13 %. Such differences between the guaranteed and the actual yield strength need to be accounted when estimating the magnitude of the forces transferred through the joint details into the supporting structure.

8.4.2.2

Stainless steels

Compared to carbon steel the stress-strain curve for stainless steels are characterised by a smooth rounded response with no definite yield point. Another major difference in the mechanical performance at ambient temperature between the two types of steel is the improved ductility of stainless steel. Table 8.3 lists typical values for the mechanical properties of various stainless steels as specified [8.14]. As is the case for carbon steels, the actual yield strength, here taken as the 0.2 % proof strength, is usually significantly larger than the minimum specified in the standard. For the experimental test series described in [8.15] the measured proof strengths were in average observed to be 28 % larger than the specified minima. Furthermore the mechanical requirements given in the table refer to material in the annealed condition. Thus in situations where the structural elements will be subjected to some degree of cold forming without a following heat treatment, the yield strength in the work hardened zones need to be adjusted upwards. Issue 1

May 2007

Page 310 of 493

FIRE AND EXPLOSION GUIDANCE Table 8.3 - Mechanical properties typically specified for stainless steels Name

Rp1.0

Rp0.2 N/mm2

N/mm2

Af

Rm N/mm2

%

1.4404 (316L)

220

260

520-670

45

1.4401 (316)

220

260

520-670

45

1.4362 (2304)

400

-

630-800

25

1.4462 (2205)

460

-

640-840

25

Strain hardening should always be accounted for when designing for the dynamic reaction forces, whereas it safely can be ignored when designing section sizes.

8.4.3

Strain rate effects

It is well known that the stress-strain characteristics of steel depend on the rate of straining, and that, at least until the onset of strain softening, an increase in the strain rate increases the stresses corresponding to given strains. The more precise effect that high strain rates have on the stress-strain characteristics of a given steel quality is a complicated function of its temperature, chemical composition and internal microstructure. However in general it is the case that the more the steel can be strengthened by heat treatment or cold working the more sensitive its mechanical behaviour is to an increase in the strain rates. Strain rate sensitivity is traditionally expressed in terms of the Dynamic Increase Factor (DIF). For a given strain rate and a given material property the Dynamic Increase Factor is defined as the ratio between the value of the material property measured under dynamic and quasi static loading conditions, strain rates of 2.5x10-3 s-1 .As a consequence the tested value will typically be about 8 % larger than the long term yield strength. In general the dynamic testing of steel specimens has shown that the elastic modulus is unaffected by strain rates, and that the strain rate sensitivity decreases with an increase in the plastic strain. It is also generally accepted that the strain rate effects are the same whether the material is loaded in tension or compression, and that the Dynamic Increase Factors are isotropic in their nature. Although an increase in the rate of straining reduces the fracture toughness of steel it is unlikely that the strain rates associated with hydrocarbon explosions will significantly reduce the fracture toughness of the high quality structural steels used for offshore installations. One of the most used models to describe the rate effects on the yield strength is the Cowper Symond’s model: f yd fy

1/ q ⎛ ε& ⎞ ⎜ ⎟ = 1+ ⎝ D⎠

Table 8.4 [8.15, 8.2] lists the coefficients D and q recommended for calculating the dynamic yield strength of various structural steels.

Issue 1

May 2007

Page 311 of 493

FIRE AND EXPLOSION GUIDANCE Table 8.4 - Coefficients D and q for dynamic yield strength Material

D

q

s-1

Mild steel

40.4

5

Stainless steel (304)

100

10

Stainless steel (316L

240

4.74


3489

5.77


5958

6.36

Figure 8.4 compares various empirical models with experimental data; stainless steel data [8.10], high quality carbon steels suitable for fixed offshore installations [8.2]. For typical steel structures the strain rates associated with hydrocarbon explosions will seldom exceed 1 s-1. This compares with the strain rates of 103 s-1 frequently encountered in metal working processes and hard impact situations. However the risk of employing the Cowper Symond’s formulation to fit experimental strength data is the loss of some accuracy for the strain rates which are most relevant to gas explosion scenarios. For strain rates less than about 1 x 103 s-1, an essentially linear relationship exists between the stress and the logarithmic strain. It should be mentioned that the strain rates vary both spatially and temporarily within a structure. Thus, when performing a non-linear finite element analysis it is necessary to know the complete stress-strain behaviour at all encountered rates. Likewise it is assumed that all conclusions regarding the uniaxial stress state can be generalised to the multi-axial stress state.

Issue 1

May 2007

Page 312 of 493


Dynamic increase factor

1.5

Test data for BS 7191 grade 355 and 450 steels Upper Yield Strength ratio Lower Yield Strength ratio

Mild Steel

316L

2304

2205

1.4 1.3 1.2 1.1 1.0 0.9 0.8 1E-006 1E-005 0.0001

0.001

0.01

0.1

strain rate s

1

10

100

1000

-1

Figure 8.4 - Strain rate effects on typical offshore steels

8.4.4

Strain hardening

8.4.4.1

General issues

Strain hardening may also be taken into account for tension members and plastic sections by taking design strength to be the ultimate strength divided by 1.25 [8.2]. This effect should not be considered when designing supports against reaction forces. It is, however, necessary to demonstrate that the strains are high enough to mobilize the benefits of the strain hardening. The following groups of structural members may sustain high plastic strain without losing strength from local or overall buckling.

8.4.4.2

Tension members

Members in axial compression or in bending and axial compression whose slenderness ratio does not exceed 15 and the cross-sections comply with the criteria of compact section Members in bending whose cross-sections comply with the criteria of compact section and whose slenderness ratio (λ) does not exceed certain values.

8.5

Structural performance standards

8.5.1

Introduction

A performance standard is a statement which can be expressed in qualitative or quantitative terms of the performance required of a system, item of equipment, person or procedure and which is used as the basis for managing the hazard. Issue 1

May 2007

Page 313 of 493

FIRE AND EXPLOSION GUIDANCE High level performance standards have been given in the Main Guidance, they are reproduced below. In an explosion event, at least one escape route must be available after the event for all survivors. For a manned platform a Temporary Refuge (TR) or Safe Mustering Area must be available to protect those not in the immediate vicinity of an explosion and to survive the event without injury. For the ductility level blast (DLB), the primary structure should not collapse with escape possible from safe areas after the event. Safety Critical Elements, defined as those elements critical to safety [8.16, 8.17], should have fulfilled their function or remain operational. Plastic deformation of the structure is acceptable provided collapse does not occur and barriers remain in-place and are able to resist any subsequent fires. The ability of the structure to satisfy these requirements will depend on its ability to respond in a ductile manner and the ability of the barrier connection details to respond without rupture. In the UKCS, the frequency with which accidental events, from all causes, will result in loss of TR integrity within the required endurance time will not exceed 10-3 per year [8.18]. The required endurance time is the estimated time for people to travel from their work stations to the TR, then to the primary and secondary means of escape, allowing for the possibility of helping injured colleagues. To reiterate the regulatory requirement, Performance Standards may also be referred to as acceptance, screening or performance criteria and Safety Critical Elements (SCE) are defined as, any structure, plant, equipment, system (including computer software) or component part whose failure could cause or contribute substantially to a major accident is safety-critical, as is any which is intended to prevent or limit the effect of a major accident. In addition to the high level Performance Standards above it will be necessary to define measurable performance standards for specific key items or systems relating to the systems’ functionality, availability and survivability. These are referred to in this document as ‘element specific performance standards’ used in the evaluation stage of the explosion assessment. These are sometimes referred to as low level performance standards.

8.5.2

Criticality categories for SCEs

It is helpful to consider a hierarchical approach to the identification of SCEs. It is suggested that the number of SCEs (systems, equipment or functions) requiring detailed assessment are classified into three levels of criticality with respect to the explosion hazard as below.

Issue 1

May 2007

Page 314 of 493

FIRE AND EXPLOSION GUIDANCE Criticality 1

Items whose failure would lead direct impairment of the TR or emergency escape and rescue (EER) systems including the associated supporting structure. Performance Standard – These items must not fail during the DLB or SLB, ductile response of the support structure is allowed during the DLB.

Criticality 2

Items whose failure could lead to major hydrocarbon release and escalation affecting more than one module or compartment. Performance Standard – These items must have no functional significance in an explosion event and these items and their supports must respond elastically under the strength level blast (SLB)

Criticality 3

Items whose failure in an explosion may result in module wide escalation, with potential for inventories outside the module contributing to a fire due to blowdown and or pipework damage. Performance Standard – These items have no functional significance in an explosion event and must not become or generate projectiles.

As is common in the design of structural systems under other forms of accidental loading, eg. earthquakes, performance criteria for the DLB are set such that permanent deformations can occur, but overall collapse is prevented. In addition, is the requirement that the explosion must be contained, in order to prevent an escalation of the event. Consideration needs to be given to limits of deformation, as determined by the location of pipes and equipment and to the performance of these items. The limits specified for the structural elements should not exceed those required for the supported or adjacent equipment to function adequately. Performance levels for structural elements, that are normally considered, are:

•

Strength

•

Deformation limits

•

Local and Global ductility

•

Rupture

•

Global collapse

This guidance document recommends two levels of structural assessment, strength level analysis for the SLB and an ultimate capacity analysis or ductility level analysis for the DLB. The performance standard relating to strength of members is more suitable for the strength level analysis, as this is predominantly a stress based check using static design codes. For the DLB, ultimate capacity check the yield stress limit will be exceeded and member stress is not appropriate for judging member response. At the ductility level, deformation limits are normally adopted.

Issue 1

May 2007

Page 315 of 493


Deformation limits

Deformation limits for structural elements are normally specified in terms of deflections, often given as a ductility ratio μ defined as the ratio of the maximum displacement of the element to the deflection required to cause first yield at the extreme fibres. This is a global deformation parameter, which is commonly used in a single degree of freedom model. A local ductility parameter may also be defined in terms of the support rotation. For a class 1 section, Dowrick [8.19] allows a limiting support rotation of 2 degrees and a ductility factor of 10 (whichever governs) as reasonable estimates for absolute values to ensure safety for personnel and equipment and consistent with maintaining structural integrity in the inelastic range. It should be noted that such levels of ductility will have design implications for members containing plastic hinges to ensure the ductility levels can be achieved. This is normally achieved by providing lateral restraint at hinge locations to the unbraced compression flange. Norsok standard Annex A, N-004 [8.20] gives the range of allowable values of μ depending on the section classification assuming no axial restraint to the beam and the boundary conditions. These are given in Table 8.5.

Table 8.5 - Allowable ductility values μ Cross-section category

Load

Boundary Conditions

Class 1

Class 2

Class 3

Cantilevered

Concentrated Distributed

6 7

4 5

2 2

Pinned


6 12

4 8

2 2

Fixed


6 4

4 3

2 2

Consideration of attached fire protection may impose a lower limiting strain or deflection. The displacement of the component must also be limited to prevent impacting SCEs and equipment items.

8.5.4

Rupture

Structural integrity is often assessed using strain limits, which if exceeded would cause rupture. Current guidance on allowable strain values are to set the critical percentage strain limit at 5 % at weld locations and 15 % in the parent material away from welded details. These values refer to average local strain values. However it is important to be aware that strains at this level are quite sensitive to a number of parameters and tests show a significant scatter of strains at fracture. The Norsok Standard [8.20] highlights a number of factors which influence the strain values such as material toughness, presence of defects, strain rate and presence of strain concentrations. Strains are normally adopted as a failure criterion when using finite element models to judge response. It should be noted that variations in strain are quite common depending on the modelling assumptions used and care in interpreting these values at critical points is required. Issue 1

May 2007

Page 316 of 493


Structural assessment

8.6.1

Introduction

The degree of complexity adopted in establishing the response of the topside requires considerable engineering judgement at an early stage in order to avoid unnecessary delays in the design process. Screening of various options for blast-walls or potential behaviour of walls and decks under a number of explosion scenarios requires cost effective, reliable and accessible solutions. In many cases this may mean that complex Non-Linear Finite Element Analysis (NLFEA) is unlikely to be an option in the early stages of the design cycle unless planned well in advance. Once the design has matured and safety critical elements of the structure have been identified, NLFEA is likely to be required to verify the design. For retrofit systems, it may be important to obtain the ultimate capacity at an early stage which may require a more refined analysis at the outset. This will assist in determining the degree of retrofit required although other factors such as shutdown period if hot work is required and space available will also influence the options available. It is also important to bear in mind that simple models may not give a satisfactory design for large overpressures as many of these tend to rely on bending capacity from a static analysis with some form of load factor to account for the dynamic response.

8.6.2

Design criteria

In order to decide on the level of assessment that is required for various parts of the structure and at different stages of the design process, the philosophy for the explosion design cases and corresponding performance standards need to be established. The extreme loading applied to a structure during an earthquake is often compared with an explosion event on a topside due to the small probability of occurrence. Also, many of the concepts used in design for earthquakes [8.19] such as attention to detail to connections and ductility requirements apply equally to topside explosion response. For earthquake design it is common to consider two load cases for the design of structures and equipment: 1. For a frequent earthquake with low seismic forces, the structure or equipment should remain undamaged. For the structure this is essentially a serviceability check and must remain elastic. 2. For a strong rare event, the structure can sustain damage but overall collapse should not occur. In blast mitigation applications the prime objective is often energy absorption and not static strength, particularly for the extreme low probability scenarios, although limiting deformations need to be set in some parts of the structure which may be influenced by plant, equipment and piping. In general, increasing the stiffness of a structure can result in local stiff points which attract high loads and lead to brittle failure modes which may compromise the integrity of the whole system. Undesirable modes of failure are:

Issue 1

•

Those resulting in an overall collapse of the structure

•

Those involving sudden brittle failure such as local buckling May 2007

Page 317 of 493

FIRE AND EXPLOSION GUIDANCE By analogy with the approach used to assess structures for their ability to resist earthquakes, two levels of explosion loads are recommended for explosion assessment. The strength level blast (SLB) and the ductility level blast (DLB) obtained from consideration of exceedance curves or from the use of derived nominal overpressures as discussed in Section 6.7. The SLB may be typically in the region of 0.5-0.6 bar. It should not be less than the 0.34 bar, which is given in the building code [8.21] as a minimum lateral pressure to be resisted by walls in order to achieve a minimum level of robustness in the connection details.

8.6.3

Strength level blast (SLB)

One aim of this approach is the use of existing design codes which are predominantly based on static design, with enhanced factors to allow for the material properties due to strain rate effects and differences between guaranteed minimum yield strength and coupon tests. This is likely to involve simple numerical models such as the Bigg’s SDOF idealization [8.5] or a static finite element analysis for the primary steelwork. The use of simple models will allow a rapid assessment of the suitability of the layout of the primary steelwork and the screening of a number of pressure time histories to establish the bounding case from the loading. Performance standards based on design strength are adopted for assessment with this loading level. It is important to be aware of limitations of this approach:

8.6.4

•

Design codes are based on static design and not dynamic loads. This is particularly important when checking members in compression as buckling is a time dependent phenomenon which may invalidate some of the static code checks.

•

It is essential to allow for the enhanced reaction forces at connection details due to the enhanced yield stresses which may occur.

•

Membrane forces may occur in some elements which may not have be accounted for in some code checks

Ductility level blast (DLB)

At this load level, permanent deformations due to yielding are acceptable. For parts of the structure which need to contain the blast, care needs to be taken to ensure that they remain intact to prevent an escalation of the event. Some local rupture of structural elements can be tolerated if it can be shown that progressive collapse will not occur. In some cases a maximum deflection limit may be specified to avoid compromising supports to vital equipment or pipework, which may lead to an escalation of the event. The adequacy of components is checked against performance criteria based on maximum deformation and strain rather than strength. Analysis of this level of deformation inevitably requires the use of more complex analytical tools, such as non-linear finite element techniques which are capable of modelling large deformation and strain. It is also important to capture the effects of interaction of the structural elements as a system, in order to assess the possibility of a global collapse mechanism occurring. Uncertainties still exist at such large strain values, which are inevitable in many instances, and care needs to be taken when interpreting the results of non-linear analyses.

8.6.5

Dimensioning explosion

Dimensioning explosion loads [8.4, 8.22, 8.23] are of such a magnitude that when they are applied to a simple elastic analysis model, the code check results in members dimensioned to Issue 1

May 2007

Page 318 of 493

FIRE AND EXPLOSION GUIDANCE resist the worse credible event or ductility level explosion. This approach has largely been superseded by the modified code check method referred to in Annex E. The definition of the SLB in this guidance may also serve to perform this check for the DLB with the more stringent requirement that the stresses in the primary structure remain below yield. Joints, panels, barriers and connections still need to be checked against the DLB directly preferably using a non-linear elastic plastic method of analysis.

8.6.6

The simple demonstration of ALARP

One method of the demonstration of ALARP using a strength level analysis is to apply a static pressure load to the structure and observe, through code checks, when member failures occur. If the pressure is then increased in stages, there will come a point where the incidence of failures rapidly starts to increase and begins to take in the majority of the members. At this point it may be argued that it would be unreasonable to strengthen or change the member properties as it would impact on members designed for the other load cases. Design to this equivalent static pressure could then be said to be ALARP. It is, however, unlikely that the differing levels of response to dynamic loads at the same peak level (as determined by the natural periods of the target structural elements) will be adequately represented without undue conservatism. The variability of pressure in the explosion load cases is also not represented in this method. The validity of this method will depend on the severity of other load cases which have been used in the original design of the structure.

8.6.7

General remarks on structural response

Yasseri [8.248.24] published an article in the FABIG newsletter where a useful hierarchy of structural systems was described. Components which were subjected directly to the blast, such as walls, deck plating including stiffeners and cladding are defined as the secondary system. The primary system is defined as those elements which have blast loads transmitted to them from the secondary system and consists predominantly the primary structure typically consisting of plate girders, beams, columns and trusses. For the primary structure, which is crucial to the survivability of the structure under the extreme load condition, it is necessary to ensure that it remains predominantly elastic in the overall failure mode and parts of the structure that are allowed to yield are detailed for high ductility. This will be predominantly the blastwalls and plating, which if allowed to deflect, will reduce the loads transmitted to the primary framing. This places emphasis on the connection details, which need to be assessed for large rotations in order to achieve a robust structure.

8.7

Response prediction methods

8.7.1

General

Several techniques of varying complexity are available for predicting the blast response of topsides. These range from simple hand calculations and graphical solutions to more complex 3-Dimensional computer models capable of modelling geometric and material non-linearity, tearing of welded connections and contact with other parts of the structure or plant and equipment. However, with all of the models available, a considerable degree of engineering judgment and experience is required in order to convert the real structure into the idealised model. The general philosophy is to start with the simplest methods (ensuring a conservative approach) and if failure is indicated, proceed to more sophisticated methods of analysis. Issue 1

May 2007

Page 319 of 493

FIRE AND EXPLOSION GUIDANCE The three main levels of analysis are: 1. Screening analysis 2. Strength level analysis 3. Ductility level analysis The following may enable simplifications to be made in the analysis method. Non load-bearing elements, typically panels, fire walls, and blast panels may be checked in isolation. The stresses in panels and cladding usually dominate the stresses due to frame movement. Panels and some blast wall systems may be conservatively idealized as one way spans. Resistance displacement curves may often be determined statically, dynamic response may then be determined using a modified Biggs’ [8.5] method. Dynamics of simple structures may be represented with knowledge of dominant natural period. Biggs’ method extensions are available for loaded components [8.25]. It is preferable to model the primary structure response to the SLB using an elastic frame model as single member assessment does not take into account the transfer of loads between connected loaded surfaces and any co-existent static loads. It is preferable not to include nonstructural cladding and plates in the model as their response is mainly in membrane action and their shear strength may be overestimated.

8.7.2

Screening analysis

8.7.2.1

Condition assessment

Screening analysis for an existing installation consists of condition assessment which may involve a survey followed by design basis checks. The transfer of conclusions and load characteristics from the analysis of a similar platform is acceptable for this and for Strength level and ductility level analyses.

8.7.2.2

Design basis checks

Design basis checks consist of checking the basis of design for the installation and determining if the methods used for the design are acceptable in the context of the fire and explosion events considered. If the structure and appurtenances have been checked for a Safety level or Ductility level earthquake loads following API RP 2A [8.26] (9th Edition Section 2.3.6e.2 or later) then the ‘strong shock’ response to explosions need not be checked.

8.7.2.3

Component checks

Component checks may be employed if the component is non-load bearing in the operational condition or if the component does not form part of the main framing. Methods of dynamic response assessment such as Biggs method [8.5] may be used. Where loads from connected Issue 1

May 2007

Page 320 of 493

FIRE AND EXPLOSION GUIDANCE structures are represented component check methods may be employed. There are however many limitations on the method which are discussed later in Section 8.7.6. A major consideration in explosion response is that deflections of the structure must be limited to allow escape. Typically the deflections into escape ways should be limited to about 150 mm. The allowable deflection into equipment spaces will depend on the clearances to equipment. The deflections of the Primary structure will normally be satisfactory if it passes the normal strength or utilization checks. Blast and firewalls are however designed to deflect to exploit the ductility of these items and so deflection checks for these items will be necessary. Buckling checks must also be performed to ensure that the full plastic capacity of a member can develop.

8.7.3


The integrity of an offshore structure may be checked using a linear, elastic, beam model. It is conservative not to include the restraint from the cladding or barriers in the primary frame computer model. In some circumstances it is advisable not to include the cladding as plate elements as the shear restraint from these elements will be overestimated in a small deflection elastic model. This applies particularly if an external explosion load is considered which puts the side walls with respect to the pressure into shear. In a dynamic analysis the masses and their distribution should be included in the model. In checking the primary structure it is conservative to include the loads from barriers but to ignore their strength contribution. The response of cladding panels and plates that form part of the primary structure may be analyzed in detail using finite element analysis assuming the supporting beams are fixed at the main nodes of the structure. The justification for this is that the stresses in the panel are dominated by local response of the panel out of plane and that the stresses induced by the deflection of the main framing are comparatively small. If necessary this assumption can be checked by application of prescribed displacements to the edge of the panel corresponding to the frame response. Buckling checks must be performed to ensure that the full plastic capacity of a member can develop. These checks should be made particularly for deck beams loaded from an explosion below as flanges usually in tension may be in compression during the explosion. These checks should ideally be performed using the loads for the DLB and SLB load cases. Deck beams loaded by an explosion below should also be checked for re-bound effects. Concerning the inclusion of static loads, an equivalent static load as described in Section 8.3.3, will need to be defined for application of explosion loads as a static load case. The dead loads in the structure need to be combined with a realistic estimate of live or operating loads to perform a strength level analysis treated as a design load case. Environmental loads need not be included. API [8.26] recommends that 75 % of the live loads are included in the combination for the earthquake analysis. It is recommended that the same proportion of live loads is taken for the explosion load case. The loads from an existing fatigue analysis load case may also be suitable. A number of issues must be considered when applying code checks for Strength level analyses. Blast resistant structures and their supports are designed to respond in a ductile way to explosion loading mainly in bending. The shear behaviour of structures at their supports and in the joints of the primary frame will also affect the utilization factors derived in Issue 1

May 2007

Page 321 of 493

FIRE AND EXPLOSION GUIDANCE the code checks. The safety factors implicit in the code checks will be different from those associated with bending. Shear strains at supports should generally be limited to the elastic limit. Additionally, for a dynamic situation these shear forces will be quite different from the values obtained by static analysis as a result of the inertia forces acting on the structure. The benefits of this effect are exploited in blast wall design, as the support or reaction loads may be less than the applied overpressure load. Plastic deformation of a blast wall also has the effect of limiting the reaction loads on the supports. For a loading duration near the natural period of the member the shear forces could be higher. Checks should be made where this is likely using a dynamic amplification factor based on the ratio of load duration to natural period (see Figure 8.1). Code checks may be re-interpreted to take account of the inherent reserves of strength, both material and plastic reserves.

8.7.4

Ductility level analysis

8.7.4.1 Interpretation of the output from a non-linear finite element frame analysis For most ductility level analyses code checking will either not be appropriate or the response simulation software will not contain a code check module within the software. Checking of members will be done explicitly with regard to performance standards, which may take the following forms.

•

Strength limit checks similar to code checks; failure is defined to occur when the design load or load effects exceed the design strength. This criterion may be applied in the plastic region.

•

Deformation limit checks. Permanent deformation may be acceptable so long as safety critical equipment is not impinged upon and collapse is not caused even in the presence of a fire. Mechanisms may be formed momentarily during an explosion.

•

Buckling checks, which identify where plastic response may be limited by local buckling.

•

Fracture checks to identify weld and member failures.

Members may be classified as plastic, compact or non-compact (BS5950) [8.27]. Plastic and compact members will generally reach their full plastic capacity before buckling. If the structural response software is capable of representing finite displacement effects, plates may be included in the model to represent barriers and loaded surfaces. The inclusion of plates with equivalent thickness to represent mid-point deflection will also help to represent the tension and shear effects from these items. The restraining effect of cladding can conservatively be omitted from the computer model so long as the loads applied to them are applied to the bounding members according to the area associated with each one. Some packages will not take account of the loss of shear restraint from the cladding as it is deformed; in this case it is preferable not to include the cladding as plates in the model.

Issue 1

May 2007

Page 322 of 493


Deformation limits

Deformation limits have been discussed in Section 8.5.3. Additional Guidance is given below. Compact sections may be designed using code checks without supplementary local buckling checks up to first hinge formation. Section 7.2 of FABIG Technical Note 4 [8.28] gives formulae for checking for local buckling of beams working beyond the elastic limit. Checking of columns under axial compression is dealt with by Kato [8.29]. In most situations blast walls are arranged to span from floor to ceiling without direct support from the columns. Isolated columns only receive load from dynamic pressures and could be in tension during an explosion. Allowable ductility ratios based on earthquake design practice are available for I-sections, box sections and circular sections from the literature [8.29]. Buckling checks must be performed to ensure that the full plastic capacity of a member can develop. These checks should be made particularly for deck beams loaded from an explosion below as flanges usually in tension may be in compression during the explosion. These checks should be performed using the dimensioning explosion load level. Table 1 of FABIG Technical Note 4 [8.28] gives criteria for the prevention of lateral torsional buckling based on slenderness ratios for beams. Large deflection effects such as web crushing and flange curling are dealt with Section 7.4 of the FABIG TN [8.28].

8.7.4.3

Joint design

The principal ultimate failure mechanism for joints is rupture or brittle fracture unless the joint is stronger than the members which are connected to it. The basic design principle is to design them so that loading or imposed rotation causes ductile deformation of a connecting member. This follows general practice in earthquake design. A more detailed appraisal is given in Section 9.4 of the FABIG Technical Note 4 [8.28].

8.7.5

Single degree of freedom idealisations

The basic analytical model used in many blast design applications is the single degree of freedom (SDOF) system. Much of the guidance developed is based on the Biggs method. Other methods based on an energy balance to obtain iso-damage curves developed by Baker [8.30] are also adopted and the basis and limitations of these techniques are described in this section.

8.7.5.1

Component response – Biggs’ method

Components may be analysed in isolation as long as the interaction with the surrounding structure through fixity and the applied loads are negligible or are represented in the component model [8.25]. Single degree of freedom (SDOF) methods represent a structural system as a single mass whose motion is resisted by a single linear or non-linear spring. The magnitude of the mass and the stiffness of the spring are determined such that the displacements in the SDOF model are the same as a characteristic displacement of the real system, usually taken to be a point at mid-span. The SDOF method is limited to structural systems, which can be easily simplified to a single mass and spring. These are systems where the overall response may be represented by a Issue 1

May 2007

Page 323 of 493

FIRE AND EXPLOSION GUIDANCE characteristic displacement and the deflected shape is similar to the first or lowest mode of vibration of the system. The SDOF method can easily be programmed onto a computer, which can calculate the displacements at each time increment. The equations of motion can be modified during the time-stepping process, to allow the modelling of changes in structural behaviour at certain displacements. For example, the change in structural stiffness caused by plastic deformation can be introduced when the yield displacement of a beam has been exceeded; hence realistically modelling the increased displacements that occur after plasticity has been reached. Explicit solutions of the equations of motion do not have to be found, and hence it is relatively simple to use non-linear force and resistance inputs without significantly increasing the complexity of the program. This is particularly useful in the analysis of blast panels, where the resistance-displacement relationship is complex. The Biggs method requires two basic inputs, the resistance displacement curve and an idealized loading time history. Design charts are available [8.2, 8.5] for the calculation of the peak response, x max , given the load duration to natural period ratio, t d T , and the ratio of peak overpressure load to component ultimate plastic resistance, Fm R m . The charts are based on simplified bi-linear resistance behaviour, which is inaccurate for fully or partially fixed members as well as for members where tension effects are significant. This procedure is illustrated in Figure 8.5. The mass and stiffness of a structural member must be carefully represented in the SDOF model to ensure that the model displacements accurately represent the displacements of the actual member. The mass and stiffness of the member, as well as the loads applied to it, are modified using transformation factors which are calculated taking into account the deflected shape and the loading and mass distributions [8.2, 8.5]. The values of the transformation factors are dependent on the deflected shape of the member under the blast load. If the deflected shape of a member changes as it is loaded (for example if plastic deformation occurs) the transformation factors must be adjusted. Methods of calculation of mass K M and stiffness K L transformation factors for beams and panels are given in the literature [8.2, 8.5]. The natural period of the member is given by:

T = 2π where

ke

Me ke

M e = Actual member mass M times K M , the mass transformation factor. = Actual member stiffness k times K L , the stiffness or load transformation factor.

A typical idealized resistance-displacement curve for a simply supported beam is shown in Figure 8.5 [8.25]. Under increasing uniform loading, the member deflects elastically up to its yield displacement x e . Further loading results in no increase in the resistance of the member it is assumed that the member is deforming purely plastically. If the displacement reduces after plastic deformation then it is assumed that the resistance of the member returns to the preplastic (or elastic) form on a line parallel to the line representing the initial elastic deflection. Typical member response is shown in Figure 8.3. Member damping is not usually modelled in this analysis, and hence the member oscillates freely after the blast load has been released. In practice, damping is not important, as it is generally small for structural members oscillating Issue 1

May 2007

Page 324 of 493

FIRE AND EXPLOSION GUIDANCE in air, and in any case it is the maximum displacement rather than subsequent oscillations, which is important.

Issue 1

May 2007

Page 325 of 493

FIRE AND EXPLOSION GUIDANCE Figure 8.5 - Biggs’ single degree of freedom model

8.7.5.2

Representation of fixity conditions

The degree of rotational and axial fixity at the ends of a structural member affects its elastic stiffness and hence its natural period. The bi-linear resistance - displacement relationship used in the Biggs’ design charts is only accurate for simply-supported members, where the member reacts either purely elastically or purely plastically. For partially or fully fixed members, elastic/plastic behavior occurs before the member reaches its ultimate plastic resistance. The Biggs’ charts use an approximation of member stiffness to give a bi-linear resistance curve for all fixity conditions. The stiffness used in the Biggs’ method is determined such that the area under the ‘actual’ and ‘idealized’ curve are equal, and hence the energy or work done to a given deflection is the same for the two curves. A range of values of Fm Rm and t d T were used to generate the sets of curves shown in the Biggs’ design chart Figure 8.6 for a simply supported member under a triangular load with a rise time equal to half the load duration. Similar charts for differing rise times of triangular loading are given in references [8.2, 8.5].

Issue 1

May 2007

Page 326 of 493

FIRE AND EXPLOSION GUIDANCE Figure 8.6 - Biggs' design chart - overpressure rise time equals half load duration This chart enables the peak response of the member to be calculated. The vertical axis is in terms of the ductility, which is the number of multiples of the yield displacement the member will reach under the loading. To use this chart;

•

Determine the peak resistance Rm, effective stiffness and yield displacement Xe for the member,

•

Determine the effective peak force Fm from the peak force Fpeak and the load factor Kl. (Fm = Kl x Fpeak),

•

Calculate the equivalent mass of the member Me,

•

Determine the natural period of the member from the effective mass and stiffness,

•

Choose the nearest curve corresponding to the ratio of Fm/Rm,

•

Read off the ductility for the peak response corresponding to the td/T for the member,

•

Calculate the peak response from the ductility indicated on the vertical axis.

The reaction loads at the ends of the member may also be estimated using this method although the accuracy may be doubtful as detailed strain information is not represented in the model. These formulae are not accurate for two way spanning panels but are reasonable for the assessment of one way spanning panels or beams. Similar charts may be constructed for partially fixed members by applying a rotational spring stiffness, K s , to the ends of the member [8.25], K s tends to infinity for a fully fixed member and to zero for a simply supported member. The degree of end fixity for a member is determined from the flexural stiffness of the connecting structure. At low values of fixity, a plastic hinge is initially formed in the middle of the member, with additional deflection causing plastic hinges to occur at the ends until the ultimate plastic resistance is reached. At high values of fixity, plastic hinges are initially formed at the ends of the member. Increased deflection causes a plastic hinge to be formed in the middle of the member. The transitional stiffness occurs at K s = 6EI L . This stiffness gives the greatest elastic resistance for the member. Here I is the second moment of area, L is the length of the member and E is the Young’s modulus for the material. The degree of fixity significantly alters the natural period of the member. The natural period for a fully fixed beam is less than half that of a pin-ended member. The ability of a member to resist axial loads is reduced if its fixity is reduced. The buckling load for a pin-ended column is 4 times smaller than that of a perfectly fixed column.

8.7.5.3

Out of plane equipment loads

Attached equipment alters the natural period of the member by increasing the mass, which must be accelerated during blast loading. A one degree of freedom idealization may be adopted to check the response of deck sections if a Screening Analysis is being performed. The effect of static out of plane loads is to cause an initial deflection of the member. The deflection will be positive in the case of a floor beam subjected to blast loading from above, Issue 1

May 2007

Page 327 of 493

FIRE AND EXPLOSION GUIDANCE and will be negative in the case of a ceiling beam subjected to blast loading from below. The initial deflection due to the out of plane loading effectively changes the position of the origin on the resistance/displacement graph. The resistance function may be modified to take into account equipment loads. The same Biggs’ chart may be used to estimate peak response so long as the natural period and resistance function are modified to represent attached masses.

8.7.5.4

The effect of in-plane loads

Whilst purpose designed blast walls will have no static loads applied to them, there is often a need to assess the capacity of module walls and columns with in-plane loads present. In-plane (i.e. axial) loads have 4 effects on the response of structural members: 1. Axial loads reduce the plastic moment capacity of a section. At the dead and live loads normally applied to structural members the reduction in plastic moment capacity is small. 2. Axial loads change the stiffness and hence the natural period of a member. The stiffness of a member will reduce to zero at the Euler buckling load. 3. As an axially loaded member deflects under blast loading an additional moment will be generated by the axial load about the original centre line of the member. This ‘P-delta’ effect is modelled by converting the moment caused by the axial load into a lateral resistance, which is then subtracted from the original beam resistance. 4. An axial load may be applied eccentrically to the member, creating an initial central deflection. The reduction of blast resistance due to eccentric axial loading is modelled by reducing the resistance of the member at the initial deflection. The dominant effect on response is the p-delta effect. As blast walls are usually arranged to span from floor to ceiling the direct explosion loads on columns are small these effects may be ignored in a Screening Analysis.

8.7.5.5

Barriers and cladding response

Blast walls are usually designed to deform plastically and act predominantly in bending to minimize the reactions on the primary structural members of the platform. A great deal of effort is usually expended in designing the edge connections of the blast wall so that the reaction loads are transmitted to the supports without damage to the supporting steelwork. Because of the inertia of the wall it is possible to design these connections such that the transmitted shear forces and moments are much less than the peak overpressure force on the wall. Purposebuilt blast walls are usually free standing, spanning from floor to ceiling and are not an integral part of the supporting structure. The capacity of a blast or fire wall with stiffened plate construction may be estimated for Screening Analysis purposes using yield line analysis for the plate sections [8.31]. Other formulations for resistance estimation are given in the API Bulletin Reference [8.31]. Work by Shell [8.32] indicates that the ultimate capacity of panels may be much larger than formerly thought. In particular the finite deflection capacity of a simply supported plate is larger than the classical estimates of the capacity of a clamped plate with the same dimensions and span. The possible failure modes of the wall may include panel, stiffener and whole wall failure. Each mode corresponds to a different plastic hinge, or yield line pattern. Local and torsional buckling Issue 1

May 2007

Page 328 of 493

FIRE AND EXPLOSION GUIDANCE of stiffeners and wall plate may also occur before plastic hinge formation. The failure mode corresponding to the lowest ultimate resistance is the critical failure mode of the wall. The calculated resistance will also depend critically on the edge support conditions assumed which may in turn depend on the form of loading. High pressure loading on adjacent panels may give rise to clamped edge conditions between panels even though the panels would not otherwise merit this approach. Tension and membrane effects often indicate an increased resistance but the restraint from the surrounding structure through inertia or stiffness may not be sufficient for these effects to be fully mobilized. Penetrations such as piping and cable runs should be arranged to pass through the wall at the top or bottom of the wall to limit deflections and induced strains in the wall. The penetration should be fire and gas proof. The penetrated section of the wall should be designed to have the same stiffness and strength as those parts of the wall where no penetrations exist. The dynamics of the wall and penetrations may need to be checked if large mass items are attached to the wall. Efforts have been made to include tension and membrane effects into Biggs’ method [8.25, 8.33, 8.34] with mixed success.

8.7.5.6

Rebound

Rebound must also be considered. This occurs when the load has subsided and the stored elastic energy in the wall is released. This may be taken into account by assuming a reverse load or suction at a level of 1/3 of the original overpressure with the same duration. Biggs method may also be used to determine the rebound response if a suction phase is included in the load time history. Other authors have developed a rebound dynamic amplification factor which may be used to calculate rebound response [8.27].

8.7.6

Limitations of Biggs’ method

The advantage of Biggs’ method is that it is simple and easy to apply once the structural system is idealised into a single degree of freedom system. However, the basic Biggs model is clearly based on simple bi-linear structural behaviour assumptions which may limit its applicability for design of modern lightweight systems. It is important to bear in mind that in the past, guidance which was developed for blast resistance design was based on using structural strength, weight and standoff from the explosion source to control response. Some of these limitations of the technique which need to be considered before adopting the method include the following:

•

It is not an easy task to convert anything other than the simplest structures into equivalent spring mass models. A great deal of engineering judgement is required in determining meaningful models and interpreting the solutions. For example, modules are normally framed for lifting and to give redundant load paths, making the overall structure of the module difficult to describe as a one degree of freedom system.

•

The deformation of structural components such as walls and decks is highly dependent on the degree of restraint provided by the primary steelwork. Although some membrane action can be incorporated into the model, it is difficult to accurately model the stiffness of the boundary. This places severe limitations in trying to characterize the resistance function of the SDOF model when modelling plated structural components.

•

Ductility factors which are used are normally for idealised simple beam models. These may not be appropriate for the actual MDOF structure where different patterns of

Issue 1

May 2007

Page 329 of 493

FIRE AND EXPLOSION GUIDANCE yielding could give the same overall inelastic peak deflection but the local ductilities may be significantly different.

•

The Biggs method implicitly assumes that the deflected shape under blast loading is normally the same as the static deflected shape. Many multi-degree of freedom systems or systems with complex mass distributions do not respond in this way. This also applies to some stiffened plate blast walls.

•

The loads obtained from a CFD model may indicate that they vary significantly in both space and time requiring some conservative idealisation to simplify them so they can be used with the SDOF model.

•

The method relies on the fact that the mass can be lumped, but deck type structures are likely to have significant mass components from plant and equipment. This spatial variation in the mass may well invalidate the assumed shape function and give nonconservative results. Biggs [8.5] does address this problem but often the refinements of his method are not implemented. If the rebound is more important, which may well be the case if the ceiling of a module supporting plant is being considered, care needs to be taken [8.35].

•

The prediction of rupture is very unreliable as there is no detailed representation of the strain distribution within the structure. High ductility deflections are not well represented by the flat portion of the resistance displacement curve representing plastic response.

Although some of the limitations above seem severe, the technique has been successfully used in design situations, particularly where the resistance function has been accurately determined. FABIG Technical Note 4 [8.28] shows an example of a stiffened plate which whose resistance function was determined via a static NLFEA and combined with the spring mass model. The deflection time histories compared well with an explicit NLFEA up to pressures of the order of 3 bar. Beyond this, the model was unable to give accurate deflection values. This was thought to be due to the spread of plasticity which results in a change of the shape function used in formulating the spring mass idealization.

8.7.7

Pressure impulse diagrams

Rapid assessments of maximum response are very useful in a preliminary structural design, particularly where there are a large number of load cases to screen. The previous Biggs model described how transformation factors can be developed using an energy balance to convert the structural element into a spring mass model. The same concept is adopted in developing pressure impulse diagrams which is described in detail by Baker [8.30]. For an impulsive load, the kinetic energy imparted to a structure or structural element by a short duration pulse or external work for a long duration pulse is determined; the strain energy is then equated to the strain energy developed while the structure is deforming. A suitable shape function is required to describe the deformation under the loading and both elastic and plastic behaviour can be accounted for. The resulting expressions for the two loading regimes are then rearranged such that a non-dimensional plot of pressure against impulse can be constructed. A number of curves are normally plotted for varying levels of damage which may be defined in terms of the ductility parameter μ. This allows rapid assessment of the damage or vulnerability to a number of different loading conditions. The method is capable of representing membrane action in elements such as plate components. The method can also be applied to certain systems which are also not easy to define using a SDOF model. Issue 1

May 2007

Page 330 of 493

FIRE AND EXPLOSION GUIDANCE The method can also be taken a step further by constructing pressure impulse diagrams for a number of different elements such as beams, plates and columns for a series of damage levels. The damage calculated for each component is then combined in a weighted manner, depending on the vulnerability of each component, to define overall module damage.

Figure 8.7 - Pressure impulse diagram

8.8

Non-linear finite element analysis

8.8.1

General

The non-linear finite element analysis method (NLFEA) is potentially a very accurate tool, and often the only tool available, for predicting response. In contrast with the more conventional methods the NLFEA simulates the complete stress-strain history within the volume of the structure. Furthermore the impediments to the common use of this powerful modelling tool are continuously being pushed back by advances in computer technology. However, though the necessary computer speed and data handling capabilities may prove no longer to be a problem, it is still very much a specialist’s tool because of its general-purpose characteristics, and because the method inherently overestimates the resistance of structures. The successful application of NLFEA requires a sequence of carefully considered modelling, and possibly sub-modelling, decisions as well as a number of control checks before total confidence in the predicted results can be achieved.

8.8.2

Choice of NLFEA tools

A suitable NLFEA tool should as a minimum have the capability to account for non-linear and rate dependent material behaviour, geometric non-linearities, large displacements, local and global instability in the structural response simulation. Geometric non-linearities are here assumed to include opening and closing of gaps, material ruptures and contact between separate components.

Issue 1

May 2007

Page 331 of 493


Construction of the finite element model

One of the first choices the analyst is facing when defining a numerical model of a given physical problem is to set the outer boundaries of the model, and the type, or combination of types, of elements to be employed. In general, beam elements are employed for the analysis of complete modules, shell elements for the analysis of decks, walls and structural components, and solid elements for the analysis of connection details. The use of solid or continuum elements potentially leads to the most accurate predictions, but are also much more costly in terms of computer resources. Furthermore an increase in the complexity of the model also increases the possibility of human errors. The numerical model should include sufficient parts of the supporting structure to ensure that the end-restraints are modelled realistically. This is especially the case when determining the membrane forces developing in structural components undergoing large displacements. The membrane forces have the effect of increasing the resistance of a structural member by delaying the onset of buckling, and can also significantly alter the reaction forces. In this context it should be noted that when membrane forces develops in one part of the structure they are usually counterbalanced by compressive forces in other parts. These compressive forces may have an adverse effect on the stability of the structure. Rather than opting for a high overall level of detailing in the modelling of structural assemblies it is often possible, without loss of accuracy, to employ the output of one model to drive a displacement controlled analysis of a sub-model. An example of sub-modelling is the assessment of the containment pressure of a blast wall. Typically the stiffened or corrugated plate is represented by shell elements. A sub-model of solid elements is employed in order to assess whether or not the ultimate resistance of the welded connections has been exceeded. The converse of displacement driven sub-modelling is to use the results from a few lower level analyses, such as those carried out to find the deformation capacity of connections and welds, to define member performance standards applicable to the higher level analysis. A further complication often encountered in the NLFEA is the presence of mathematical singularities, which occur where elements meet at sharp corners. The analyst need to be aware of this numerical phenomenon, and may have to investigate this in further detail by employing refined models. In order not to overestimate the ductile capability of members, it is very important that the finite element analysis takes due account for all the potential buckling modes. As a consequence the mesh density need not only to be fine enough for apparent convergence, but need also to be sufficiently fine to represent all the dominant local buckling modes. Sufficient fineness can be obtained by dividing each structural element susceptible to buckling into at least 6-8 elements across the width. Furthermore the analyst may have to introduce imperfections or destabilising loads in order to trigger numerical buckling. For large assemblies it is not practical to make the mesh fine enough to pick up all the buckling modes. Hence the individual structural components need to be checked until the analyst is satisfied that all potential failure modes have been accounted for. Regarding meshing it is also considered to be good practice to keep the aspect ratio of the elements as close to unity as possible, and only to gradually change the sizes of the elements in the mesh. Post processing tools can play an important role when investigating whether the meshing is adequately fine.

Issue 1

May 2007

Page 332 of 493

FIRE AND EXPLOSION GUIDANCE For most models it is necessary to specify appropriate multiaxial constitutive equations for the material. For steel materials Von Mises yield criterion used in conjunction with an isotropic hardening rule and an associated flow can be employed in situations where the critical response is reached during the pass of the positive phase of the blast loading. In the special situations where plastic strain reversal is significant a kinematic hardening model is preferred. The spatial and temporal distribution of strain rates and their adverse influence on the reaction forces need always to be considered when performing a plastic analysis. When analysing structural components it is usually assumed that the pressure time history is uniformly distributed over the surface. However when carrying out a global structural analysis the ability to describe non-uniform loading, which also varies in time, is often required. Blast loading should at all times remain normal to the surface of components undergoing large displacements. The analyst should recognise and possibly need to include the fact the structure is in a state of static equilibrium at the time of blast loading. Ignoring the service loads when calculating the blast resistance will not necessarily be conservative. Permanent loads associated with heavy equipment are best modelled by transferring the load through discrete fixing points, which can be mutually constrained. Other service loads are included using a smeared approach.

8.8.4

Solution techniques in NLFEA

Two fundamental different solution techniques can be adopted based on implicit and explicit time integration algorithms. In general the explicit method is best suited for the analysis of blast loaded structures, where the transient responses are to be measured in tens of milliseconds, and large plastic deformations develop. The primary reason being that the explicit algorithm requires relatively little computational effort in each time step since no formal matrix factorisation is necessary. Implicit methods on the other hand are essentially static codes running in time domain, and will as such require much more memory and disk space. The degree of non-linearity of the problem makes the larger time steps permitted in the implicit codes of little practical value. Another advantage associated with the explicit codes is that they have an inherent ability to initiate most of the local buckling modes. The most severe limitation for non-linear finite element modelling is the dependence on low level performance standards, which in general means that a significant amount of time may need to be invested in setting up the models and interpreting the results. However in most cases the reward is a more cost efficient design.

8.9

Response of the primary structure

8.9.1

Introduction

There are a number of effects which tend to mitigate the effect of explosion loading on the Primary structure [8.23, 8.25] and enable it to resist unexpectedly high loads without modification. Detailing of barriers and connections may however be required to bring the structure up to full capacity. The loading direction resulting from an explosion may also necessitate further stiffening to prevent buckling if this is not allowed. Isolated columns and beams will be loaded by drag or dynamic pressure loads which are only important near vents and are often much less than the overpressures. The method of load calculation is discussed in the context of piping and vessels in Section 8.10. Issue 1

May 2007

Page 333 of 493

FIRE AND EXPLOSION GUIDANCE Other mitigating effects including scale effects, the limitation of reaction loads by secondary member capacity and the effects of dynamics and plasticity are discussed in this Section. Finally these effects are discussed in the context of modified code checks in Section 8.9.5.

8.9.2

Global loading scale effects

It is quite clear that the Advantica explosion test rig at Spadeadam used in the UK project on fire and explosion engineering has repeatedly been subjected to local overpressures over 10 bar which it was not designed for. The structure has withstood these pressures with minimal damage. The simplest factor, which affects global primary structure response, is the scale factor or coherence factor. The following cases are given only as an illustration of the scale effect. The precise geometry of the target structure and the loading pattern will change these conclusions and a detailed assessment of these factors should be made depending on the scenario considered. Considering the situation of a pressure disturbance travelling along a wall or for a ridge of pressure travelling across a deck, the pressure disturbance is considered to be a pulse travelling with a velocity of about 340 m/s (the speed of sound C0 in ambient conditions, neglecting convection with the gas flow) giving a length scale of the disturbance ‘ld = td x C0 of about 17 m for a 50 ms pulse. A typical bracing member or panel of length ‘l’ equal to 8 m will hence see a peak averaged pressure of 0.75 of the peak. A module wall of length ‘L’ equal to 35 m will see a peak averaged pressure of 0.25 of the peak value. This indicates a scale factor of 1/3 on the global load/member load for this situation. In situations where a large deck is considered these conclusions may only apply locally as the pressure loading pattern may be circular or irregular in shape.

8.9.3

Global received loads

Global loads on primary members are also dependent on the capacities and dynamic properties of the connected panels. Often the loads transmitted into the primary framing will be reduced by panel capacities and the delay in load transmission due to delayed panel response. The panel peak response may well occur long after the load has subsided and if a suction phase is present then the panel response itself may be reduced. Often the direction of the loading on the primary framing may be changed locally due to panel membrane effects. These membrane loads may be balanced globally if panels of similar dimensions are attached to either side of the columns.

8.9.4

Plasticity and dynamic effects

The Biggs’ chart shown in Figure 8.6 may be used to estimate the benefit to member capacity resulting from plastic deformation and dynamic effects (within the constraints that the chart is applicable to the structure and loading considered). If a member has a td/T ratio of 0.2 for example, and a ductility of unity is required (elastic response) then the static resistance to load ratio is about 0.6 and the member will resist (dynamically) a load of 1/0.6 = 1.6666 times the member resistance. For elastic response the dynamic amplification factor for this case is 0.6.

Issue 1

May 2007

Page 334 of 493

FIRE AND EXPLOSION GUIDANCE If a ductility of 10 is allowed then the resistance to load ratio is about 0.15 and the member will resist a load of 6.66 times the member resistance. Hence the ratio of the capacity allowing a ductility of 10 to the elastic capacity is 6.66/1.66 or a ratio of 4 for structures with a load to natural period ratio of 0.2. Values above 4 may be reached for structures with long natural periods (large frame structures or compliant structures). The allowed ductility will depend on the applicable performance standards. A ductility level blast performance standard could well allow a ductility level of 10 for decks and beams.

8.9.5

Modified code checks

The design of the topside components of an offshore hydrocarbon production facility is traditionally carried out using codes of practice based on conventional static design, where the elements are required to remain elastic under normal service load conditions. This normally involves comparing maximum stress levels in the member with allowable values permitted in the code of practice. As an initial screening process, this approach can be used before further checks and analyses are carried out, particularly if the overpressures are not high (say, less than 0.5-0.6 bar). The checks can be carried out with some relaxation on the design yield strength which is normally based on a guaranteed minimum value and an allowance for the increase in the yield strength due to strain rate effects. Allowing for strain rate effects will extend the elastic range and this needs to be considered in the buckling checks. Also, the forces at the connections will increase, and their adequacy will need to be re-considered. Checking primary structure against the SLB (in the case where the load is 1/3 of the DLB) will often size the members for the DLB. Experience suggests that the Primary structure will not experience the full overpressure loading as the loading acts first on secondary members, barriers, cladding and plate [8.25, 8.4]. Unity or utilization checks to the appropriate standard (e.g. AISC) may be re-interpreted to reflect the reserves of strength in the structure. When compared with a Ductility Level Analysis this approach often results in a less efficient and heavier structure. These methods will not be suitable for the analysis of a situation where a fire has preceded the explosion unless allowance is made for material weakening and geometric imperfections and permanent deformations resulting from the fire. Blast resistant structures and their supports are designed to respond in a ductile way to explosion loading mainly in bending. The shear behaviour of structures at their supports and in the joints of the primary frame will also affect the utilization factors derived in the code checks. The safety factors implicit in the code checks will be different from those associated with bending. Shear strains at supports should generally be limited to the elastic limit. Additionally, for a dynamic situation these shear forces will be quite different from the values obtained by static analysis as a result of the inertia forces acting on the structure. The benefits of this effect are exploited in blast wall design, as the support or reaction loads may be less than the applied overpressure load. Plastic deformation of a blast wall also has the effect of limiting the reaction loads on the supports. For a loading duration near the natural period of the member the shear forces could be higher. Checks should be made where this is likely using a dynamic amplification factor based on the ratio of load duration to natural period (see Figure 8.1). Issue 1

May 2007

Page 335 of 493

FIRE AND EXPLOSION GUIDANCE Code checks may be re-interpreted to take account of the following inherent reserves of strength, both material and plastic reserves. The following factors may be applied to the final utilization:

•

The explosion event is an accidental event and hence the stress may be allowed to approach yield. A factor of 1/0.66666 (1.5) is then appropriate on the allowable utilization. Alternatively the yield stress may be enhanced by the same factor to allow for non-linear relationships for some aspects of utilization factor calculation.

•

The material strain rate effect will generally give an increase of yield stress of the order of 20 %, this value is used in the nuclear industry [8.36]. This value may be higher locally, in particular in high strain regions of a blast panel. A factor of 1.2 may be applied to the acceptable utilization or to the yield stress.

•

Strain hardening will occur around regions of local plasticity. Where it is appropriate (for tension members, plastic sections in compression and/or bending) allowance may be made for this by taking the design yield strength as the ultimate tensile strength divided by 1.25 (Section 3.5.8 of the IGNs [8.2]).

•

The occurrence of plastic hinging may be taken into account by factoring the acceptable utilization factor by the ratio of the plastic ‘Zx’ to elastic section modulus ‘Sx’. This factor is generally greater than 1.12 and will be in the range 1.1 to 1.5. The member must be able to sustain the formation of a plastic hinge before buckling, i.e. in tension or be a ‘plastic’ section.

As discussed above shear checks should also be made using the correct dynamic reaction loads with strains being limited to elastic limits. Taking into account all the factors above gives a possible acceptable utilization factor of 1.5 x 1.20 x 1.25 x 1.1 (a factor of 2.5) for a tension member. Usually the benefit of both strain hardening and strain rate yield strength enhancement is not taken into account. The recommended acceptable utilization factor is hence 1.5 x 1.20 x 1.12 = 2.0 for primary members acting in bending and/or compression under explosion loading so long as the member does not buckle where local buckling is not acceptable. Discussions of buckling checks for members working beyond the elastic limit can be found in the literature [8.28, 8.29]. It is stated in Kato [8.29] that semi-compact and compact sections may be designed using code checks without supplementary local buckling analysis up to the formation of the first hinge. The above approach assumes a working stress approach is being used for primary framing design. The limit state approach may also be used with the equivalent elastic load level for the DLB (the dimensioning explosion load) derived from consideration of the differing partial safety factors suitable for the ultimate limit state and elastic limit state. Further discussions of these topics can be found in work by Walker et al [8.4, 8.25].

8.9.6

The use of NLFEA in global response

One of the key limitations to effective assessment of the global response to explosion loading, has been the time and cost of NLFEA structural analysis. The computer hardware was simply not generally available to enable the whole topsides structure to be modelled and analysed for the response to localised dynamic loading with a rapidly changing load function.

Issue 1

May 2007

Page 336 of 493

FIRE AND EXPLOSION GUIDANCE Assessment and design tended to be component oriented, with little understanding of the interaction of effects between components [8.35]. Non-linear and dynamic analyses became commercially viable for even small design houses at component level using PC based software. Finite element packages enabled single degree of freedom solutions to be improved, through consideration of support stiffnesses and axial membrane resistance. Single component assessment could be expanded to the consideration of panels or complete walls and decks. The influence of penetrations could be addressed and the detrimental effect of local stiffening on global ductility became evident. A common misunderstanding in the design of blast walls is the relationship between the design overpressure and the strength of the wall, interpreted through its stiffness. In the mitigation of explosion loads, the key consideration is the ability to absorb energy through ductility, and the delay of peak response to a time where the load has dissipated or reversed. The inclusion of penetrations and local reinforcement for the support of piping or equipment, will introduce hot spots in terms of stiffness, which may reduce the explosion resisting capacity of the wall. The deformation of the wall, when subjected to explosion loading, may also violate the integrity of any attached pipework or equipment. In brownfield reassessments of explosion resistance, simple linear elastic designs are often reviewed using non-linear, dynamic techniques to identify additional capacity without the need for reinforcement. The capacity of a blast wall or deck, in terms of explosion loading, is limited by its weakest component. This could be the situation where the connection is made by means of a weld with a 5 % strain limit, as compared to the 15 % strain limit of the parent material. In some situations, making a wall more flexible may increase its ultimate capacity to resist blast. Removing or revising over-stiff details, say by making a heavy column base pinned rather than fixed, may allow the development of plastic hinges throughout a wall and through greater overall deformation before key component failures. Later response may exploit the benefit of the suction phase in the loading.

8.9.7

Global response considerations

Another key area for not fully appreciating the response of the structure to explosion loads is at the interface between walls and decks, or in the open trusswork behind a blast wall, which ties two decks together. Finite element analyses may well consider a full wall or deck, but modelling a complete module, integrated deck, an assembly of modules or complete topsides of a fixed or floating facility requires another order of magnitude of effort, computing power and cost. Accurate modelling of both geometry and mass distribution is required, in order to achieve a realistic dynamic response. Many different blast simulations may be required in order to generate a realistic envelope of responses for specific details. A balance has to be reached between the extent of the model and the level of detail in order to be cost effective. Inclusion of small details, such as penetrations and stiffeners, may not influence the global response and thus becomes irrelevant for a global model. Application of point masses at deck level at primary model nodes may also be sufficient to achieve an acceptable accuracy for vertical dynamic response. Elevated masses may be required for significant items of equipment or vessels where rotational effects may be important and local horizontal loads are present. Major pipework may need to be modelled if it could influence the dynamic and explosion response of the structure, particularly if it has been detailed in such a way as to provide an explosion resistance load path between decks via pipe supports.

Issue 1

May 2007

Page 337 of 493

FIRE AND EXPLOSION GUIDANCE Elastic global models may be conservatively used to determine accelerations on primary elements remote from an explosion, or on complete modules such as the Living Quarters, or for lifeboat and muster areas. Dynamic amplification for such areas can thus be determined for use in local analysis. Rigid boundaries for panel assessments are not necessarily conservative if the operating condition deformations are not considered. The sensitivity of the explosion capacity to deadweight and operating load should be addressed, as should the sensitivity to residual fabrication deformations and stresses. Welding residual stresses should also be considered in connection assessment, especially if key components are limited in capacity by the 5 % weld strain limit. The weld geometry needs to be addressed for ultimate capacity calculations, especially in fillet welded details, as a considerable portion of the total capacity of a connection may be absorbed by secondary loads generated by eccentric load paths. In “brownfield” re-assessment of explosion capacities, deflection criteria may become critical, especially in circumstances where blast panels come into contact with primary framing braces at loadings beyond the design overpressure. This can be common with linear elastic designs, say, to 600 mbar design overpressures, which are revised to 2 bar overpressures following updated CFD modelling. Care should be taken over the capacity of the framing braces, in that they may not have the capacity to carry the transferred loads from the blast wall in combination with the dead loads from the deck above. Destabilisation of the brace could result in potential toppling of any supported tall structures. In these circumstances, the total dynamic loading on the brace needs to be considered, including the explosion loading on connected decks. An advantage of global models is the ability to visualise modes of mitigation, which may otherwise not be apparent when focussing on individual components or panels. Tying long span decks together to limit the deflection under heave is a means of limiting damage to equipment and pipework, which would otherwise suffer consequentially from large displacements. The loading required for design can be extracted from a global dynamic analysis which incorporates the ties, the ties affecting the dynamics of the deck girders. Care must be taken in detailing, however, in order to prevent operating loads being transmitted into the ties.

8.10

Response of equipment, pipework and vessels

8.10.1

General

In areas of a production facility with an explosion risk, the following load conditions or actions need to be addressed for pipework, vessels, equipment, cabling and their supports, plus other miscellaneous items, such as scaffolding and loose items:

•

Dynamic pressure loads (comprising drag and inertia components);

•

Differential pressure;

•

Differential movement;

•

Strong vibration;

•

Missile impact and generation.

Areas remote from, or physically separated from, the areas with the direct explosion risk should also be assessed for these actions if there is a potential consequence to personnel safety or integrity of safety critical systems, including personnel escape provision. Issue 1

May 2007

Page 338 of 493

FIRE AND EXPLOSION GUIDANCE Dynamic pressure loads are discussed in Section 6.11 and are potentially the most severe design loadings on equipment, vessels, pipework and cable trays. Differential movements may generate significant loadings where adjacent supports respond in a differing manner to an explosion. For instance, a vessel will be supported from the deck of a module, but pipework connected to the vessel may be supported from the roof of the module. In an explosion, the deck and roof will deflect in opposite directions, imparting loads on the vessel nozzle, potentially triggering a further hydrocarbon release, which could be catastrophic in terms of escalation of the event. Similar effects could be seen with pipework connections to equipment and with pipe branches; or where supports are positioned either side of stiff deck elements leading to support rotations in opposing directions. Loose items subjected to blast wind, components that break free of their supports as a consequence of explosion loading effects, or fragments of equipment or vessels generated by the break-up of those items in explosions all have the potential to become missiles which can then impact other equipment, vessels, pipework or critical electrical and control systems. The potential for loose items to become missiles needs to be controlled by good working practices; the potential for items to break free and become missiles, or for vessels and pipework to break apart and become missiles, needs to be controlled by design. The dynamic response of the vessel or equipment on its support steelwork is fundamental to the reactions that are generated. Very stiff supports will generate high reactions; flexible supports will generate lower reactions, however, too flexible a support condition may not be tolerable for operational reasons, or retaining continued integrity following an explosion event. Too much allowable movement may also contribute to vibration modes of failure for connecting pipework.

8.10.2

Response of equipment and vessels to explosion loading

For large diameter vessels, there should be consideration of the near-uniform pressure loading, as well as differential pressure and blast wind. Process vessels need to be assessed for the vessel stability when subjected to explosion overpressures. In many cases the blast overpressure will have negligible effect if the internal operating pressures are of a greater magnitude. However, the external overpressure could be a significant cause for concern if ignition was to follow blowdown, as process vessels are not normally designed to withstand net external pressure loads in excess of 1 bar. In most circumstances, the critical explosion loading effect on a vessel will be a lateral loading or overturning effect on the supports. For “brown field” reassessment cases, this may be well above the design loading magnitude, as the design explosion loading would have been on a par with the accelerations allowed for in the transportation or earthquake scenarios. Under the higher explosion loadings now prevalent, this may no longer be the case and modification of the vessel supports may be required. As discussed above, support strengthening may lead to an increase in the support reaction, so modifications should be carefully assessed. Often a linear elastic design may be demonstrated to have adequate ultimate capacity if re-assessed using non-linear dynamic techniques, with full use of material certificates. The vessel should be considered rigid in order to develop support reactions, but the uncoupling of loads onto the deck steelwork needs to be considered in conjunction with the deck loading from explosion. A simple SDOF solution may not be appropriate, whereas simple NLFEA would be. For equipment supported on Anti-Vibration Mounts (AVMs), this could mean retention of lateral stops or shear keys, which would otherwise be removed after the transport and installation phase. The deck plating or under-deck bracing must be assessed for adequate resistance to Issue 1

May 2007

Page 339 of 493

FIRE AND EXPLOSION GUIDANCE the lateral explosion loads. Tall equipment (relative to the support footprint) must be assessed for the possibility of toppling under explosion loading. A similar approach to the large vessels discussed above can be taken for the support reactions and the response of the under-deck steelwork. Attachments to equipment must be assessed for the possibility of differential movement between the equipment supports and the attachment supports. This is particularly important with small bore pipework, e.g. fuel gas lines and instrument pipework. Long spans for smallbore pipework should be avoided in order to limit vibration problems caused by flow turbulence, but normal operating vibration considerations are likely to govern.

8.10.3

Response of pipework to explosion loading

Pipework supports are generally designed to withstand gravity loads and allow thermal expansion of the line. Flowlines are designed to tolerate a specified rotation or lateral movement of a well conductor or pump caisson. In some instances, the lateral loading caused by slugging forces must also be allowed for. However, the lateral loading generated by blast wind loads must also be accounted for, in order to prevent excessive mid-span deflections or displacement of the pipe from its supports, which in turn lead to a rupture of the line or potential flange leakage. In general terms, line pipe is inherently ductile and consideration should be given to the adoption of flange class ratings which are higher than the design pressure rating of the pipe, in order to prevent flange failure under explosion loading [8.37]. Differential movement between adjacent supports, whether at a pipe branch, transition from deck to roof support or between modules must be accounted for when considering explosion loading. It may well be prudent to design the first support from a pipe branch as a structural fuse, in order to prevent a line from breaching under explosion loading. Explosion loading assessments should not be restricted solely to oil and gas lines, but must also include deluge pipework, as these are Safety Critical Elements for potential fires following explosions. Pipe runs on F(P)SOs are designed to accommodate significant movement due to vessel flexing. Safety critical pipework on fixed structures in regions of significant potential movement due to explosion loading, should have the same considerations. Explosion loading on pipework will be significantly increased by turbulence and congestion. Reduced piperack support reactions may be achieved by the use of baffles or slipstreaming aids, in order to present a single large rounded face to an advancing shock wave. Given the problems associated with developing a time-domain loading for a complete pipe run, an appropriate test for robustness would be to consider each pipe span as simply supported and use either a Biggs’ SDOF approach or a static load solution in a standard design pipe stress analysis. The tension capacity of the piping dominates the response and a pure plastic resistance may be assumed for the pipe span with the mid point deflection being the relevant response variable. Plastic hinging soon occurs at each end of the pipe when the pipe may be assumed to be simply supported. Consideration of the equilibrium of a length of pipe between supports as a catenary yields a time history of the tension Tp in the pipe and the extreme deflection of the mid point enables the plastic strain at each end to be estimated using methods given in the previous section. Issue 1

May 2007

Page 340 of 493

FIRE AND EXPLOSION GUIDANCE An average plastic strain limit of 5 % and a peak local strain limit of 10 % may be used to determine failure of the pipe. These failure criteria apply to all reasonable pipe sizes and are insensitive to pipe diameter. If the pipe supports are attached to beams of similar section properties then the differential movement of the deck under an explosion should not be a problem.

8.10.4

Strong vibration

Strong vibrations are caused by shock or displacement waves transmitted through the decks and walls as a consequence of the explosion. These need to be allowed for in the design of sensitive equipment, piping, electrical connections and instrument panels. Strong vibrations could lead to the toppling of tall items of equipment or instrument cabinets, damage to valve actuators or large bending forces on long unsupported spans for pipework or cable trays. It should be recognised that vibrations can be either vertical or lateral, depending upon the support arrangement of the item relative to the deck or wall transmitting the shock wave. If the structure and SCE’s appurtenances have been checked for a safety level or Ductility Level Earthquake loads following API RP 2A 9th Edition (Section 2.3.6e.2) [8.26] or a later version, then the ‘strong shock’ response to explosions need not be checked. In the Cullen document [8.38], it was reported that ‘a number of witnesses spoke of the severe vibration associated with the initial explosion. People were thrown off chairs and knocked over’. Once the force is calculated it may be applied to a dynamic global platform structural model. The displacements and accelerations at points on the topsides may then be calculated. These accelerations are potentially damaging to essential safety systems such as:

•

Emergency escape and rescue systems;

•

The temporary refuge and its supporting structure;

•

Emergency lighting systems

•

Emergency power supply and battery systems;

•

P.A., telecommunication systems and navigation aids;

•

Fire water systems;

•

Emergency shut down systems.

One further consequence of shocks of this kind is that pipe runs between modules may be stressed due to relative displacements between modules. This would be particularly important in Safety Critical Elements, e.g. for the fire water main. If the accommodation module or Temporary Refuge (TR) is supported on ‘anti-vibration’ mounts, the acceleration may be further amplified due to resonance by the low frequency components of the shock. For a fixed platform the integrity of the substructure should be checked against out of balance explosion loads.

Issue 1

May 2007

Page 341 of 493

FIRE AND EXPLOSION GUIDANCE It is likely that the explosion loads will have a duration in the range of 50 to 100 ms whereas the substructure will have a natural period of sway in the range of 2 to 4 seconds. For elastic response of the jacket, a dynamic amplification (or reduction) factor may be calculated from the ratio of load duration td to the natural period T or extracted from the curve given in Figure 8.2. A reduced equivalent static load may then be derived which can be applied to the fixed platform computer model. Typical dynamic reduction factors of the order of 0.05 may apply in which case problems with the substructure are unlikely. This load case may then be eliminated from consideration, on the basis that the equivalent static loads on the substructure are smaller than those induced by waves and currents. Floating, tethered and moored installations are unlikely to suffer serious response to this form of loading because the natural period in the horizontal direction is much longer than the load duration. Awareness of strong vibration is therefore essential in the design and protection of safety systems used for emergency shutdown, emergency power, communications, fire protection, deluge pipework, fire and gas detection, HVAC, EER etc. Systems which some may consider not to be “Safety Critical” also need to be assessed for strong vibration loading: e.g. grating on escape routes, stair towers, module stools. Such systems are fundamental to the safe evacuation of personnel from the facility and strong vibration or blast wind loading may be the governing design load case. Control and instrument cabinets in utilities areas, which are protected from the direct influence of explosion loading, should be assessed for the risk of toppling by strong vibrations. Battery racks should have a retaining bar across the front of each shelf. Even book shelves in critical areas such as the Control Room should be assessed for the risk of displaced objects, which may fall and damage control panels or cause injury to key personnel. Massive objects with sensitive connections to adjacent machinery should be particularly addressed. Isolation or shut down valve actuators, rotating machinery such as pumps, turbines and compressors, HVAC dampers and lifeboat mountings should be reviewed for the consequences of shock or strong vibration loading. Walkdown is now a commonly used tool to perform a qualitative assessment of the risk of damage from strong vibration [8.37].

8.11

Areas of uncertainty

There are a number of areas which still need to be addressed that relate to structural response.

•

Assessment of response at high ductility levels is still difficult due to uncertainties in predicting both the performance of welded details under dynamic loading and in sensitivities in finite element modelling.

•

The difference between guaranteed minimum yield stress values and actual coupon tests can give rise to a significant increase in reaction force, particularly in strain concentration regions which will amplify strain rate behaviour.

•

The ductility values given in Table 8.5 are based on 2-dimensional beam models. However in 3-dimensional systems tri-axial effects, effects of bending and twisting in the third dimension are significant and will reduce the available ductility. There are limited performance criteria in order to assess the reduction in available ductility.

Issue 1

May 2007

Page 342 of 493


9 Systems for fire and explosion management 9.1

Common issues

Detection, control and mitigation systems should be selected and specified according to the following principles:

•

The assessment of fires and explosions should be used to determine the need for a system.

•

Each system should have a clearly defined role.

•

Systems should be selected and specified to provide an appropriate balance between prevention, detection, control and mitigation.

•

Systems should be resourced with regard to the risks from the particular hazardous event being addressed and their role and importance in reducing that risk.

•

Mitigation systems should be specified after taking into account the contribution from the detection and control measures in reducing the extent and duration of the hazardous event.

•

Systems should preferably be specified in terms of functional parameters, reliability, availability and survivability.

•

Systems should be capable of being operated, maintained, inspected and verified on the installation. The design should therefore take these needs into consideration.

•

Systems should be selected and specified after appropriate consultation with those responsible for their use and operation.

•

Systems which may introduce a new hazard, exacerbate an existing one or impair the performance of another system should be avoided or the interaction should be addressed. These drawbacks must not offset the risk reduction provided by the system, i.e. there should be a significant overall benefit.

9.2

Selection and specification

9.2.1

Overview

The purpose of this section is to assist those responsible for the selection and specification of detection, control and mitigation systems to select an appropriate combination of measures. The arrangements selected to manage each identified hazardous event should be such that the risks to persons are reduced to ALARP. The provision of some systems may eliminate or modify the need for others and may affect the quality of other related or supporting systems. The result of the joint effect of contributing systems should dictate the selection and specification. Systems should be chosen with a full understanding of the likely hazardous events, their means of escalation and the realistic expectation of the capability of the systems when new and after some time in operation. Issue 1

May 2007

Page 343 of 493

FIRE AND EXPLOSION GUIDANCE The provision and quality of the prevention and avoidance measures may influence the probability of occurrence of an initial event. The consequences of this event will be determined by the provision and effectiveness of the control systems. The provision of mitigation systems will limit the consequences of escalation. Detection systems may be used to initiate prevention, control and mitigation systems. The combined performance of each of these systems will determine the overall risks to life. The selection of an appropriate combination of measures in a new design will require the interaction of both designers and the Operator/Owner so that the relative contribution from, and dependence on, procedural measures and engineered systems is fully assessed and understood by all involved. In the case of existing installations, all the measures should already be in place but the relative dependence on engineered systems and operational measures should be understood by those responsible for the maintenance and operation of systems. Factors to be taken into account in the selection and specification of systems include:

9.2.2

•

severity of the eventual consequences;

•

frequency and severity of the initiating events;

•

the functional role of the system and the suitability of that system for the fulfilment of that role;

•

applicability to the circumstances in which they will be used;

•

timescale and potential for escalation of an initial event to a major accident;

•

limitations that the systems may place on operations and vice versa;

•

hazards which may be introduced by the systems themselves;

•

requirements for, and practicality of maintenance, inspection and testing;

•

capital and maintenance costs;

•

availability, suitability and applicability of alternative systems;

•

performance of the combination of systems in meeting the risk criteria;

•

any adverse effect that the system may have on hazards or other safety systems.

The definition of a system

The extent of a system should be described so that its role and performance can be defined. This may range from an overall system such as an active fire protection system to a discrete part such as a deluge system. These may either have a direct role in counteracting a particular hazardous event such as preventing rupture of a vessel or a support role for these systems such as firewater supply or fire and gas detection.

Issue 1

May 2007

Page 344 of 493


The role of a system

The role of a system should be clearly defined by providing a statement of what the system is intended to achieve. A system may be required for more than one hazardous event and may also have more than one role, (e.g. a deluge system can reduce oil burn rate, or prevent catastrophic rupture of a pressure vessel under certain fire conditions). It should be clear how the system relates to its role in managing each particular event.

9.2.4

The suitability of a system

The systems chosen should be suitable for the role which they have to perform. If a system is required to detect, control, mitigate or survive a fire or explosion, it should be specified so that it is suitable for the range of hazardous events for which it is to be used. These are identified in the assessment of fires and explosions and it is important that they should be considered, as appropriate, for the system. In specifying a system, it may be appropriate to specify the type of fire or explosion, the release and combustion conditions or particular characteristics such as: For Fires:

•

flame temperature;

•

heat flux;

•

flame velocity;

•

type and concentration of products of combustion.

For Explosions:

•

overpressure;

•

pressure profile;

•

drag force;

•

missile velocity or energy.

Where practical, the system suitability should be verified by representative testing. Care should be taken when extrapolating results or basing a design on a purely theoretical analysis.

9.2.5

The applicability of a system

Each system should be designed to ensure it can be installed, maintained and tested effectively taking into account the working environment, access and site conditions. It should not introduce undue maintenance and repair requirements such that either the system will have limited availability or require disproportionate resources on the installation to maintain it. It should not seriously inhibit the day to day activities on the installation. A system should normally be capable of fulfilling the role for the anticipated life of the installation providing that the designated inspection, maintenance and repair requirements are carried out. If this is not practical, or cannot be guaranteed, it should have a predetermined lifespan at the end of which it should either be replaced or fully assessed to determine the extension of that lifespan.

Issue 1

May 2007

Page 345 of 493


Types and variations

There is a large variety of systems ranging from those operating on fundamentally different principles to subtle variations between different manufacturers. For example, there are a number of types of passive fire protection systems including demountable panels and spray applied systems and there are variations within these different options. The choice of a particular type of system should primarily be based on the list of parameters in Section 9.2 for selecting the system. These parameters should be assessed for the full lifecycle of the system taking into account the effects of the environment and site conditions. In considering the applicability, the ability to operate, maintain and repair it should be given equal consideration to the initial cost and ease of installation. Systems should, where possible, be simple and robust to enhance their long term effectiveness.

9.2.7

Interaction and limitations

System interactions are those characteristics of a system which may:

•

introduce a new hazard;

•

increase the frequency or consequence of an existing hazardous event;

•

reduce the effectiveness or reliability of another safety system.

These should be identified and, where necessary, either an alternative safety system selected or measures put in place to address the interactions. Interactions include:

Issue 1

•

increased direct risk to personnel operating, maintaining or testing the system;

•

increased numbers of leak points and breaches of containment due to the addition and testing of process safety systems;

•

increased explosion overpressures due to the obstruction caused by it or ladders / walkways / scaffolding needed for its inspection, maintenance or operation;

•

corrosion caused by the system; for example due to deluge system testing or increased by passive fire protection;

•

corrosion due to increased saline exposure resulting from free ventilation and open venting to reduce explosions;

•

increased probability of ignition for example due to deluge water ingress to electrical systems;

•

limitations on inspection, maintenance and non-destructive testing of plant, equipment or structure as a result of passive fire protection materials or enclosures;

•

deterioration of passive fire protection systems caused by repeated removal for inspection of the protected plant;

•

increased explosion overpressure caused by firewalls;

•

reduced ventilation caused by ftrewalls;

•

projectiles created by safety systems such as vent panels. May 2007

Page 346 of 493


Functional parameters

These are the parameters which define whether or not a system will fulfil its role and its effectiveness. Each system should be examined to identify which of these parameters are needed to define functional specification. These may then be used as the basis of design, for initial verification that the identified role is fulfilled and for continued verification during the life of the installation. They represent the minimum acceptable performance standard to be achieved during routine testing. Failure to achieve this performance would require remedial action or justification.

9.3

Impact of fire and explosion type characteristics

9.3.1

Requirement

It will be appropriate to define either a particular hazard condition or a characteristic dependent upon which is more suitable for system specification or verification. It will also be necessary to define a maximum fire size or explosion overpressure (for protection) or a minimum fire/gas cloud size (for detection) in accordance with the design accident loadings or boundary. Where a system has to detect, extinguish, suppress or protect against one or more particular hazardous event, it should be specified so that it is effective for all these events. The coverage or area/hazard of application should be defined. It may be a list of equipment, a discrete part of the installation or a part of a module.

9.3.2

Response time and duration

The response time should be considered for all active systems which are required to respond to emergency or hazardous events. The time should be taken from the start of the event until full functional performance is achieved. It is not necessary to set response times for the individual components as it is the system response which is important. However, individual component responses may be useful as an aid to system confirmation through component test. The time taken to detect an event should also be taken into account in determining the systems overall response time. Once activated, the time during which a system is required to operate in order to fulfil its role should be defined. This will normally be until the hazardous event is adequately reduced or personnel have been moved to a place of greater safety.

9.3.3

Logic

The initiation and activation logic should be clear. There may be a range of escalation paths and the sequential activation of parts of a system or other supporting systems should ensure suitable operation in accordance with the defined protective role. As well as ensuring actions, the controlling logic can also prevent actions until certain others have taken place.

Issue 1

May 2007

Page 347 of 493


Sensitivity/preset values

Systems which are required to operate at a particular level should have this value defined, together with the acceptable limit of tolerance. This can apply to preventive measures which alarm or operate when equipment or process characteristics deviate from their design or operating specification and to detection systems which alarm and possibly actuate control and mitigation systems.

9.3.5

Flow/application rates/concentration

Active fire or explosion protection/suppression systems will require a minimum or maximum flow, application rate or a concentration (where an additive is needed) to fulfil their defined role. Flow rates should include an allowance for losses during the application of the fluid, for example, wind blowing the fluid away from the fire, loss of deluge water due to thermal effects, or losses after application such as gaseous extinguishing agent leakage from an enclosure. Concentrations should consider the sensitivity of the required percentage and whether mixing would be effective. There should also be a specification of duration of the chemical additive. For example, fire-fighting foams may have adequate additive for say, 30 minutes but the systems would be expected to continue to deliver firewater after the additive had been used.

9.3.6

Environmental conditions

It will be necessary to specify the range of environmental conditions such as air velocity, temperature, humidity, visibility or contaminants in which a system is required to operate. System components should be suitable for long term exposure to the environmental and operating conditions either through their design, material qualities, their protective coatings or enclosures.

9.3.7

Failure criteria

Where a system is provided to prevent a failure, this may have to be defined by a particular characteristic. This may also be associated with duration, as the role may be achieved so long as failure does not occur within a specified time. Following guidance from the earlier sections in this Guidance, examples would include limiting structural steel temperature in a fire, or impairment criteria within a TR.

9.3.8

Survivability

The exposure of parts of control or mitigation systems to a hazardous event is identified by the assessment process. The need for that system to survive the event should be determined by examining the likelihood of the system failing and the frequency and consequence of the escalation without its contribution. Safety systems such as ballast control systems on a floating installation should also be considered. Survival is particularly important where that system is specifically needed to continue counteracting the hazard during and after the event. Protection may be achieved in four ways: 1. by re-locating the system so that it is not exposed to the hazardous event; 2. by constructing the system so that it has sufficient inherent resistance to withstand the event; Issue 1

May 2007

Page 348 of 493

FIRE AND EXPLOSION GUIDANCE 3. by shielding the system with fire or explosion protection; 4. by providing redundant components which are widely separated so that sufficient parts of the system remain operable. In a new design, systems should be positioned following an assessment of the hazardous events so that exposure can be reduced. Where a system is duplicated, it may be necessary to locate duplicated components or sub systems in different areas with alternative routings for distribution systems such as cabling and firewater systems. Duplication will only increase survivability if failure of the duplicated component does not cause total system failure or the damage can be effectively isolated and the system reinstated during the emergency. The latter requires a method of determining the location and extent of the damage, access and availability of competent personnel. Those persons responsible for emergency response should confirm that it would be practicable to reinstate the system during an emergency. Where protection is provided, the characteristics and severity of the event should be defined and the system or enclosure designed to withstand it.

9.4

Availability and reliability

9.4.1

Underlying principles

It will be necessary to define the likelihood that a system will operate and fulfil its role when required to do so. The need to specify these criteria for a particular system should be determined during the assessment of the fires and explosions and by the required risk reduction from the system. Systems provided to protect against those hazardous events which make the greatest contribution to the total risk level will generally need a high reliability or availability to ensure that they perform the necessary functions when required to do so. Where there is a heavy dependence on a single safety system to reduce the risks from a particular major accident, it may be appropriate to consider duplication of the system to reduce the likelihood of failure on demand. These criteria can be developed in three ways: 1. By identifying the required probability of success of a system in order to achieve a given level of risk reduction. Based on this, the system can be specified and designed to achieve the required probability of success. This approach is generally more relevant when new systems are to be provided or where there is a significant revamp. 2. By reviewing the design of an existing system and assessing the probability of successful operation. This approach is most relevant to existing installations. 3. By applying a generic classification such that the systems are ranked in accordance with industry practice, standards and codes or by internal company standards. The ranking of systems may be variously described as Safety Integrity Levels, Criticality Ratings or Safety System Categorisation. These ranking systems should ensure an expected probability of success.

Issue 1

May 2007

Page 349 of 493

FIRE AND EXPLOSION GUIDANCE The ranking system has the advantage that it can assist identification of the most critical safety systems on the installation so that due attention can be paid to them. It can also demonstrate the relative importance of different types of safety systems. Applying a ranking system to one group of systems in isolation should be treated with care to avoid over specification or over concentration on these systems. Whichever approach is chosen the following parameters should be defined or assessed:

9.4.2

Design and build quality

The long term reliability of the system will be reflected in the quality of the components, sub-systems and in the design. All system components should have a proven reliability which may be demonstrated by appropriate representative inspection and testing during design and manufacture. The design should integrate the components into an effective system which achieves its functional performance standard throughout its life. There should be clear design responsibility for the whole system where components and sub systems are sourced from different suppliers and different parties carry out parts of the design. All parties involved in the design should be competent and have a clear understanding of the purpose and functional requirement of the whole system. Systems should not be over complex or enhanced with features which are not essential to the fulfilment of the role. Adequate integrated operating and maintenance information about the whole systems should be provided for the operator in order to overcome failures due to lack of understanding. The whole system should be commissioned and subject to full representative testing of the functional parameters to verify that it fulfils its role and will continue to do so throughout its life providing it is maintained and tested to a given schedule.

9.4.3

Maintenance, inspection and testing

All safety systems should be inspected, tested and maintained to a particular standard at predetermined intervals by competent personnel. These intervals will be determined by the required probability that the equipment will not have an unrevealed fault (e.g. would not start or continue to operate when required). These intervals and standards should be determined after taking into account the required reliability or the criticality of the system, historical information on the likelihood of failure, known causes of failure and the environmental conditions.

9.4.4

Non-availability (downtime)

Systems may not be available because of maintenance, testing, repair, breakdown or impairment while other unrelated activities are being carried out. They may also be partially impaired during some activities such that the functional parameters may not be fully achieved; for example a system may be switched to manual from automatic thereby extending its response time or scaffolding may limit the coverage of deluge and optical fire detection systems. There should be clearly defined limits for the periods when a system may be out of commission. In some cases, it may be appropriate to have duplicate systems, initiate a plant shutdown or curtail hazardous operations whenever a system is not available. In others, it may be appropriate to set a maximum continuous period when a system may be disabled or a maximum cumulative downtime over a given period such as a year. It may be appropriate to set controls on hazardous activities in areas covered by the safety systems which are not available, or to provide contingency measures as alternative cover. Issue 1

May 2007

Page 350 of 493

FIRE AND EXPLOSION GUIDANCE Where the functional performance of the system may be impaired by activities in the area, the limitations should be identified and assessed. Where necessary, controls on hazardous activities or contingency measures should be considered.

9.5

Actuation and initiation

9.5.1

Manual vs. automatic

The method of actuation of a system will inevitably influence the probability that it will operate during a major incident. The actuation system will be dependent upon data systems and may additionally require electrical, pneumatic or hydraulic power. It may be automatic (e.g. from a fire and gas detection or process instrumentation signal) or manual (e.g. a remote operation from a control room or an external walkway or local to the equipment such as a valve handle). With automatic systems, the probability will depend on the reliability of the detection and of the interface logic and the connecting systems. Where practical, full functional actuation tests should be carried out between detectors and the system. Where this is not practical, representative tests of all the links and the logic of the system should be undertaken. For manual action the probability will depend on; the availability and capability of personnel at the time of the initial event, the reasonable expectation of their performance in an emergency, other duties which they may have to perform and accessibility to the actuation point in the emergency. Where such actions are critical, they should be documented in emergency procedures, competent personnel should be specifically assigned to the task and the actions and responses simulated in exercises.

9.5.2

Duplication

Duplication will need to be considered for those systems where it is unacceptable to continue operations when a system is wholly or partially disabled. This may be as a result of planned or unplanned maintenance/repair and may also result from other actions linked to the event. A review of credible scenarios should be compiled to identify linked events and failures. Duplication is likely to add significantly to the system cost and complexity but may also add to the vulnerability of the system as well as increase the exposure of personnel due to increased maintenance demands. It should only be used where the reliability and availability of a single simple system is deemed inappropriate for the function and risk requirements. In some cases, a system may have a variable demand, for example, firewater supply. With multiple pumps, there may be effective duplication for smaller incidents but the total capacity may be needed for larger events. In these cases, this should be fully documented and, where necessary, analysed, to ensure that the systems can deliver the required functional performance for the different events and provide adequate availability and reliability for the frequency of the particular events.

9.5.3

Diversity

Diversity is the provision of different type components such that they are not vulnerable to single similar failure mechanisms. This overcomes common mode failures associated with one manufacturer, design or maintenance activities. Diversity would normally only be considered if there was a total dependence on one system to prevent a major accident and a very high reliability was required from that system.

Issue 1

May 2007

Page 351 of 493


Over complexity/operability

The overall reliability of a system may be impaired if the level of complexity raises the numbers of components that can fail or makes it difficult to operate and maintain. Any reduction in reliability through the addition of system features or enhancements should be identified and, where necessary, justified. It may be necessary for designers to consult with the Operators/Owners to determine an appropriate balance between dependence on complex engineered systems and on installation personnel. Where complex systems are provided, documentation should be sufficient to enable them to be operated, and maintained effectively.

9.5.5

False and spurious alarms

Systems which are subject to false alarms or spurious operations due to their over-sensitivity, poor design or response to normal installation activities are likely to lose the trust of the Operators. As a result they are more likely to be locked out or overridden and therefore have reduced availability. Designers should seek to overcome this by taking account of all foreseeable operation and maintenance activities. Systems should be operable under the full range of operational and maintenance conditions where practicable. Where such problems become apparent during operations, alternative arrangements should be considered to reduce risks.

Issue 1

May 2007

Page 352 of 493


10

Detailed design guidance for fire resistance

10.1

Introduction

Despite the complexity of fire phenomena and the many areas of uncertainty still acknowledged by the industry, experience shows that, with care, offshore fire risks can be kept to acceptable levels. This is achieved by designing with fire-related issues in mind throughout every stage of a design project. This section seeks to compile guidance on existing best practice for a two-pronged approach to fire protection i.e. 1. Designing the process systems to minimise both the occurrence and the severity of fires. 2. Designing effective fire protection systems to detect, control and mitigate the residual fire risk following all reasonable efforts to minimise fire hazards through good process design. Section 2 provided engineers with the under-pinning principles of designing out problems and reducing risks early in design, where significant changes can be made relatively cheaply. This assumes that sufficient time for creative thought and corrective action is allowed in the project schedule. Failure to provide time and resource for this can result in the need for very expensive fire-protection systems or failure to meet risk targets without extensive QRA input and/or remedial design. There is a legal obligation in the UK to base decision-making for health and safety on risk assessment. Project managers need to understand that risk assessment is not a one-off activity but a continuous process throughout the design process. Failure to do this courts a risk of missing safety or financial targets and having difficulty demonstrating ALARP. Risk assessments do not always have to be complicated, quantitative, or time consuming, but should be appropriate to the problem being assessed. Targets for risk are set at the beginning of a project, but the desired information for QRA (where justified) is generally not available until later in the design. Thus early decisions on concept and layout have to be based on ‘quick estimate’ assessments. It is important that design decisions are taken in the light of an understanding and assessment of “the Cost” vs. “the Risk Reduction” in order that the justification can be recorded for the ALARP demonstration. If this process is followed, it is far less likely that problems requiring expensive solutions will arise when the final QRA results for the installation are produced. There will always be a trade-off between cost and safety. Senior Management is responsible for approving new projects or major modifications and may ultimately be called to account for their decision. Two key safety issues to be addressed are: 1. Can this installation be built and operated to make a reasonable profit with an acceptable level of safety? 2. Does the project documentation fully record the basis upon which the decision to sanction the project was made?

Issue 1

May 2007

Page 353 of 493

FIRE AND EXPLOSION GUIDANCE The cost of continuing to operate the installation safely once the revenue from the installation has dropped to a fraction of its peak rate must not be forgotten. Some issues for older platforms nearing the end of their life cycle are discussed in Section 3.8.5. Senior managers will look to their project managers, who will in turn look to their discipline engineers for the detailed back-up to support the sanction decision. One of the aims of this section is to highlight to both project and discipline engineers the extent to which they can influence the type of fire hazards and well as the effectiveness of the fire management measures within the design effort.

10.2

Minimising fire hazards throughout the design

10.2.1

Introduction

The recommended Fire and Explosion Hazard Management processes may be found in Sections 1 and 2 of this guidance. The objective of this section is to provide additional, qualitative, pragmatic, guidance on designing to reduce fire risk at each step of the design process and is intended for discipline engineers and project managers. Each of the following stages of the design process should include scheduled safety reviews appropriate to the information available at that particular stage of the project schedule.

10.2.2

Project appraisal & concept selection

At the first stage of design, a number of different concepts will be proposed for consideration. A simple evaluation of which concept offers the smallest fire risk should be made. At concept stage there will be only very basic well information, production flow rates, vessel inventories, utility requirements and layout data, so that only very basic comparisons can be made. In addition, it must be recognised that there is always a balance to be struck between safety, cost and practicality. The discipline of recording the basis for the concept selection forces project teams to ensure the balance of cost vs. safety is appropriate and in line with Company Safety Policy. If the cost of the safety facilities necessary to maintain the safety of any proposed concept within acceptable bounds makes the installation unprofitable, then that concept should be rejected. Key items to consider at concept selection stage are to ensure that the wells, risers and process equipment are located such that;

Issue 1

•

Their associated hazards conform to a “hazard gradient”, with respect to areas of greater safety (e.g. TR and evacuation areas), and include the effects of prevailing wind in terms of spread of impact (dispersion of gas or smoke).

•

Potential escalation paths are minimised where possible within the confines of the layout, and certainly concerning the TR and evacuation facilities?

•

Future risers should be considered where at possible, for example, gas lift risers can provide a considerable hazard in later years of operation as the reservoir pressure declines, but may not have adequately considered in the original design.

May 2007

Page 354 of 493


Evacuation from a NUI is just as important as evacuation from a manned installation. Efforts should be undertaken to reduce the relative complexity of the topsides processes. Greater complexity often implies a higher leak frequency (and higher overall fire risk) and also requires a larger or more regular workforce to meet the maintenance demands.

•

The flammable and toxic inventories should be minimised to reduce the duration of release and fire scenarios.

•

The balance between designing for fire hazards and explosion hazards (also see the discussions in Section 4) is logical and consistent. For example, enclosed or partially enclosed modules containing process equipment present serious fire risks but are more readily managed through a mixture of ventilation control and fire protection. Open module design facilitates better dispersion and dilution of released gas or vapours and provides less containment for explosion overpressure generation.

•

The full range of fire hazards have been designed for, for example, considering fires on the sea surface, external flaming effects and associated fire sources (e.g. shuttle tanker fires during offloading from F(P)SOs).

•

Inventory removal and containment concepts/philosophies have been carefully considered within the context of other ER planning (for example, inventory containment allows helicopter access at all times whereas rapid venting effectively excludes helicopter approaches).

•

The range of supporting equipment that will be active over the installation lifetime, for example identifying where cranes, boats and drilling rigs will be required to operate and ensuring that pipelines, risers, wells etc. are located away from areas of high activity.

•

Where cranes, boats and drilling rigs will approach or operate in relation to pipelines and risers?

The outcome of the review should be presented in a discussion meeting so that engineers and managers can understand how the options were compared. In this way, the benefits of each concept can be adopted to improve on the chosen selected concept. The less effort put into control of fire at source at concept stage, the higher the likely cost of the fire protection systems found necessary at a later stage in design. As a general rule, large installations with complex process plant can expect higher leak frequencies so an understanding of all the fire escalation issues should be a focus point right from concept selection. These installations also tend to have a higher POB. It is now known that heat build up from fires in confined modules is both more severe and more rapid than was appreciated in the 1990s if a sufficient supply of air continues to be available. A key finding of recent research work is that fires from even relatively small hydrocarbon releases (around 1 to 3 kg s-1) in enclosed or partially enclosed modules can generate a layer of very hot gases (temperatures in excess of 1000 °C) in the top few metres of the module within a few minutes of ignition. Structural failure, damage to high level process and safety equipment and smoke and flames reaching well beyond the module boundaries are all realistic consequences to be considered.

Issue 1

May 2007

Page 355 of 493

FIRE AND EXPLOSION GUIDANCE To control the consequences of sustained pressure-release fires requires higher deluge rates and more passive protection than have been traditionally used in the North Sea in such modules. A further option is to investigate a greater degree of hermetic sealing to reduce air ingress, although this has traditionally been difficult to achieve and certainly difficult to maintain on ageing installations. At concept stage however, many of the causes and consequences can be designed-out thus reducing costs. This can be achieved by:

•

Avoiding placing process equipment capable of sustaining severe fires into partially enclosed modules,

•

Considering the effect of weather on plumes/cloud behaviour and eventual EER, gas clouds from unignited releases and smoke plumes from fires will adversely affect EER. (See also Section 7.8).

•

In open modules, analysing where the heat, smoke and flame will go, and designing in the light of this knowledge,

•

Ensuring that all structure potentially exposed to high heat loads is analysed for fire resistance,

•

Ensuring that all vulnerable and critical structures are adequately protected by PFP or the structural concept changed,

•

Providing very high deluge application rates, very rapid activation systems, extensive protection to high level support structure and blowdown facilities to control escalation if managing fires within enclosed modules (noting that this my lead to higher costs),

•

Providing high deluge application rates and wider coverage in open module design if several adjacent areas (vertically as well as horizontally) could be initiated at once,

•

Providing for the rapid removal of inventory and high levels of protection against the high heat loads at ceiling level where enclosure of process plant is unavoidable.

On large installations, personnel can rapidly distance themselves from a major fire incident. The TR and evacuation points can be far enough away to allow safe evacuation, provided the decision to evacuate is made early in the escalation sequence. Evacuation risks on small, open, gas installations can sometimes be acceptable because of low production rates, very simple process or small inventories. Small, single jacket installations with complex process plant however need extremely close attention. Where wells, risers, process and blowdown facilities are all in close proximity to each other, to the TR and evacuation points, an innovative, well-informed design is needed to make them safe. In such cases, separation of personnel from the fire and explosion hazards via an accommodation jacket or mobile unit should be seriously considered despite the increased costs. Some normally unmanned very small gas satellite platforms in the Southern North Sea have ended up with relatively high risk levels and ‘minimum facilities’, based on the philosophy that the installation would only be manned for an absolute minimum time. The high risk stems from the fact that these are small open installations with minimum safety features, and ignited gas jet fires are large in comparison to the installation footprint. There is limited shelter for personnel before or during evacuation. Such installations need to have lower risk targets to take account of satellite team personnel who may spend their time visiting a succession of similar facilities. The platform-specific risk becomes high, although not excessive if viewed in isolation. However the cumulative individual risk for satellite team members becomes high. Issue 1

May 2007

Page 356 of 493

FIRE AND EXPLOSION GUIDANCE Once the design concept is selected, and a basic layout proposed, a layout review should be undertaken. Optimising the layout with regard to fire potential can minimise the likelihood of release, ignition, and the subsequent impact on exposed equipment, critical systems or personnel. The layout fire review should be a multi-discipline activity, as a minimum, addressing the topics and associated considerations listed in the table below. Given that no two installations are alike, there will be many variations on the list of issues to be covered. The table is intended to highlight key considerations to be addressed. If such layout issues are not addressed until late in design, improvements are far more costly to implement. The table below covers the review of the platforms normal operational phase. The objective is to explore whether the locations of key items which contribute to fire safety can be improved without incurring disproportionate cost. Separate, shorter layout reviews should be considered, with appropriate discipline attendance for other stages of the installation lifecycle (e.g. installation, commissioning, major drilling/ workover programmes, decommissioning etc). This would ensure that key layout considerations for other lifecycle phases are not missed.

Table 10.1 – Topsides issues during conceptual design stage Item Wells

Fire considerations Location and segregation for all anticipated types of well operation (including drilling and workover) and maintenance during field life. Location, accessibility and vulnerability of automatic and manual isolation valves in fire situations Location of artificial lift arrangements, inventories (including down hole gas lift inventories) and isolation

Risers / pipelines

Riser and riser isolation valve locations – vulnerability to fire attack Risers and Pipelines as source of release and potential for escalation. Riser vulnerability to passing and attendant vessel collision especially during cranes operations Future risers, e.g. gas lift risers or other proposed tie-ins

Process & piping

Location of major inventories Location of relief, blowdown and flare and/or vent lines Number and rough location of process ESDVs and BDVs Location of overboard discharge lines or atmospheric vents (in worst case process upset condition) with respect to ignition points Location of fuel-gas piping and potential for fires/explosions outside main process locations (especially turbine enclosures) Exposure of personnel and equipment (including piping, instrumentation and safety critical elements) in closed or open module designs needs due consideration

Structures and supports

Issue 1

Location of tall structures or structural supports vulnerable to fire attack with severe consequences

May 2007

Page 357 of 493

FIRE AND EXPLOSION GUIDANCE Item Points of ignition

Fire considerations Consider ignition potential for all release scenarios (see factors listed in Sections 3.2.3 and3.2.6.8) Especially consider the location of all non-certified equipment with respect to releases and associated gas plumes (e.g. cranes and generator or motor enclosures.

Egress, escape and evacuation routes

TR and alternate protected muster points

For potential fire scenarios: •

Consider egress routes, checking for trap points or need for protected muster point alternative to TR;

•

Consider location of escape routes to sea;

•

Consider time to escalation Vs time to muster, appraise and evacuate;

•

Consider impairment of TEMPSC loading area and helideck access routes.

Location of air supply ducts

Vulnerability to heat/smoke Vulnerability of TR supports to fire scenarios Communications

Location and vulnerability of any critical communications hardware

UPS

Check for vulnerability to fire

Fire Protection

Location of firewalls and PFP Vulnerability of fire pumps and ring-main to damage in fire scenarios Vulnerability of deluge piping inside module and supply lines. Location of backup supply lines. Discharge location for oil and firewater drained to sea in fire incident.

Issue 1

May 2007

Page 358 of 493

FIRE AND EXPLOSION GUIDANCE Table 10.2 – Subsea and marine issues during conceptual design stage Specific subsea or marine issues Subsea layout

Understanding of leak durations and isolation provision Position of pipeline routes to minimise damage potential Position of subsea isolation to minimise inventory loss

Subsea tiebacks and control

Location of control interface and vulnerability to fire attack

F(P)SOs

See Section 3.6 Time for escalation of process events to vessel threatening events Diversity of escape routes for all fire scenarios (especially process/storage scenarios) Location of evacuation facilities for sea-fire scenarios

MODUs

See Section 3.7 Drilling units – vulnerability to drilling fire scenarios, especially survivability of ballast control arrangements Floating Production Units (converted MODUs) – consider vulnerability of hull to internal and external process fire scenarios Vulnerability of emergency pull-off arrangements in fire scenarios (drilling and production units) For Jack-ups, vulnerability of legs to fire scenarios in both standalone drilling operations and drilling operations over production installations-

10.2.3

FEED stage

At this stage of design, fire management input can still have a major impact on the overall risk levels for the personnel and the TR impairment. This is the stage where the process control, ESD and blowdown/dump systems are developed. The fire and gas detection and protection system philosophies will be set. These systems must not be designed in isolation. Whichever particular philosophy is followed the aim should always be to:

Issue 1

•

Raise alarms, shut down and isolate plant rapidly on fire or gas detection,

•

Provide the facility to remove all significant hazardous inventories from the fire zone quickly without local manual intervention,

•

Optimise design of multiple escape routes and muster areas to ensure POB reach a place of greater safety with minimised risk for the hazardous scenarios identified,

•

Ensure full emergency evacuation can be achieved under all weather conditions and wind directions before the incident escalates to a platform-threatening event. Evaluation may be delayed, particularly on large installations, due to the need to carry out search and rescue operations for personnel not appearing at muster. Partial evacuation may be initiated. This may impact on TEMPSC numbers and locations.

May 2007

Page 359 of 493

FIRE AND EXPLOSION GUIDANCE At the start of FEED stage the basic process design parameters are set down and the key plant items and protection systems identified and sized. The process and the safety engineers need to work together to:

•

Develop a draft ESD and blowdown philosophy document;

•

Examine the design for potential escalation points;

•

Develop draft fire and gas detection and protection philosophy documents, identifying the goals of the key SCEs for fire control i.e. how is each release or fire scenario prevented, detected, stopped or controlled;

•

Clarify the fire areas and location of fire walls with respect to plant and the TR;

•

Decide what types of passive and active fire protection best suit the fire scenarios;

•

Compare escalation times with evacuation, search and rescues times;

•

Design egress routes including stairways, ladders etc. to the sea, TR and muster/embarkation areas;

•

Review the isolation and blowdown systems to minimise the fire impact and escalation potential (a number of reiterations of the design may be needed);

•

Carry out coarse fire risk assessment;

•

Carry out FEED stage HAZID and HAZOP reviews, identifying new fire related issues as well as other safety issues.

European Standard EN ISO 13702:1999 [10.1] entitled ‘Petroleum and natural gas industries – Control and mitigation of fires and explosions on offshore production installations – Requirements and guidelines’ provides more guidance on layout, control systems, protection and mitigation systems, EER arrangements and inspection, testing and maintenance issues for the various systems. NORSOK Standard S001, Rev 3 2000 [10.2] entitled ‘Technical Safety’ and its annexes, also give the requirements for layout, structural and process design safety, fire and explosion protection arrangements and communication systems.

10.2.4

A methodology for an initial fire QRA

An initial conservative QRA associated with the fire hazards on an installation can be undertaken using the typical thermal loading values presented in Section 5.4 and the relevant response methodologies contained in Section 7. Such an assessment should consider:

Issue 1

•

A range of fire scenarios and sizes – particularly from high pressure areas;

•

The impact of operation or non-operation of ESD valves;

•

The impact of operation or failure of the water deluge system;

•

High risk areas - where escalation might result in a short time, near escape routes, where impact on Safety Critical Systems may occur, where structural integrity might be affected;

•

Transition to other events – escalation to a larger fire or potential for an explosion. May 2007

Page 360 of 493

FIRE AND EXPLOSION GUIDANCE The focus is primarily on the risk within the first 15 minutes whilst personnel are likely to be present and trying to escape. However, if required, this can be extended to longer times when the impact on the asset may be considered. If this assessment suggests that the risks are well understood and broadly acceptable, then it is likely that the installation is falling into the Type “A” category of UKOOA Framework for Risk Related Decision Support [10.3]. Otherwise, a more detailed analysis is warranted. This may mean using mathematical models, (which should be validated against a wide range of large scale experimental data), to predict spatial and time varying fire behaviour and thermal loading. More sophisticated calculation techniques could also be used to predict the response of vessels and structures impacted by these fires. Additional preventative and mitigation measures may need to be considered and a detailed QRA undertaken.

10.2.5

Detailed design

10.2.5.1

Introduction

The effectiveness of the detailed design stage is dependent on the success of the preceding design stages. If a design concept with high fire risks or poor protection philosophies has been selected, then detailed design is unlikely to be able to rectify the situation without major cost and time penalties. This stage of design presents many conflicting issues to be resolved. Realistically, design decisions affecting safety have to be made by balancing the risks, and this has to be done on a project timescale. This is only possible where the risks are openly discussed between the various disciplines affected and the project management. Some of the common fire-related issues for each discipline area are outlined in the sections below.

10.2.5.2

Structural design

The fire scenarios for the installation will have been identified in the FEED study. They should already have been minimised as far as possible at concept and FEED stages. Key structural supports (or vessel hulls in the case of floating installations) either need protection against the remaining fire effects or the provision of redundancy in the design. The effects on the structure of external, as well as internal flaming in confined but ventilation controlled modules must be assessed. The escalating fire effects can lead to progressive collapse of the topsides. Structural redundancy, whilst costly in the short term, has other longer term benefits e.g. for collision protection, reducing inspection or protection against long-term structural degradation. Locating process pipework inside structural supports should always be considered carefully as overpressure from releases or explosions, or heating by fire could cause rapid structural failure. An open design of platform with appropriately designed fire and blast walls to segregate process and drilling areas from safer areas with higher occupancy is preferred. Wherever fire scenarios within enclosed modules are identified, early failure of structural items in the roof of the module is predicted unless passive protection and/or a very high rate of deluge application is provided. The times to structural failure and the consequences in the absence of protection should be investigated between the structural engineer and the safety engineer.

Issue 1

May 2007

Page 361 of 493

FIRE AND EXPLOSION GUIDANCE Grated floors greatly reduce the pool fire risks and reduce explosion overpressures. Environmental legislation however forbids marine pollution by oil, so alternative measures to prevent operational spillage must still be provided. Grated floors do not provide a barrier against jet fires or radiant heat, and an understanding of the lack of protective effect should be considered during scenario and escalation developments. The structural design must provide for rapid egress and escape of personnel from the process areas to sea or to the TR. Space allowance for a diversity of escape routes is essential. Escape routes should be based on stairways not ladders. The routes must take into account all the different fire scenarios.

10.2.5.3

Process systems

Process engineers should seek to minimise inventories, operating pressures and temperatures and simplify their designs as much as possible. However they are limited by reservoir and export system characteristics, residence times needed for separation and the product specification. Where large inventories are still retained in sections of the process train following ESD, systems to remove hydrocarbon inventories such as blow-down, dump to flare, cold vent or surge/storage vessels should be considered. These systems introduce other risks and these need to be balanced for every design. The options considered and the basis for the provision (or lack of) of safety facilities should be documented as proof that ALARP has been achieved. Process items exposed to severe fires (defined as confined pool fires or fully engulfing jet fires) should be designed and provided with protection in accordance with the Energy Institute’s “Guidelines for the design and protection of pressure systems to withstand severe fires” [10.4]. Fires fuelled by 2-phase releases are harder to control than simple pool fires; modelling 2-phase releases is not a precise science and the output from proprietary software codes should be managed with great care. The designers of blowdown systems must recognise that the biggest hazards are the liquid inventories which sustain high release pressures for more than 5 or 10 minutes. This has little to do with existing design codes which require pressure reduction to half design pressure or 7 barg within 15 minutes [10.5]. Identifying the transition point at which spray releases change to liquid releases (resulting in simple pool fires as opposed to pressurised oil-spray fires) and designing the blow-down system accordingly, is key. Typically, this transition point occurs at around 7 barg for oil and 4 barg for condensate. There is some evidence that in the presence of general area coverage (of at least 12 l min-1 m2 with medium velocity nozzles) the transition point pressure could be raised to around 15 barg for oil and 10 barg for condensate, but at the time of writing, the published research is inadequate to develop proper design methodologies. Wherever possible, systems should be designed to contain overpressure caused by process excursions. Where this cannot be done, pressure relief to a vent system, combined vent and blowdown system or an active containment system (such as a High Integrity Pressure Protection System (HIPPS)) may be used. The choice of system should be based on the potential hazards, credible excursions and the vulnerability of the systems at risk, bearing in mind that relief systems are semi-passive and that HIPPS have to achieve suitably high integrity and reliability.

Issue 1

May 2007

Page 362 of 493

FIRE AND EXPLOSION GUIDANCE Sand production frequently increases as reservoirs deplete. Many large releases have been caused by sand erosion. An ignited release through a 17 mm hole in an oil system at 20 barg in a mainly enclosed module (i.e. some openings) of 8000 m3 (for example, 10 m² x 20 m² x 40 m²) would produce a major fire with external flaming and smoke sufficient to overwhelm the installation. Reservoir engineers as well as process engineers should consider how they have prepared for eventual sand production in their designs. Production chemicals can cause leaks and fires as well as adverse health effects during handling. Chemical data sheets should always be reviewed for potential contribution to platform fire risk.

10.2.5.4

Process pipework

Piping engineers can reduce risks on an installation by:

•

Locating key isolation, pressure relief and blowdown valves away from fire effects or else adequately protecting them.

•

Ensuring that where valves are quick acting and fail-safe, protection may not be necessary, but the designer needs to examine the fail-safe mechanism (with input from the instrument engineers) to ensure they are truly fail-safe under all fire scenarios. Duplication of solenoids or steel enclosures for control cabinets may be necessary to achieve the required reliability within the heat-up timeframe. This information should be documented within performance standards for the equipment.

•

Developing the protection options based on a clear understanding of the fire effects.

•

Considering pipe and valve support arrangements at high levels within modules to minimise potential escalation. The consequences of failure where rapid and severe heating is a significant risk should dictate the protection requirements.

•

Considering the balance between minimising sources of release and allowing safe isolation and access for intrusive maintenance. Areas with a concentration of potential release points in close proximity to high inventory process plant require close scrutiny to see how the risks can be reduced through re-arrangement, use of high integrity flanges, use of integral block and bleed valves, shielding, grating floors, etc. Areas susceptible to vibration or sand erosion should be similarly considered.

•

Ensuring that failures emanating from piping runs, piping and vessel connections, small bore tappings etc. do not present jet or pool fire hazards to less-obvious targets, for example, pipe flange joints in line with safety critical control panels or utility systems, non-process flammable inventories etc.

10.2.5.5

Instrumentation and control

Instrumentation and control engineers can reduce risks on an installation by:

•

Minimising where possible intrusive instrumentation as this may provide a common leak source.

•

Checking the design of safety critical control systems for common mode failures which cause releases, ignite releases or could occur as a result of fires.

Issue 1

May 2007

Page 363 of 493


Determining the safety integrity level (SIL) requirement of safety critical instruments or systems. As part of this process, the consequences of failure are considered and maintenance/testing intervals established. The SIL assessment should be a multidiscipline activity, chaired by a practical engineer with experience of such assessments. Good SIL assessments often help to reduce unnecessary instrumentation and should be carried out in accordance with the IEC 61508 [10.6] or IEC 61511 [10.7] as appropriate.

•

Considering the consequences of rapid heating causing simultaneous failure of all mid to high level instrumentation in modules which may suffer from prolonged fire engulfment. Where this will lead to catastrophic or extreme events, reducing risks to ALARP may still be achieved through more rapid, higher rate water, failsafe design, better redundancy, or managing the heat build-up by altering the module openings.

•

Setting realistic performance standards for safety critical instruments or systems is usually an iterative process, requiring input from process mechanical, safety and instrument disciplines. Sufficient time for discussion must be included in project schedules.

•

Identifying and eliminating instrument tappings which can be prone to fatigue failure in the presence of pipework vibration and unsupported instrument loads. The fatigue damage and subsequent failure can occur very rapidly.

10.2.5.6

Fuel gas and lubrication lines

Power generation systems fuelled by conditioned process gas or diesel can be a source of both fuel releases and ignition.

•

Fuel gas lines should be designed to tolerate failures at the HP/LP interfaces in the system.

•

The design of the fuel gas system should minimise inventory in the system and minimise routes through process areas or areas of high mechanical damage risk.

•

Provision for rapid isolation and/or disposal of fuel inventory is required.

Provided proper maintenance and condition monitoring takes place, serious mechanical failures of rotating equipment, leading to projectiles and serious fires are rare. The system design should make system shut down as soon as it deviates from its safe operating envelope. Early intervention allows the situation to be brought back under control. Escalated fires inside any enclosures, given some air ingress, can be severe. Lube-oil or diesel fire produce smoke which migrates to other areas. The layout should take into account the possibility of sudden mechanical failure and smoke generation and locate enclosures where such events are less likely to escalate to process fires.

10.2.5.7

Power generation and electrical systems

Existing standards of protection against the occurrence of electrical fires on offshore installations have proved adequate over time. Early automatic electrical isolation on overload is usually sufficient to prevent development of serious cable fires and subsequent escalation. Electrical equipment can provide a source of ignition in the event of a process hydrocarbon release. Detailed design should minimise the risk of hydrocarbon releases coming into contact with uncertified electrical equipment. However, the open design of process modules allows migration of large gas releases. Issue 1

May 2007

Page 364 of 493

FIRE AND EXPLOSION GUIDANCE Best practice is to locate uncertified electrical equipment inside enclosed areas which contain no process plant and to which the air supply can be shut off if gas is detected at the inlets. The location of non-certified electrical equipment in open deck areas should be either avoided or adequately justified, for example by gas dispersion modelling. During a fire event, main power generation usually switches over to emergency arrangements. Often initial emergency power is from diesel and then ultimately by battery power, shedding non-essential loads at each stage. In a major fire event, UPS and dedicated batteries provide power to communications and essential shutdown/process/F&G data, life support and evacuation systems. Batteries can only supply power for a limited time. The design must be compatible with the fire, emergency response and evacuation timescales. The power for each fire pump is usually independently supplied. The location and redundancy arrangements need to be designed to meet so far as is reasonably practicable the fire (and other) scenarios and how they could be influenced by interaction with the weather. The effect of power loss on the operation of all safety critical items should be reviewed very early in detailed design.

10.2.5.8

Fire and gas detection

Fire & Gas detection systems monitor and provide early warning of fires and flammable or toxic gas releases on the installation. The detectors are required to detect the presence of fire or gas as rapidly as possible. They provide information on the location of the gas cloud or fire and then raise an appropriate level of emergency alarm to the operating teams and executive action where required. The alarms should also indicate whether the event is confirmed by other detectors, by virtue of their voting arrangements, combined with detector location identification, the operating teams should be able to start to piece together what the fire or gas event is doing. It is important that the value of gas detection remaining functional following an incident is realised in the design and the ER arrangements. To provide the response teams and operating teams with adequate information to plan responses and ultimately to investigate safely the pre-cursors to the accident are extremely valuable. Generally, flammable gas detectors should be located throughout the process areas and locations such as:

•

Open process areas;

•

Non-hazardous area HVAC air intakes, ventilation air intakes of equipment enclosures; and

•

Any enclosed/semi-enclosed space where gas may accumulate.

Plus the location of the gas detectors should take into account:

Issue 1

•

Leakage sources within the area and areas for potential gas accumulation;

•

Potential gas or vapour cloud size;

•

The gas or vapour composition, temperature (on release) and density;

•

Access for maintenance and calibration of the detectors (so that they retain their performance standard); May 2007

Page 365 of 493


The location of personnel access and escape routes (to identify potential impairment).

The aim of the detection systems should be considered carefully, that they detect the events postulated for the installation and act as a coherent component of an overall fire hazard management strategy. An illustration of how this approach supports safety is in the increasing use of improved smoke detection in accommodation areas. The traditional protection method for accommodation units was to supply sprinkler systems, in line with onshore hotel practice, however investigations have shown that there can be significant smoke generation without much heat in small smouldering fires of nominally domestic material. The potential for injuries arising from smoke inhalation is significant. An alternative strategy has been to improve the sensitivity of smoke detectors and enforce a “no smoking” policy within the accommodation, thus implementing a preventative strategy. Newer technology applications such as acoustic gas detectors are available and these will detect leaks regardless of whether ventilation systems or open modules disperse the leaked material. Current acoustic detection equipment can be shielded against turbine, compressor and air tool sourced ultra-sonic noise. In addition, there are also fibre optic laser devices available that are calibration free and non-energetic.

10.2.5.9

Fire protection (active and passive)

In most major fire accident hazards, the active fire protection system primarily relies on automatic and remotely activated fire protection systems. Manual fire fighting facilities are only relied upon where:

•

The fire hazard is readily controllable;

•

Evacuation in the event of escalation can be implemented very rapidly; or

•

The maintenance load of the safety equipment adds risks to the maintenance crews (as has been found in the UK Southern North Sea on NUIs).

Nevertheless, manual fire fighting facilities (e.g. hydrants, hose reels and fire extinguishers) are often provided in all areas to permit rapid intervention on small fires or to support the rescue of injured or trapped personnel. Fixed active fire protection systems are based on firewater pumps feeding a firewater distribution network, the network can be supplemented by foam-concentrate systems (tanks and pumps feeding a foam-concentrate distribution network). Some areas, notably helidecks, will also have monitors and hydrants to provide adequate coverage. In addition, where appropriate, (in areas such as control rooms), total flood gaseous or water mist extinguishing systems can be used. The passive fire protection arrangements (PFP) will take the form of structural barriers, insulation or fire retardant coatings and will be used to protect walls, decks and structural members. They should be used to protect against defined credible fire hazards that are capable of causing failure, and should take into account the fire size, duration, location and intensity. Passive protection measures will often be used in critical areas where the assumed 100 % reliability of PFP is required. Refer to Section 4.4.2 for further details.

Issue 1

May 2007

Page 366 of 493

FIRE AND EXPLOSION GUIDANCE 10.2.5.10 Drains The drain system design should be carefully checked. There have been many fatalities and near misses due to hydrocarbon ingress to safe areas via drains. Specifically:

•

Never mix separated process water and drains in one caisson;

•

Water seals in drain systems are unreliable protection devices;

•

Never allow process hydrocarbons into open drain systems;

•

Use of process pressure by operators to ‘blow down’ liquids to the closed drains system should be forbidden unless the system is specifically designed for this practice;

•

Accommodation and sewage drains should be independent from any other drains;

•

Deluge operation must be taken into account in drain system design;

•

HAZOP of drain systems is essential on large, integrated platforms;

•

Drains capacities must take account of the vessel inventories in their specific areas and the effects of bund systems.

10.2.5.11 HVAC HVAC has a key function in dispersing and controlling gas and vapour releases, for example, preventing gas clouds from coming into contact with ignition sources or diluting toxic releases such that they pose a lesser hazard to personnel. There are key design features that enable the HVAC systems to achieve these roles, some of these are listed below. It should be noted that with such functions that the HVAC systems will be designated as Safety Critical Elements:

Issue 1

•

Locate HVAC intakes optimally with respect to gas releases and fire scenarios.

•

Penetrations between such areas should be kept to a minimum and penetrations for piping, cables, ducts, etc. should be adequately sealed. heating, ventilation and air conditioning (HVAC) penetrations, fire dampers ductwork should be of the same fire integrity as the boundary through which ductwork passes.

•

The duties of extraction systems from enclosed hazardous modules should be carefully considered, they may be required to provide effective extraction of gases or hydrocarbon vapours and their eventual exhaust point should not contribute further to any escalation.

•

The continued operation of the HVAC system may be required to be safety critical (for example, for a control room within a process module following a gas release). Suitable safety measures to protect the system and ensure its continued function and survivability will be required.

May 2007

Page 367 of 493

any For and any


10.2.6

Determine the optimal ways to protect against gas ingress, e.g. by generating positive pressurisation in “safe” areas or sealing the areas via the use of HVAC dampers. (Experience has shown that HVAC dampers are often difficult to access and may suffer from reduced reliability as they age. If used, access to and maintenance of dampers should be considered very carefully).

Construction/commissioning phases

During construction many minor alterations take place. Some may have potential for negating designed-in safety features. It is thus important during commissioning to:

•

Monitor construction for on-site changes to design;

•

Ensure that personnel installing safety systems (PFP application, valve installation etc) are competent and properly supervised;

•

Ensure installation personnel have easy access to the design engineers so they can check out any reservations/problems they have during installation/commission;

•

Use checklists, punch lists etc to ensure all items are finished, tested and properly handed over to operations.

10.2.7

Operational phase

The transfer of key fire-safety information from the design team to frontline offshore staff (OIM, supervisors, emergency response personnel) is often neglected and under-funded. This should be separately and adequately budgeted for at the outset of the project:

•

Operational and maintenance staff and contractors based offshore will take over the operation and maintenance of the safety systems. Supervisors must be given an overview of the fire scenarios and the design intent of the safety systems. Offshore supervisors are under considerable time pressures offshore. It is not reasonable to expect them to absorb this information from the risk assessment documents and the Safety Case is unlikely to provide the level of detail required. Without this essential background, there will be a potential for work permit approvals or on-site risk assessments to miss important issues.

•

Maintenance and testing of SCEs must be adequate to prevent degradation of the installed systems. The impact of degradation may not be obvious without the training described above.

•

The fire and explosion scenarios and the escalation time-frames must be captured and incorporated into the platform-specific emergency response plans. Scenario-based, platform-specific emergency response exercises should be carried out periodically throughout field life. The quality of these exercises will depend directly on the quality of the engineering input.

10.2.8

Plant modifications

Equipment, plant and personnel changes should be monitored and their impacts on fire hazard management assessed. The changes may be significant such as a substantial change of inventory, or they may be a revision to maintenance schedules that potentially reduces the reliability of detection or protection systems.

Issue 1

May 2007

Page 368 of 493

FIRE AND EXPLOSION GUIDANCE The “soft” changes such as personnel changes with subsequent loss of experience, or loss or records are the most difficult to control and track. Management practices may impact a system in ways that will only become evident after some considerable time unless they are specifically reviewed with respect to influence on fire hazards. Some changes can be properly planned as they are regular and predictable, change-outs of OIMs and supervisors are frequent and it easy to track and enforce the maintenance of skill levels (if not knowledge levels), by providing new personnel with the same (or better) level of training as the original personnel.

10.3

Best practice for fire protection systems

10.3.1

Introduction

Although every effort may be made to minimise topsides inventories and the likelihood of leaks, there is always some level of hydrocarbon fire risk left. Thus fire protection systems need to be provided for the benefit of personnel, plus protection of the asset and the reputation of the company. The design philosophy for fire protection systems has changed over the last decade and a half from being code-based to scenario-based. The design of a fire protection system for any area of the installation must now be shown to be appropriate for the potential fire loads and resultant consequences. This is a very different approach from the code-driven approach where water deluge requirements were set for different parts of the installation. This ‘one size fits all’ code-based approach is no longer acceptable. The design process must start with understanding the type of fires, the period for which they may persist, the time-line for all the potential fire escalation events, times to structural failure and effects on escape and evacuation of personnel. Once the fire and its interaction with the safety of personnel and the preservation of the asset is understood, the most appropriate combination of active and passive fire systems to achieve the necessary degree of protection can be considered. Generally, the use of passive protection is preferred over active protection, due to its inherent reliability. On a typical platform there may be several different active protection systems (including manual fire fighting equipment) plus different types of passive protection. These measures are discussed further in the next section.

Issue 1

May 2007

Page 369 of 493

FIRE AND EXPLOSION GUIDANCE Examples of the types of protection system in common use are given in the table below.

Table 10.3 - Fire types and common methods of protection Type of fire

Type of Protection

Aim of Protection

Jet fire impinging on process vessel

PFP cladding on vessel

Protect vessel against BLEVE until blowdown complete

Pressurised liquid spray fire in partially enclosed module

PFP cladding on roof support beams plus high rate deluge application to (24 l min-1 m-2) module.

Delay structural failure of roof beams until platform evacuated. Suppress fire and cool process and safety equipment.

Pool fire in open process module with solid floor

Low rate (10 l min-1 m-2) with AFFF

Control/extinguish fire by cooling oil pool and putting layer of AFFF on pool surface. Cool process equipment to prevent further leaks. Reduce smoke plus wash spill to deluge drains

Spray fire escape route

Firewall (or F(P)SO)

across

escape

deluge

tunnel

on

Protect people escaping to TR from spray-fire and radiant heat effects

Gas jet fire in vicinity of stairwell

Mesh screens on stairwell

Reduce radiant heat on stairs

High pressure jet fire in export module

PFP on export ESDV plus all sections of downstream export pipework in module

Delay escalation to riser fire until after platform evacuation completed

The table demonstrates how the protection has to be specific to the requirements of a number of differing fire scenarios. Recent research on deluge systems has emphasised the importance of this approach. Potentially there are 3 main roles for deluge: 1. Cooling of exposed process and safety equipment 2. Cooling and control of pool fires through suppression of fuel vaporisation 3. Cooling of the high hot zone through interaction with the combustion process These approaches require totally different design philosophies and one “catch-all’ design for deluge systems cannot achieve them all.

10.3.2

Fire protection design

10.3.2.1

General

This section discusses some design issues associated with particular applications of passive and active fire protection.

Issue 1

May 2007

Page 370 of 493


Passive systems

Firewalls The design of firewalls is moderately well understood. They should be designed to a specific fire rating compatible with the fire scenario for which they offer protection. Due consideration is needed for any deflection of flame by the firewall, plus the movement of the smoke and hot gases that accompany the flame. Products of combustion do not disappear when they encounter a firewall but build up or migrate. All firewall ratings and the extent of the firewall whether jet fire rated or only A0 rated, should be indicated on the appropriate drawings. The design basis must be clearly recorded for future reference; otherwise justification of worthwhile future changes becomes difficult. Penetrations and doors must be designed to the same rating as the firewall itself. Firewalls are often provided for area segregation. On many installations combined fire and blast rated walls divide the process areas from the wellbay and the wellbay from the utilities and accommodation areas giving multi-barrier protection across the platform from the high hazard process end to the low hazard accommodation end. This strategy is simple and effective when designed in at concept stage. Blast walls with superimposed PFP must be assessed for the integrity of the PFP following deflections of the wall during an explosion. TRs, accommodation and control room wall are usually fire-rated. The rating must be defined by the potential fire exposure. On NUI platforms where TRs are often very small, they may be located behind a firewall segregating the open process areas from the enclosed units such as the control/electrical room and TR/day room. It needs to be large enough to provide real protection. Smoke and radiant heat effects around the edges of the wall and the effect on people leaving the TR to evacuate the installation must be considered in the design. Firewalls are usually composite items consisting of a structural part and an insulating part, both parts need to retain their integrity for the life of the installation. Discussions of firewalls and other PFP can be found in Section 3.2.8. Mesh screens These reduce heat radiation on escape routes by approximately 50 %, provided the flame is not actually impinging on the route. They are frequently used to protect open stairways. They are cheaper than firewalls and offer less protection but have their place for gas jet scenarios provided good diversity of escape routes is available. PFP on structures and structural supports It is important to understand the temperatures at which structural failure will start and the consequences as the fire continues and heat increases. Whatever the design basis, the redundancy in the structure and the consequences of failure during a fire should be explored in discussions between the structural or marine engineers, the safety engineer and the designer of the passive fire protection system. Derivation of fire loadings and response of steelwork to fire attack is covered in Sections 5 and 7 respectively. Attachment systems for the PFP must be given detailed consideration in view of the cycles of expansion, contraction and flexure experienced by steelwork in offshore applications. Disintegration and separation of heavy PFP cladding materials from walls or other structural supports is still causing problems on existing older installations. Likewise retrofitting of PFP offshore e.g. externally to the underside of TRs on small gas platforms has proved both costly and temporary.

Issue 1

May 2007

Page 371 of 493

FIRE AND EXPLOSION GUIDANCE Modern methods of attachment are much improved however. Best practice requires close attention to detail, especially in meeting the requirements of the manufacturers specification for installing the PFP. Wherever possible, PFP should be installed onshore, under controlled conditions. Modern trends for smaller topsides that can be fabricated onshore and installed in one heavy lift make this a much more viable option. High pressure gas jet fire impingement on PFP, particularly of the early intumescent epoxy type has been found to cause rapid degradation of the material. PFP systems are now available which are resistant to jet fire attack. Where jet fire impingement is likely, and could be sustained for more than a one or two minutes, type-testing of the selected PFP system should always be specified. A jet fire test standard has been developed in the last few years based on industry research and at time of writing is becoming available as a draft ISO standard (22899-1) [10.8]. A jet fire rating equivalent to an A or H rating has been proposed in the latest draft version of the ISO, (based on the jet fire test criteria proposed in ISO 13702 [10.1]) that is, type of application / critical temperature rise (ºC) / type of fire / period of resistance (minutes). Floating structures have a different structural design basis (widespread use of integrated, stressed skin designs) to that for a fixed steel jacket with modular topsides construction. Where fire or explosion in these areas is catastrophic the possibility of occurrence should be designed out, rather than reliance placed on protection systems. For this reason pipework containing process hydrocarbons should be avoided inside support columns or pontoons unless they can withstand the predicted fires/explosion overpressures. All PFP applications must take account of the need for periodic inspection of key parts of the underlying structure. This can be catered for by providing inspection hatches. However, it must be emphasised that PFP integrity must be sufficient to prevent the ingress of water and subsequent corrosion under the insulation and that the application of inspection or access points must not degrade the “water-tightness” of the PFP. PFP on process vessels PFP is the preferred method of protecting vessels from heating up and failing when exposed to fire. Water cooling is possible but not as reliable and requires large amounts of water. Leaks from vessels caused by heat distortion are often capable of adding large inventories to existing fires and if the fire exposure is severe, unprotected vessels could BLEVE with devastating consequences. The main concern with PFP on vessels is that it makes NDT of the vessel difficult. Given that ongoing corrosion monitoring is an essential feature of most asset integrity programmes this has been seen as a major drawback. Removable PFP is sometimes used, but this is susceptible to water ingress under the cladding and can lead to external corrosion. Also it can become custom and practice to leave large parts of the vessel bare of cladding for long periods for ease of inspection (especially where the vessel is already known to suffer corrosion problems), thus reducing the availability of the protection. Where the primary concern is BLEVE protection, and given that it is the gas space of the vessel that needs protection rather than the liquid space, recent ideas are that cladding may not need to be provided to the base of the vessel, to obtain the BLEVE protection. This is because the liquid inside the vessel provides protection against rapid heat-up of the vessel walls. This should be subject to careful analysis and understanding of liquid levels under all process conditions.

Issue 1

May 2007

Page 372 of 493

FIRE AND EXPLOSION GUIDANCE Research in the last few years has shown that for vessels subject to severe fire impingement, the existing API codes 520 [10.5] and 521 (jointly with ANSI) [10.9] and the “fast-tracked” ISO equivalent of API 521, ISO 23251 [10.10] are inadequate for specification of the pressure relief arrangements to prevent BLEVE. Vessels protected in accordance with these codes have burst resulting in a BLEVE within 5 minutes following attack by jet flame or engulfment by confined pool fire. New guidance has been produced setting out the design considerations for process vessels and their pressure relief systems for BLEVE protection. For design against BLEVE events engineers should design in accordance with the Energy Institute Guidance Document “Guidelines for the design and protection of pressure systems to withstand severe fires” [10.4] which was published in March 2003. As noted above, the integrity of “water-tightness” of PFP is a key issue and loss of water-tight integrity has been found to generate problems of accelerated corrosion on ageing installations. There is an added issue with piping and vessels where there is the possibility of temperature cycling, condensation may accumulate under the insulation. Inspection points will be required to monitor such systems. PFP coating of risers Additional considerations related to the application of PFP are discussed in Section 3.2.8 of this document. Consideration of protection for riser barrier valves and other emergency isolation valves is covered below in the sections on PFP Enclosures and PFP Wrappings. Water tightness of risers is a key issue when the PFP goes down to the “splash zone”, issues of water ingress are added to potential damage by wave action. PFP enclosures for safety critical items An alternative method of protection for safety critical items such as ESD valves and their actuators is installation of a PFP enclosure around the item. Design considerations for enclosures are:

•

High costs because they usually have to be have to be custom designed to suit the duty, the size and the location;

•

Additional loads, they have to be designed to resist explosion overpressures for the particular area and on some installations the potential for wave-slam has also to be considered;

•

In-situ installation may be complicated by access problems, although for new build projects this can be done early, before access problems are created;

•

They have to be removable or otherwise designed to allow entry for essential repair and maintenance.

•

The design also has to take into account that after repair/maintenance the unit will have to be restored to its original design specification. The costs of proper reinstatement offshore throughout field life need to be considered from the outset of design.

Most importantly, it is no use protecting a specific item of safety-related equipment if escalation will then take place through failure of the pipework on either side of the fire protection. In designing any PFP system, an holistic view of the whole module, must be taken. Design of protection for just ‘safety critical’ items in isolation can lead to inefficient safety spends. Issue 1

May 2007

Page 373 of 493

FIRE AND EXPLOSION GUIDANCE PFP wrapping / blankets In recent years soft wrapping jackets for protection of valves or critical piping sections have become popular as, by comparison with box-type enclosures, they are relatively cheap, easy to design and install, and can be removed to allow inspection. The potential for such systems to promote external corrosion of the protected item remains but the extent of the corrosion can be visually monitored when the wrapping is removed for maintenance etc. The paint or coating system under the lagging should nonetheless be to a high specification. Such systems tend to be rated for short-term protection e.g. 5 or 10 minutes. Thus, they can give useful protection where inventories are small, or rapidly blown-down. With respect to enclosures, they must be re-instated after every disturbance for maintenance/repair/inspection by personnel who have been suitably trained for the task. It should be noted that offshore inspections indicate that they are easily damaged and repeated removal and re-wrapping tends to damage their fastenings but that their use is successful if trouble is taken to ensure proper fixing and re-fixing. The key issue is to ensure that the wrap is securely and properly fastened, otherwise it may come off or be damaged in an explosion and hence not be able to provide the required fire protection during any subsequent escalation.

10.3.2.3

Bunding and draining for liquid fires

Bunding and draining is also considered a form of passive fire protection. Bunding is used to contain oil pool fires which would otherwise spread to other areas and/or prevent any AFFF in the deluge system from working effectively. Designers must ensure that bunds provided primarily for environmental purposes do not potentially concentrate a pool fire around an area of plant, exposing it to a higher level of risk. Drain design must take into account the interaction and disposal of both the fuel and the deluge release. Where drains are critical for fire hazard management, they must be designed for easy inspection, maintenance and testing so that their performance standard is always met. Offshore drains are susceptible to blockage and the design should aim to minimise this.

10.3.2.4

Active systems

In the 1980s and early 1990s firewater system design was code-based and designers followed prescriptive water application rates for different areas of installations. Best practice is now to design for the specific fire scenarios in the area to be protected. Firewater tests carried out at various test centres such as Spadeadam in Cumbria in the late-1990s identified that deluge rates required for fire control depend on the type of fire, not just the area designation. The deluge application rates recommended in view of the findings of both the above research and earlier Norwegian research into the characteristics of confined hydrocarbon fires, are summarised in the following table.

Issue 1

May 2007

Page 374 of 493

FIRE AND EXPLOSION GUIDANCE Table 10.4 -Deluge application rates Hydrocarbon fire type

Deluge application rate

Additional comments

Oil Pool Fires

10 l min-1 m-2

Suitable provided the cause of the pool fire is not a two-phase (spray) release. Addition of AFFF is beneficial

Hydrocarbon jet or spray fires (impingement)

General area deluge not suitable for protection of specific items against impinging jet fires

Key items (e.g. riser sections, riser ESDVs, vessels with BLEVE potential) should be protected by other means (PFP or targeted, very high rate deluge)

Jet or spray fires (radiant heat exposure)

20 l min-1 m-2 general area cooling for plant exposed to radiant heat from jet fire in vicinity

AFFF can help control residual hydrocarbon pool fires, but does not contribute to cooling of heat-exposed plant

Well head fires

400 l min-1 m-2 per wellhead

The objective is to prevent fires on one wellhead, affecting adjacent wellheads

Gas-only jet fires

Where gas jet is large in comparison with size of module or installation, deluge may be of limited benefit.

This is often the case for small, open, normally unmanned gas platforms. Money here may be better spent on rapid detection, isolation and blowdown coupled with PFP of key valves.

Directed deluge on tanks impacted by flashing liquid propane jet fires

100 l min-1 m-2

Horizontal cylindrical storage vessels should be protected by means of open medium velocity sprayers, not less than 6 mm bore, operating at pressures between 1.4 and 3.5 barg and should have cone angles between 60° and 125°. Fire Office’s Committee’s “Tentative rules for medium and high velocity water spray systems” [10.11]

Reference should also be made to Section 5.2 for further discussion on the issues of deluge rates with respect to different fire types. For fires giving free flame volumes in the order of 25 % to 35 % of module volume, there will be widespread and simultaneous heat input to the top half of the module. This has implications for safety systems, structural supports and process equipment (especially the tops of process vessel which could suffer a BLEVE) located at high levels in most process modules. Hydrocarbon fires generate a very hot layer, of partially burnt gases a few metres deep at ceiling level from releases of a relatively small size (with a burn rate from around 1 to 3 kg s-1) in enclosed modules, whether partially or fully ventilated. This occurs for any hydrocarbon fire whether all gas or all liquid. However non-pressurised liquid releases burning as pool fires are much easier to control by deluge than fires fuelled by 2-phase pressurised releases. The layer of hot gases can reach 1000 ºC within a few minutes if the fire is sustained for that period. Tests have shown that dry deluge systems can be destroyed by the heat prior to their operation; designers should consider some of the following issues in their design requirements. Issue 1

May 2007

Page 375 of 493


Where enclosed modules are desirable for other reasons or otherwise unavoidable, the process should be designed for isolation and blowdown to prevent or minimise ongoing severe fires;

•

Safety control components and systems should not be vulnerable to damage from heat build-up effects while they are in operation;

•

The risk of structural failure at ceiling levels should be taken into account;

•

The design of deluge systems should recognise and mitigate the consequences of these scenarios, that is;

•

Provide systems that deliver the necessary deluge rates as fast as possible;

•

Provide mechanical support systems that will not fail before the deluge brings the fire under control;

•

Consider installing fine spray deluge specifically to cool the top few metres of ceiling space.

Once the flame volume in the module exceeds around 25 % of the module volume, it is very likely that flame and smoke will occur beyond the confines of the module such as at the locations of any openings in the module walls. When the flame volume reaches 100 %, most of the combustion will be taking place beyond the confines of the module as the partially combusted hot gases reach a source of oxygen. This effect exposes other areas to fire and can also set off the other areas’ deluge systems, thus potentially reducing the fire protection to the source module. The design of the deluge system and the structural protection must consider these escalation scenarios. In general, with the exception of riser inventories, it is the liquid inventories that are capable of producing and sustaining these high flame volumes after ESD and blowdown. Temperatures close to the flame can be around 1350 °C, with heat fluxes in excess of 350 kW m-2. The overall platform process design should remove the potential for large, sustained, pressurised hydrocarbon fires, however, the combined design of deluge and PFP systems, to mitigate against the remaining scenarios, may be expensive in view of the need to control the consequences of such fires. In unpublished reports of tests, it has been found that a deluge rate of 12 l min-1 m-2 for a pressurised jet fire had little impact on hydrocarbon gas jet or spray fires, but did reduce the heat fluxes at ceiling levels from around 300 kW m-2 to 200 kW m-2. Increasing the deluge rate to 24 l min-1 m-2 reduced peak ceiling fluxes from 350 to 60 kW m-2, suppressed the flaming considerably and changed the smoke from dense black to a grey mixture of steam and entrained carbon particles. It is not clear whether these benefits arose because the water droplets at the higher deluge rate were smaller, or because the water rate doubled. In the same reports, the heat imparted to process vessels and pipework by an impinging sonic gas jet flame was found to be little reduced by general area coverage of 24 l min-1 m-2. This rate did however reduce the rate of heat input from an impinging simulated live crude pressurised spray release. It was not possible to confirm whether this reduction was sufficient to prevent eventual failure. Specific deluge at 10 l min-1 m-2 directed to the vessel using a conventional array of nozzles, in conjunction with 24 l min-1 m-22 general area coverage appeared to halt the rate of rise of the vessel surface.

Issue 1

May 2007

Page 376 of 493

FIRE AND EXPLOSION GUIDANCE A general area deluge of 12 l min-1 m-2 should be able to control the burning of pool fires, but with some reservations concerning the actual water volume reaching the flaming surface. (For more detailed discussion, refer back to Section 5.2.3.2). Again, unpublished reports of tests have indicated that for vessels exposed to pool fires, specific deluge coverage as per NFPA 15 [10.12] (10 l min-1 m-2) provided effective heat exposure protection.

10.3.2.5

Component – specific design issues

A brief discussion of design issues associated with key components of typical North Sea deluge systems is presented in the paragraphs below: Fire pumps Modern designs are based on an absolute minimum of 2 x 100 % fire-pumps, each capable of supplying the entire system needs. On open design installations, especially where the deluge is activated on gas detection, more than one or two areas may be set off simultaneously. The redundancy within the pump configuration enables the platform to continue operating when one pump is out for maintenance. A variety of alternative fire pump configurations (e.g. 4 x 50 % pumps), are possible, based on analysis of vulnerability to fire scenarios, cost, operating characteristics, maintainability, flexibility and system start-up reliability. ‘Cross-over’ valves allowing service water to be diverted for fire-fighting use can be useful, with appropriate safeguards against reverse flow and overpressure. Fire pumps and their power units should be located diversely, in safe locations, in order to reduce the possibility of a major accident event rendering the entire system inoperable. Materials of construction must be suitable for the marine operating environment and the life of the installation. Parts that may fail early should be identified in advance and spares held or ensured readily available. The pumps need to be independently powered as the platform main power generation system is generally designed to shut down in serious fire and gas release situations. Modern pumps are often electric submersible pumps, located in firewater caissons and powered by topsides diesel-generator sets. Older pumps tend to be traditional diesel fire-pumps, taking suction from pipes run inside firewater caissons, terminating below wave action depth. Start-up reliability is crucial and can be a deciding factor in determining the number of pumps in the systems. Although design is always for automatic start-up, back-up manual starting arrangements are generally required and should be tested regularly. Experience shows that fire pumps slowly deteriorate (i.e. they exhibit a gradual drop-off in peak delivery capability) over the years, regardless of the fact they spend only a fraction of their life in actual operation. They are started and discharged to hydrants or overboard dump lines at regular intervals to prove their continued readiness for service. Firewater ring mains On most platforms the fire pumps discharge into a firewater ring main, which runs around the perimeter of the installation at a low level. This arrangement provides protection from fire and blast damage by shielding behind primary support beams and providing redundancy within the system. Firewater is distributed to the deluge sets (which supply specific modules), hydrants, hose reels and sprinkler or water curtain systems. Isolation valves are provided on the ring main. Thus, if one area becomes damaged, the affected section of the ring main can be isolated and supply continued through the undamaged sections. Ring main isolation valves may be locally or remotely operated, but must be clearly identified, easily maintained and accessible for operation in an emergency. Issue 1

May 2007

Page 377 of 493

FIRE AND EXPLOSION GUIDANCE Some operators also provide secondary ring main riser pipework either to critical areas or where the primary riser supply to an area is vulnerable to fire/explosion damage. One of the most important considerations for an offshore firewater system is speed of initiation. To keep delays to a minimum, ring mains are filled with seawater and held at pressure ready for immediate use; any significant drop in pressure, caused by a demand on the firewater system initiates automatic start-up of the fire-pumps. To prevent pressure fluctuations in the system causing frequent starts and stops of the main firewater pumps, the pressure is held at around 8 to 12 barg, by a small pump (usually called a jockey pump) supplied from the service water system. Firewater ring mains are usually large-bore and contain seawater, therefore, they are not lagged or heat traced. However in extreme winter conditions freezing is not unknown. As an added precaution, many systems provide for a continuous slight circulation within the system by dumping a small flow back to sea. The smaller pipework rising off the ring main is usually lagged and heat traced. In smaller firewater systems, dry ring mains are often used if the time taken for fire water to reach deluge or monitor nozzles is acceptable. The use of dry ring mains eliminates corrosion and freezing issues. Ring-main and riser pipework corrosion is a major issue, thus Cunifer is the usual material of choice for the wet parts of the system. Older platforms with carbon steel ring mains run the two-fold risk of wall thickness loss and build-up of corrosion products throughout the system. Designers choosing steel over Cunifer in the past for cost saving have passed the cost of replacing or maintaining such systems onto operational staff working on a diminishing budget ten or so years later. Linings or surface treatments for carbon steel ring-main pipework have been used with mixed success. Corrosion inhibition can be used, but consideration must be given to treating the dead-legs in the systems, such as the wet riser pipe sections between the ring main and the deluge valves. Composite materials such as GRP or specially developed fireproof elastomers have also been used for firewater piping. These can possess significant corrosion, weight, flexibility and price advantages. Key concerns for such alternative materials remain.

•

Can they be properly installed, maintained and repaired in-situ (some need specialist installation)?

•

Will they melt in the event of serious fire attack, either before of after deluge water reaches the distribution pipework and nozzles?

As an alternative to traditional ring-main design, some operators arrange their fire-pumps to directly supply different parts of the installation directly. Choice of system has to be justified with respect to effectiveness for the specific fire-scenarios, vulnerability to fire damage, and the reliability requirements for the system. Deluge valves and dry pipework The deluge valves separate the wet part of the system from the dry pipe network that supplies the firewater nozzles. These valves are usually air-activated either by loss of air when fusible links or bulbs are breached by fire, or when solenoids are activated by the fire and gas detection system to dump air. The valve opens to feed water into the dry pipework that leads to the firewater nozzles. Design needs to focus on maintaining the air pressure for very long periods (i.e. the whole of field life). Any leaks or pressure accumulator failures in later life will trigger off the deluge system in the affected section. Repair downtime on safety critical systems is likely to be expensive. Issue 1

May 2007

Page 378 of 493

FIRE AND EXPLOSION GUIDANCE Deluge valves need careful design and maintenance since their operation is complicated especially for valves which have AFFF proportioning as part of their function. Deluge valves may be at the junction of the Cunifer and steel parts of the system, so dissimilar metal corrosion protection must be designed in. Valve sets should not be located immediately outside the area they are designed to protect. A manual operation lever, very clearly labelled in large writing, should be provided. This allows for override of the deluge valve should it fail to operate, or if water is needed as a priority elsewhere on the installation. Hydraulic shock within the system can result either when main firewater pumps kick in, or when deluge valves suddenly open. The shock can cause damage to the small-bore endpiping in the system and its supports. It is important to consider and quantify this problem as part of the design. Pneumatic dampers may need to be used. Slowing down the opening of the valves is not a good idea if it means a delay in getting water through to the dry pipework. Minimising the delay time is critical for 2 reasons: 1. The faster a fire is cooled the easier it is to bring under control and the chance of rapid heat (and smoke) build-up is reduced. 2. The dry pipework and its pipe supports are mostly located high in the module and are vulnerable to high temperatures. Small bore dry Cunifer or GRP pipe (depending on the exact specification) may melt rapidly in a jet fire thus stainless steel or titanium alloys would be preferred. Once water flow is established the pipework is provided with internal cooling. Firewater pipework supports are also vulnerable to heat and may be unprotected by deluge application, thus they require careful design attention. The time between detection and getting water to the region of the fire should be minimised. Many new designs are capable of getting water to the fire within 30 or 40 seconds of detection. NFPA 15 [10.12] sets a target of 40 seconds for response time. Research has shown that for large fires severe heat build-up can occur within one or two minutes of ignition. Some systems in current operation have to rely on regular flushing either with firewater or potable water in order to control build-up of corrosion products, salts, powder deposits (in some drilling storage areas), scales etc. This is expensive and time consuming, especially where the requirement was never envisaged or provided for, without flushing, the system can clog up but sometimes the regular flushing accelerates the rate of corrosion. Modern designs now tend to use larger ‘self-cleaning’ nozzles, less susceptible to blockage. These bring benefits in terms of higher water application rates but also imply larger pumps and bigger supplies of expensive AFFF. The grid of firewater nozzles covering a module or an area is designed to produce a specific range of water droplet sizes The nozzles generally used for deluge are high or medium velocity nozzles. The smaller the droplet the more likely it is to be evaporated or blown away between emerging from the nozzle and reaching the fire. This is a particular issue for droplets under 0.5 mm diameter and an important factor in more modern, open platform designs. The larger the droplet the less affected by wind and the more water provided to the fire for cooling, but the bigger the pump required. High velocity nozzles produce droplets over 1 mm diameter. A large module may require a few hundred such nozzles for adequate coverage. The pipe sizes may range from around 10” at pump discharge to 1” and 2” at the nozzles. A full hydraulic analysis of the system is necessary to ensure the necessary water distribution throughout the module will be achieved. Periodic testing of active fire protection systems to ensure initial suitability and continued compliance with the stated performance standards is mandatory in the UK. Issue 1

May 2007

Page 379 of 493

FIRE AND EXPLOSION GUIDANCE Reference areas The design of firewater systems in the 1980s and early 1990s was based on reference areas, which were, generally speaking, specific fire areas of the platform bounded by firewalls, for example, most reference areas were enclosed modules. Fire pumps were designed to supply one or two reference areas plus the helideck in a fire situation. With the move to more open platform design this approach is usually not appropriate. Platforms are now divided into ‘fire zones’, defined both by area and fire characteristic and not necessarily bounded by walls. The fire protection (or combination of protection systems) in each zone must be suitable for the fire characteristics. With open platform design, a fundamental issue to address is how many different zones could be triggered by each different gas release or fire scenario. Where firewater in a number of different zones could be activated almost simultaneously the pumps need to able to meet that demand. The alternative is to attempt to manage the supply so that it targets the right place by remote manual operation of valves or inhibition of a second fire zone on activation of the first. Remote manual operation of valves in a fire situation is problematic since it requires accurate feedback on the fire development to allow for decision making plus the availability of a suitably trained emergency response and/or fire team. On some platforms, neither may be available. Reliance on local manual intervention to supplement the automatic fire system response has to be realistically evaluated and only used where it does not expose the person(s) operating the valve to danger from the fire/smoke. Huge firewater demands can be more easily avoided with proper attention to:

•

process isolation and blowdown;

•

layout of plant and escape routes; and,

•

passive protection of potential escalation points.

AFFF design considerations The addition of AFFF to firewater systems can bring great benefits when used for liquid pool fires. It is less effective for running pool fires. AFFF, and other types of foam, work by creating a layer on the surface of the burning hydrocarbon pool, cutting off contact with the air. This reduces the fire and smoke generation significantly and may extinguish the fire altogether in some situations (e.g. bunded fires). Foams, (sometimes) in combination with dry power applications are important for fighting aviation fuel fires. The design of foam systems should take into account the effect of high winds during application plus application must be possible from at least opposite quadrants. Foams are expensive, especially in the quantities needed offshore. Good design of storage facilities will avoid costly early degradation. Stored foam should be sampled and tested regularly. Foam are injected either just downstream of fire pumps or at deluge valve locations or directly at the hydrant. Proportioning equipment of various designs, for injecting foam at the right concentrations into the firewater supply, have proved unreliable in the past. The vendors of such equipment should be asked to provide evidence of reliability and maintainability for their systems and show they have a good track record in operation.

Issue 1

May 2007

Page 380 of 493


Area cooling and extinguishing systems

Water curtains Water curtains have been used as a solution to reducing heat exposure of people on escape routes, or critical plant items. Their advantage is that they do not exacerbate explosion overpressure problems, but they have several disadvantages:

•

The delay in activation means they are of limited use for immediate ignition situations but could be useful in delayed escape situations;

•

In open locations they are affected by wind;

•

There is limited research, but water application rates for effective operation were found in tests to be high, in the region of 25 to 40 l min-1 m-2;

•

A continuous screen of water is required, achieved by flat plates or a combination of flat plates and nozzles.

•

The attenuation of heat radiation by general area deluge is noted from research work to be considerable. However at the time of publication there are no design methods for calculating the personnel protection effect.

Ceiling cooling Where there remains a possibility of heat build-up at the roof level within an enclosed or partially enclosed module, which could still be the case on some existing installations, new systems are becoming available specifically to reduce heat at high levels within the module. These systems are based on heat-resistant rubber-type tubing that can be easily site- laid and fixed to the structural beams. Being flexible they will withstand considerable deflection without loss of function during an explosion event, and they do not suffer from the same corrosion problems as steel-based systems. They generate fine water sprays which provide cooling through evaporation of the water droplets. The steam generated also retards the combustion process. Water mist design These systems are now widely used as the replacement for Halon protection of power generation or fire pump enclosure. A variety of water mist systems have been developed over the 3 to 5 years and are available on the market. They work by injecting bursts of very fine water mist into the enclosure once fire has been detected. The mist evaporates, reducing heat and rate of burning. They work in enclosed, limited inventory conditions. They do not offer protection against fuel gas explosions in gas turbine enclosures, protection against explosions relies on a combination of forced ventilation, early detection of gas build-up, and rapid isolation of the gas supply Inerting and extinguishing systems Halon is no longer used for offshore inerting / extinguishing systems. A few installations have provided CO2 flood systems for extinguishing electrical fires, with appropriate safeguards against asphyxiation, as a replacement. Many operators have removed the Halon previously provided in switch-rooms and control rooms and replaced it with a VESDA (very early smoke detection and alarm) system instead for better protection of personnel against electrical fires, (see Section 3.2.7). This is in addition to the more traditional smoke detection systems.

Issue 1

May 2007

Page 381 of 493

FIRE AND EXPLOSION GUIDANCE Manual fire fighting equipment – hydrants and monitors Previous legislation required hose stations to be provided in modules for use by fire teams. Teams were trained to run hoses from nearby hydrants to supplement the fixed automatic systems if necessary. More recent practice is to keep personnel in a safe place away from the fire and leave the automatic systems to provide the all the necessary protection. Manual systems on newer installations should be provided only where a legitimate specific need has been identified (for example to cover temporary well test equipment on a top deck). The protection will be suitable for the specific scenario and a team of trained and competent fire or emergency response personnel are available to operate the equipment. The prime example is provision of helideck fire-fighting equipment and personnel. Hydrants and hoses or fixed monitors (often fitted with an automatic oscillating mechanism as well as manual control) are still provided where overhead deluge systems are not practical e.g. on drilling rigs to target water onto escape routes and well fires from a safe distance or for protection of equipment on exposed upped decks where strong winds could prevent proper deluge coverage. Manual hose facilities can also be useful in securing large unignited spills with an application of aspirated foam Manual fire fighting equipment – hose reels, trolleys and hand extinguishers Manual fire fighting equipment such as fire extinguishers, fire hose-reels and fire trolleys are still provided offshore for use by personnel in the event that someone discovers a small fire which can be safely bought under control by manual means. The main change in provision of such equipment in recent years is that:

•

Platforms are now occupied by much smaller workforces;

•

Platforms no long support large fire teams;

•

Few installations run 24 hour operations;

•

Small fires are less likely to be found and dealt with by a passing member of the workforce, especially at night;

•

Hot-work and intrusive maintenance work on some platforms is very infrequent;

•

Oversupply of extinguishers etc and their maintenance requirement places an extra burden on small offshore crews.

All of the above must be considered when deciding the appropriate level of manual equipment to be provided.

Issue 1

May 2007

Page 382 of 493


11

Detailed design guidance for explosion resistance

11.1

General

This section of the Guidance is based on an earlier basis document [11.1] and incorporates additional design and operations experience to provide guidance on methods and particular areas of detailed design. Industry initiatives that have generated detailed design and operating practices guidelines are briefly discussed. The aims for detail design have been identified to enable co-ordinated best practice, such that significant changes can be avoided late in the design process.

11.2

The design sequence

11.2.1

Introduction

The approach in this section is to work through the design process in a generally sequential manner, identifying those areas that have an impact on explosion hazards. Conflicts between the requirements for different engineering disciplines will be identified, as will the conflicts between explosion and fire hazard management or mitigation. Some areas will be covered on a phase by phase basis, others on a discipline by discipline basis. The readership is intended to be broad and the issues understood by all disciplines (engineering, management, verification and compliance) through all phases of project development, execution and operation.

11.2.2

Project appraisal and concept selection

Concept selection is normally achieved by means of comparative assessments both qualitative and quantitative, based on cost, risk and timescale. The following subject areas can influence the explosion hazard:

•

New build or modification – a new build project essentially starts with a clean sheet of paper and thus has little or no constraints in terms of layout, materials or structural form. An existing facility modification, by contrast, will have constraints in terms of viable location, weight, layout, interfaces with existing plant, power, spares, materials, accessibility and impact upon the existing Safety Case and HAZOP assessments for the facility.

•

Sub-sea or topsides wellheads – generally the selection process for sub-sea or topsides wellheads is related to satellite facilities where the processing and main export is accommodated elsewhere. Explosion hazards are not normally a primary consideration, as the satellite structure, if selected, would be a minimum facilities, normally unmanned installation where primary separation may be included, but usually improved accessibility for maintenance of the topsides wellheads. With sub-sea wellheads, all fluids would be transferred to the main facility for processing. Current technology has made the sub-sea option more viable, especially where the main facility is in close proximity.

Issue 1

May 2007

Page 383 of 493


Inventory – The gas content of the received fluids is the primary contribution to the explosion hazard, with the pressure of the flow, coupled with volume in the case of vessels, being the key parameters in determining the magnitude of release for a given leak size. The temperature of the fluids has an influence on the degree of absorption of gas within the crude oil, but is much less significant in terms of explosion hazard than pressure. The sweetness of the crude and the water content are the primary contributors to corrosion risk, with sand entrainment being the key contributor to erosion.

•

Separation of process, drilling, utilities and accommodation – The process area usually has the highest risk on the facility, in terms of explosion hazard, due to the high pressures and the number of potential leak sources in the pipework, pressure containing vessels and machinery. It is normal to distance the gas compression plant from the separation vessels, where possible, to reduce the escalation risk for any single event.

•

Wellbay and drilling facilities – These also pose a high explosion risk, due to the amount of flanged pipework required to connect the trees to the manifold and the tendency of this pipework to move in concert with the conductors. The utilities area is much less vulnerable to serious explosion hazards, but a risk is still present, for example with fuel gas for power generation.

•

Export route – The availability of a convenient nearby pipeline, with available capacity, may determine whether export of oil is by tanker or pipeline. Gas is often flared, exported by pipeline, re-injected into the formation for later export or increasingly liquefied for transport. Excessive flaring is no longer considered to be an option in many parts of the world, due to environmental considerations. The required pipeline entry pressure will contribute to the compression requirements for the platform. The degree of gas compression has a significant influence in the potential for leaks and the resulting gas cloud sizes in the process area.

•

Gas lift - The other factor in determining compression requirements is whether gas or electrical submersible pumps are used for artificial lift of the oil. The gas lift lines are a major potential hazard due to them being small bore, high pressure and subject to vibration due to tree movement. A major hazard is also presented in the loss of containment of the gas in the well annulus. Switching from gas lift to electrical submersible pumps is generally not an option on existing installations, due to the compressor design requiring a minimum throughput to maintain efficiency, for new installations the electrical submersible pump option is much safer.

•

Regulatory regime – Regulations vary in different parts of the world and cognisance is therefore required of the relevant governing regulations for the installation location, irrespective of where the design is executed.

•

Budget, timescale and external factors – Best practice may sometimes be compromised by the available budget and project timescale, whether for new build or brown field modification. Similarly external factors such as lift vessel availability may influence or determine the outcome of a particular decision, resulting in a less than optimum solution. The degree of compromise should be documented for evidence in hazard review and project safety audits.

Issue 1

May 2007

Page 384 of 493


Initial hazard review – The initial hazard review can make use of judgements based on past experience and advise on the consequences of initial engineering or management decisions. This review process must be open, however, to new understanding on explosion loading and response, as well as to the capabilities of new technology or design methods. The initial QRA must be based on current generic data for leak and ignition frequency, or take account of proposed high integrity solutions which offer better hazard management, in order to be meaningful and aligned with the design process.

11.2.3

Sub-sea layout

As discussed above, the sub-sea layout can significantly influence the topsides inventory and the topsides hazard. Additional elements to those already covered above, include:

•

sub-sea isolation valves (SSIV);

•

high integrity pipeline protection systems (HIPPS);

•

emergency shutdown valves (ESDVs);

•

pipe-in-pipe risers;

•

new or pre-installed risers;

•

in-field pipelines;

•

sub-sea storage.

Several of these elements affect topsides risks by impacting vulnerability to dropped object hazards causing sub-sea leaks. The pipe-in-pipe solution requires the use of vents to control leaks, in which the construction arrangement inhibits in-service inspection and repair. This arrangement may be preferable to single skin risers for reasons of insulation to maintain oil temperature. The use of new or pre-installed risers is a judgement as to the fitness-for-purpose of the existing riser, given its current condition and design specification, as balanced against the construction risks, operational risks, cost and impact on the global structural integrity of a retrofit custom designed riser.

11.2.4

Process engineering

The process design then has to evaluate and specify equipment which will convert the fluids to export specification, in such a manner that the changing circumstances through the life of the field can be met, together with any allowances for future expansion. The influences on explosion hazards here are leak sources and the magnitude of the release, generally through mechanical connections, but also associated with corrosion and human intervention. Areas for consideration include:

•

separation;

•

cooling/heating;

•

compression;

Issue 1

May 2007

Page 385 of 493


water injection;

•

sand entrainment;

•

metering;

•

vessel size and configuration;

•

storage prior to export.

Water injection is included here as being associated with aquifer water and the pipework contributing to process area congestion. Sand is primarily a source of vessel and pipework erosion; water is the primary source of corrosion. Vessel size is a consideration in terms of the quantity of the topsides inventory and the potential for fueling a fire in case of rupture. Vessel size is also crucial in terms of reducing pressures during blowdown. Smaller vessels may thus be more controllable in emergency situations, but may be less efficient in operating terms. The layout stage is important in the provision of adequate inspection and maintenance access, selection of laydown and storage areas and mechanical handling routes between the laydown areas and the relevant equipment. The design should be influenced by reliability, operability, inspection and maintainability particularly in late field life.

11.2.5

Pipework

The initial pipework sizing and routing follows the layout process. Operational considerations included here are: provision of fixed and spring supports; valve locations; flange locations to facilitate installation and maintenance; material selection for robustness (wear control and corrosion resistance). The key areas for explosion hazard potential are leak sources and the magnitude of release, generally through mechanical connections but also associated with corrosion, fatigue, erosion and human error. The following also need to be considered in terms of explosion hazard management:

•

large deflections overloading flanges;

•

joint damage due to mechanical impact;

•

use of pipe supports as structural fuses to protect pipework at branches;

•

area congestion;

•

bundling and shrouding of pipes to reduce explosion turbulence;

•

shielding of safety critical pipework to reduce drag wind loading.

Design should be influenced by the maintenance of piping joint integrity, inspection, maintainability and robustness. There should be a challenge to lagging/insulation for personal protection or heat conservation due to issue of corrosion risks hidden under lagging and also to the materials selection in the context of late field life costs and integrity. Issue 1

May 2007

Page 386 of 493


Power requirements and electrical systems

The power requirements can be determined after the compression and main pump designs are at an advanced stage. The main considerations here, in terms of explosion hazards, are associated with hot surfaces and electrical sparks. Elements for consideration include: motors; transformers; switchgear and distribution boards; control panels and junction boxes. The security of supply to critical services (e.g. TR pressurisation) and protection of generator and TR HVAC intakes from smoke/gas ingress. The key design considerations are inherent safety and robustness.

11.2.7

Instruments and controls

A key consideration in terms of explosion risk is whether instruments are powered by air, electricity or fuel gas, the later obviously having an associated leak potential and the middle option an ignition potential. Intrusive instrument tappings are a major potential source of leaks and non-intrusive options should be used wherever possible. Local or remote control is significant in terms of manning levels within hazardous areas. The Control Room layout is critical in terms of the potential for human error in crisis management; information overload is now recognised as a cause of delay in response times. Cabinets in hazardous areas need to be robust to withstand explosion loading and prevent missile penetration. Instruments and their controls (valve wheels, handles, switches etc) need to be accessible to minimise or eliminate the need for scaffolding or other temporary access, hence reducing congestion, vent paths and potential missile material. A review of potential standardisation of components is likely to lead to reduced human error. The durability of components and software should be an important design consideration, along with the potential for upgrade or expansion to accommodate future platform modifications. The mixing of system types or overloading of components can lead to increased explosion risk.

11.2.8

ESDV, blowdown, pressure relief devices and isolation systems

The Emergency Shut-Down Valve (ESDV) system provides the means of isolating the installation from import and export pipelines, in order to control the topsides inventory in an emergency or quickly terminate export in the case of a pipeline or riser leak. The blowdown system rapidly transfers the gas or oil inventory to the vent, flare or reservoir in a controlled manner, in order to reduce the potential for further escalation in the case of a fire or leak. Pressure relief devices are provided on process systems to prevent rupture of pressure vessels and leakage of pipework joints under applied pressure arising from faults in the process control system or as a result of fire. The isolation systems enable safe and secure isolation of key inventories and components to enable draining and purging of fluids prior to maintenance or inspection. The same influences and design requirements apply to general pipework, but both the blowdown and isolation systems require a very high integrity, reliability and survivability in order to function safely. These systems can involve a large number of flanged connections and isolation systems are associated with components that are regularly subjected to manual intervention.

Issue 1

May 2007

Page 387 of 493

FIRE AND EXPLOSION GUIDANCE An area of potentially poor design that has become more apparent recently is that onshore refinery based design codes for blowdown systems [11.2] are based on fire loads which are too low for the offshore industry [11.3]. These codes do not take account of the stress distribution in the vessels and the strength of the vessel steel is reduced faster than is applied in the codes, as a result of the higher heat load that would be typical. The vessel integrity may thus be compromised before the blowdown is achieved. Reviews of blowdown system efficiency are also now considering sequenced blowdown as a means of improving overall response time. Such reviews need to assess manual versus automatic or semi-automatic shutdown of systems on high-level gas detection. Considerations for reliability and robustness of systems include the use of double isolation valves, high integrity seals, the attachment of small bore bleed pipework in double block and bleed isolations and the selection of appropriate pressure relief valve devices. Some operators have experienced a number of failures of bellows in balanced bellows type relief valves [11.4]. An impaired pressure relief valve may fail to prevent an explosion or lead to a sudden large toxic gas release in the event of rapid escalation of fire. Bellows failure may be caused by valve chattering, incorrect material specification or pressure rating, incorrect installation, incorrectly specified fatigue life or incorrect dimensional tolerances on the valve seat and bellows manufacture.

11.2.9

Utilities requirements

Utilities systems generally do not contribute to explosion risk, (with the exception of fuel gas, which may be classed as a quasi-process system as that is where it usually originates); however, they can contribute to congestion and their failure under explosion loading may reduce their ability to manage a subsequent fire or cause them to contribute to secondary incidents such as chemical spills. Utility systems include: firewater deluge; seawater cooling; diesel and potable water tankage; chemical storage; HVAC. The design and routing of deluge mains is of primary importance in ensuring a robust system capable of withstanding the Strength Level Blast and providing continued deluge coverage outside the affected area in a Ductility Level Blast.

11.2.10

Layout

The equipment layout is usually based on good past experience and an awareness of design details that can lead to problems with poor ventilation, congested explosion venting, blast wind turbulence and high explosion overpressures. The finished layout may then be validated by CFD modelling. The other main layout considerations are: process economics; accessibility; pipework protection; ventilation; congestion; escape routes; trip hazards; mechanical handling provision; storage; maintenance access; growth provision; HVAC; cable trays; pipe racks; lighting; communications.

Issue 1

May 2007

Page 388 of 493


Structural arrangement – topsides

Within the sequence of design phases, a suitable nominal overpressure for a facility type and location may be available for initial structural sizing. A load factor would be required to enable sizing by elastic methods, as non-linear analysis would be too extravagant for initial sizing, this could apply 50 % of the nominal load for elastic design, with safety factors of 1.0 and characteristic material properties; one third to one half of the DLB has been quoted elsewhere for initial estimates of SLB loading. The primary structural steelwork will often have been sized for other load considerations (operating loads, installation or environmental) but blast walls will be sized for these blast loads. Topsides structural and architectural design includes the following considerations:

•

modules and module stools;

•

integrated decks; blastwalls,

•

wind walls and fire walls; floors,

•

equipment supports and pipe supports;

•

stairways and escape routes;

•

bridges and bridge supports;

•

lifeboat and liferaft supports;

•

doors and windows;

•

passive fire protection (PFP);

•

lift points; tall structures,

•

drilling derrick, cranes and masts;

•

living quarters (LQ) and temporary refuge (TR);

•

Control Room and Workshops;

•

Helideck;

•

fabric maintenance and inspection;

•

growth provision;

•

decommissioning.

In the design of architectural features such as doors and windows in the LQ, whose failure could lead to TR impairment, it is important to consider the negative pressure impulse immediately following the initial high positive pressure impulse. The ability of doors and windows to resist outward loading is generally much lower than that of inward loading due to the construction details and assembly method.

Issue 1

May 2007

Page 389 of 493


Structural arrangement – substructure

Whilst less susceptible to direct impairment from explosion loading, the substructure arrangement can have a bearing on the behaviour of the facility under extreme events. The main structural forms for manned installations are:

•

Fixed steel platforms;

•

Gravity based steel platforms;

•

Spars

•

TLPs

•

Gravity base concrete platforms;

•

Jack-up production and drilling platforms;

•

Floating structures – semi-submersible, F(P)SO.

Some fixed steel platforms have diesel tanks in the legs close to the topsides; F(P)SOs have storage tanks beneath the process modules; jack-up production facilities will have diesel tanks in the side double skin or crane pedestal. Subsea oil storage is not considered to be an explosion risk, however, such tanks will require vent pipework to control gas build-up and allow tank purging. Conductor and riser support is important in the control of flowline vibration topsides. Such vibration can have a significant impact on attached small bore pipework fatigue, particularly with gas and chemical injection pipework. The provision of pre-installed risers and J-tubes for future satellite development can significantly reduce the explosion hazard associated with construction activities on the topsides. A robust sub-structure design will significantly reduce the explosion risk associated with strong lateral vibration resulting from major boat impact hazards. Structural redundancy will ensure adequate support to the topsides in the case of a surface pool fire, ensuring that gross deformation of the topsides does not result, leading to secondary releases and explosion risk.

11.2.13

Explosion & fire hazards review

If the ALARP criterion has not been met (following re-assessment of an existing structure, for example) the degree of non-compliance needs to be established and various options described elsewhere in this Guidance will need to be considered to determine the optimum route for reduction of the explosion hazard: A comparative exercise is required to document the benefits and disadvantages of the options, equating cost, risk savings, timescale, practicability etc. On brown field projects factors such as lack of bed space and production downtime for modifications are significant factors in the calculation.

Issue 1

May 2007

Page 390 of 493


Brown field modifications: survey, hook-up and commissioning

The balance between construction risk and operational risk in pipework modifications needs to be carefully assessed. It is sometimes impracticable to handle long lengths of new pipework offshore, especially where complex geometries are involved. Flanged connections present an ongoing operational leak risk, but welded connections are difficult to achieve on a live installation, requiring pressurised welding habitats the manning levels for which often require more space than is available. The balance is thus drawn between the cost of lost production and the increased hazard presented by more pipe flanges. If high integrity flanges are utilised, where the flange class ratings are higher than required for the design pressure rating of the pipe, then the system ductility will be tolerant of explosion loading and brittle modes of failure and flange leakage will not result. With all piping systems the location of flanged joints must be considered in conjunction with the selection of support locations, to avoid joints being placed at locations where high ductility is required. Nitrogen leak testing is recommended for all hydrocarbon pipework following new construction and maintenance. Leaks can often be detected in existing pipework following a shutdown, even where no intervention had occurred, as a consequence of joint relaxation upon cooling or accidental mechanical impact. The need for detailed dimensional surveys for pipework tie-ins at the hook-up stage is demonstrated time after time. Reliance on “as-built” drawings has caused many project delays, whereas a single visit offshore to confirm the accuracy of the recorded data would have ensured a better fit-up and eliminated clashes with items not included on the referenced drawing. The use of PDMS (Plant Design Management System), which integrates data from all disciplines in a 3-D model, has vastly improved clash control, but as-built models are still rare. The consequences of being ill-prepared at hook-up, in terms of explosion hazard, are that piping joints are cold-stressed and on-site fit-up rectification is required for pipework or structures that may involve hot work. An additional requirement for brown field works is a well-developed installation scheme. Craneage requirements, laydown availability, mechanical handling routes, clearances and temporary removals (pipework, cabling etc) all need to be clearly defined and prepared for. The consequences of unexpected problems can again be associated with human error, leading to gas leaks, ignition sources and hence explosion risk.

11.3

Best practice in explosion hazard design

11.3.1

Introduction

“Best practice” will be used here to describe the outcome of a design process that would result in the minimal explosion risk for a viable concept. The term viable is necessary, as the absolute minimum risk may result in a design that is not commercially viable. In each design process, the needs of each design discipline must be weighed against each other, as well as those of the operating requirements, the regulatory requirements, commercial considerations and safety. This section outlines the considerations used to arrive at a best practice design. These considerations constantly change as new technologies, explosion behaviour or response information becomes available.

Issue 1

May 2007

Page 391 of 493


Management of the explosion hazards

High risk activities, such as start-up, testing, sampling, blow-down, draining, flushing and venting, can have the associated risks reduced by good design, as well as good working practices. Other high risk activities like construction and maintenance, well operations, relief valve testing and simultaneous operations will also have reduced associated leak risks through good design and planning. Design has a big influence on the prevention of ignition. Hot surfaces, electrical equipment, lights, and equipment earths are all fixed ignition sources that need to be designed or selected with recognition of the potential explosion hazard. Selection of a higher specification, different location or gas tight enclosure will reduce the ignition risk. Temporary ignition sources, such as hot work or poorly earthed scaffolding or equipment, need to be eliminated or controlled, by design and operating procedures. The need for a calm weather policy should be considered. External ignition sources, such as ship exhausts, helicopters and lifeboat engines, also need to be considered in the design process.

11.3.3

Derivation of explosion loadings

An increase in venting area can be achieved in brown field modifications as a mitigation measure. Venting panel locations can also be optimised, to best suit the particular geometry of the structure and identified ignition sources, however, the effects of venting on escape routes and adjacent areas also needs to be considered as must the consequential damage caused by displaced wind walls or blow-out panels.

11.3.4

Response to explosions

The key factor in the response of the structure or equipment to explosions is the limitation of escalation damage, or containment of damage. Measures to be considered under this category include:

•

the minimisation of potential missiles;

•

the strengthening or protection of critical safety systems/equipment;

•

the protection or behaviour of the primary and secondary structures subjected to explosion loads;

•

the deflection of decks;

•

the behaviour and ultimate capacity of blast walls;

•

the mechanisms of escalation;

•

the stability of tall structures;

•

the protection from loss of containment damage to process systems components.

The subject matter in this category is very broad and needs to be addressed by simple, generic guidance. Several of the measures are procedural, especially in the area of missile limitation. The design based issues, whether green field or brown field, can involve multi-discipline aspects, not just structural. Blast wall performance can be compromised by the need for pipe transits, cable conduits and access manways. Blast wall capacity is not necessarily related to stiffness but to ductility.

Issue 1

May 2007

Page 392 of 493

FIRE AND EXPLOSION GUIDANCE Connection capacities can be more critical than span capacity. Increased capacity in existing systems can often be demonstrated through the use of non-linear analysis, where simple elastic methods were used in design, the strain limitations of the welded connections may be the limiting factor. Mechanical strengthening may have to be achieved through cold work solutions, if platform shutdowns are to be avoided. Complex loading situations need to be considered on space frame systems, with understanding of the real collapse and failure mechanisms, where computer modelling may only represent idealised post-yield and joint behaviour. Equally important, the initial failure in the system may not represent the ultimate capacity, as the failed component may be redundant. The consequence of component failures within the collapse sequence must be appreciated. A weld failure along the edge of a blast wall may enable release of gas or flame into a previous safe area, with a potential tunnelling failure resulting. In other instances, say within a double skin wall, there may be no significant consequence from first failure.

11.3.5

Specific considerations for blast walls

11.3.5.1

Corrugated profiles

Corrugated profiles are commonly constructed from stainless steel due to its high energy absorption characteristics and good corrosion resistance. Typical failure strains for ASTM 316 stainless steel are in excess of 50 % with ultimate capacities in the region of 600 N mm-2. Pre-Piper Alpha, firewalls were used in situations where explosions were a possibility. However these were not initially designed for the blast loads and many were constructed from mild steel. Blast walls typically span from floor to ceiling and are normally provided by specialist suppliers. The behaviour of the wall is very much controlled by the web and flange slenderness limits, the column slenderness of the wall, the flange to web ratio, corrugation angle and the end connection details. It is important to be aware of the interdependence of some of the controlling parameters such as the angle of corrugation which will control the degree of restraint to the flange. Also the web/flange ratio plays a crucial role in controlling buckling of the section. Previous research [11.5] on profiled flooring systems suggests a maximum value of 1.5, although limited profiles were given which may not be appropriate for blast walls. FABIG Technical Note 5 [11.6] provides guidance for web and flange slenderness limits based on stub girder tests in order to classify the section. In traditional static design of typical universal beam members in bending, codes give slenderness limits for web and flange elements independently despite the fact that one provides restraint to the other. Extensive validation work has been carried out to ensure designs based on this specification are conservative with an effective width concept adopted to account for the actual stress state. With profiled sections under blast loads there are little published data to provide the same extent of validation for using these results. Also the web in this case is loaded by the pressure providing a destabilising load. Technical Note 5 [11.6] also provides guidance on the selection and design of profiled barriers, however, this reference deals with design criteria for predominantly elastic wall profiles and recommends the use of NLFEA to provide performance standards for ductility factors greater than 1.5 for plastic sections.

Issue 1

May 2007

Page 393 of 493

FIRE AND EXPLOSION GUIDANCE It is important to be aware of the change in behaviour of the wall with increasing depth. For relatively shallow profiles the corrugations can open up under a blast pressure load allowing some of the energy of the explosion to be absorbed by the deflection of the wall. This also has the effect of reducing the forces applied at the supports. If a deeper wall is adopted which is very stiff, then little of the blast energy will be absorbed via bending deflections. This will attract high shear forces which will impose large forces at the connections and could induce buckling of the cross section. Buckling issues need to be carefully checked for deep troughed walls. Double skin profiled systems have also been adopted recently where the skins were separated by an air gap with the same profile used for both layers to allow for a blast occurring from either side. One of the skins becomes sacrificial while the gap increases the standoff from the explosion and impacts the second skin. The wall is designed to be flexible to allow much of the energy to be dissipated in bending.

11.3.5.2

Stiffened panels

Stiffened panel blast walls consist of a flat plate stiffened by a series of vertical and horizontal stiffeners and is supported by the main steel structure. For integrated decks the stiffeners are continuous and are required to carry large service loading. As a result, they are likely to be closed hat type sections. Although plates can resist high loads through membrane action, this will be transferred to the main structure as an axial force and requires careful consideration, particularly if the deck is carrying high service loading. Many stiffened panel walls have connection details which minimise the transfer of high axial forces to the main structure for this reason. Where there is a need to assess the capacity of module walls and columns with in-plane loads the effects of static loads need to be considered on the response of structural members:

11.3.5.3

Support details for blast walls

Support details for any blast barrier are crucial to ensure that the integrity of the wall is not breached during an explosion and must be detailed such that they are not the weak link. Walls are normally attached at their top edge to the flanges of primary beams, normally allowing rotations to occur such that large membrane forces are not developed. It is important to ensure that any stress concentrations, which may not always be avoided, occur in the components of the connection rather than the weld itself. The connection must be sized to transfer the computed reactions and to assure that any plastic hinges can be maintained in the assumed locations. They should be designed for a capacity that is greater than its supported member. The bottom of the wall is commonly welded to a channel or angle section attached to the top of the deck in order to allow for rotation to occur. In some cases the wall is welded directly onto the deck which has no rotational flexibility, relying totally on the top connection for this. Results from a JIP, which investigated tests on firewalls carried out at the Spadeadam test site, together with numerical studies, have shown that flexible angle connections arranged in a dog-leg configuration performed well in terms of energy absorption capability [11.6].

Issue 1

May 2007

Page 394 of 493


Increasing blast capacity for existing structures

In situations where walls have limited clearance strengthening schemes which considerably stiffen the wall have been adopted. Yasseri [11.7] has discussed a number of these, including adding a facing plate (flat or corrugated) to the wall or the addition of an X-bracing or stiffening in the form of a light grillage welded to the wall. However limiting the deflection of the wall means less energy of the blast will be absorbed in bending which will attract high shear forces at the connections. Stiffer walls also tend to exhibit more brittle failure modes.

11.3.5.5

Transits penetrations in blast walls

Ideally no penetrations should be allowed in the wall as these are likely to reduce the available ductility under blast loading. However, if they are required they should be located at the top or bottom of the wall, or other locations where deflections will be a minimum. For existing installations the problem is likely to be more complex, as there are likely to be many penetrations including doors in some instances. These need special attention particularly in relation to any likely stiffening which can introduce undesirable stiffer areas which will attract high loads. It is also necessary to define whether the service (the subject of the penetration) moves with the wall or not. For instance, a large pipe can be regarded as a fixed object and the wall must move relative to it. However, a cable has a degree of flexibility, and providing adequate extension is available, can be anchored to the wall.

11.3.5.6

Combined behaviour of decks and walls

It has been suggested that internal ties, which restrict the differential movements between the floor and the ceiling, may be incorporated into the design to enhance its blast resistance. The ties must be designed so that do not carry any compressive loading occurring as a result of operational loading or the explosion rebound of the deck structures. In order reduce local loading effects the ties should preferably link the stiffer members of the deck structures.

11.3.6

Integration with fire hazard management

The integrity of door strengths and seals is of primary importance on air lock systems. The doors, seals and door mountings need to retain integrity through both the positive and negative parts of the explosion impulse and indeed remain functional afterwards.

11.3.7

Operations, inspection and maintenance issues

Good design is intended to deliver a reliable, robust system to the workplace that meets the required specification. How that system is operated and maintained is outside the control of the designer, although recommendations can be made regarding inspection, maintenance and operating procedures. In brown field modifications, the designer can assist with the continuation of existing safe working practices and safety records by utilising, where appropriate, the same equipment and material specifications as are already in use. In addition, the application of consistent sparing philosophies and tool sizes as are in use for that installation will also aid operator use and reduce the potential for accidents.

Issue 1

May 2007

Page 395 of 493

FIRE AND EXPLOSION GUIDANCE Operating procedures should recognise the explosion hazards associated with the misuse or poor maintenance of equipment. Rigorous testing procedures should prevail to ensure that any intervention activities with pressurised hydrocarbon systems are executed only after depressurisation and purging is confirmed. Following reinstatement of systems, nitrogen leak testing is recommended to confirm joint integrity. Inspection and maintenance procedures should be regularly reviewed to ensure that best current practices are considered, whilst retaining the intended operating philosophy and design intent. Inspection methods should recognise the function and defined performance standards of safety systems and ensure that they are not compromised by their removal or disabling during critical operations in order to repair or gain inspection access.

11.4

Industry and regulatory authority initiatives

11.4.1

ATEX directives

The ATEX (Atmospheric Explosion) Directives 94/9/EC [11.8] and 1999/92/EC [11.9] cover electrical and mechanical equipment and protective systems, which may be used in potentially explosive atmospheres (flammable gases, vapours or dusts). The term “equipment” is defined as ‘any item which contains or constitutes a potential ignition source and which requires special measures to be incorporated in its design and/or its installation in order to prevent the ignition source from initiating an explosion in the surrounding atmosphere’. Also included in the term “equipment” are safety or control devices installed outside the hazardous area but having an explosion protection function. “Protective Systems” are defined as items that prevent an explosion that has been initiated from spreading or causing damage. They include flame arresters, quenching systems, pressure relief panels and fast-acting shut-off valves.

11.4.2

Bolted pipe joints

An essential aspect of maintaining integrity in mechanical joints is correct joint design and analysis. In the case of bolted flanges this is achieved through the use of design codes such as PD5500 [11.10] and ASME VIII [11.11] as well as correctly executed working practices with regard to joint make up. In the case of bolted joints, this includes sequence of bolt tightening, method of tightening (torturing or tensioning) and leak testing. These factors all influence the integrity and pressure retention capacity of the joint and if any or all of these are not rigorously followed, failure will result. A UKOOA guideline [11.12] is in preparation that covers the lifecycle activities of bolted pipe joints, including the critical aspects of system design, construction, maintenance and operation. It will set out the principles of joint integrity management and provide examples of best practice to assist operators in develop their own management systems. Training and competency are significant contributors to successful safe operating practices and demonstrate that good design alone is not sufficient where manual intervention is required with hydrocarbon systems.

11.4.3

Small bore pipework, tubing and flexible hoses

These components are commonly used in process systems both for instrument connections and other process duties. A common definition of small bore is 50 mm and under. Small bore piping and tubing is often site-run without any particular assessment of the strength and integrity of the configuration. They require special treatment due to this and the fact that it is often difficult to provide assurance of their capacity when exposed to accidental loads such as blast loads.

Issue 1

May 2007

Page 396 of 493

FIRE AND EXPLOSION GUIDANCE Most concerns with these systems are associated with vibration and fatigue, which can lead to uncontrolled releases, as the received explosion loads are of small magnitude. In actuality the loads derived from large differential movements between supports on these systems can be critical, but then the additional released inventory may not be significant in terms of the unfolding event. The recently published “Guidelines for the Management, Design, Installation and Maintenance of Small Bore Tubing Systems” [11.13] records that "small bore tubing systems are the single largest contributor to the incidence of process containment rupture in potentially hazardous plants". As such, the adoption of these guidelines go some way to assuring the integrity of tubing systems under operational loading, such as vibration, and should be adopted as a basis for good practice for resistance to accidental loads, such as mechanical impact, which are a further cause of releases. At the time of writing, a joint UKOOA/HSE workgroup is to be set up to review general industry best practice on flexible hose management. Shell’s flexible hose management system has been offered as a starting point. This system utilises a risk matrix to categorise the consequence of hose failure in terms of human injury, environmental impact and production or equipment losses. An inspection and hose replacement frequency is determined by the hose classification and performance standards for hose condition and competency standards for operators have been established. All Shell installations have been reviewed for compliance with this strategy.

Issue 1

May 2007

Page 397 of 493


Annex A

References

A1 - References – Chapter 1 1.1

Selby C A, Burgan B A, ‘Blast and Fire Engineering for Topside Structures – Phase 2, Final Summary Report’, Steel Construction Institute, ISBN 1 85942 078 8, 1998

1.2

‘Offshore Installations (Prevention of Fire and Explosion and Emergency Response) Regulations’ (PFEER), HMSO, 1995

1.3

‘Offshore Installations (Safety Case) Regulations’ (SCR), HMSO 1992.

1.4

‘Offshore Installations and Wells (Design and Construction, etc.) Regulations’ (DCR), HMSO 1996.

1.5

‘Petroleum and natural gas industries – Control and mitigation of fires and explosions on offshore production installations – Requirements and guidelines’, 1st Edn. 1999, ISO 13702.

1.6

NORSOK, Guideline for Risk and Emergency Preparedness Analysis, Z-013.

1.7

‘JIP - Gas build up from high pressure natural gas releases in naturally ventilated offshore modules – Workbook on gas accumulation in a confined and congested area’, BP Amoco, CERC, BG Technology, May 2000.

1.8

BS EN 1127-1: 1998 “Explosive atmospheres. Explosion prevention and protection”, BSI, 1998

1.9

HSE OTI 92-596: Oil and Gas Fires: Characteristics and impacts

1.10

HSE OTI 92-597: Behaviour of oil and gas fires in the presence of confinement and obstacles

1.11

HSE OTI 92-598: Current fire research, experimental, theoretical and predictive modelling resources

1.12.

‘Area Classification Code for Petroleum Installations’, Institute of Petroleum. March 1990. (IP 15)

1.13

BS EN 60079-10: 2004 “Electrical apparatus for explosive gas atmospheres Part 10. Classification of hazardous areas”, BSI 2004

1.14

Bennet JF, Cotgreave T, Cowley L T and Shirvill L C, Shell Offshore Flame Impingement Protection Programme (SOFIPP): Parts 1, 2 and 3, Shell Research Limited, 1990

1.15

Review of the Response of Pressurised Process Vessels and Equipment to Fire Attack, OTO 2000 051, HSE Books, 2000

1.16

BS 5958: 1991: “Code of practice for control of undesirable static electricity”, BSI 1991

1.17

‘Explosion assessment guidelines’, Genesis oil and gas consultants, report J6838 for the HSE June 2001.

Issue 1

May 2007

Page 398 of 493


‘Control of Risks at Gas Turbines Used for Power Generation’, Guidance Note PM84 HSE.

1.19

UKOOA Publication,EHS08 Industry Guidelines on a Framework for Risk Related Decision Support, 1999

1.20

Wishart J. et. Al., ‘White paper – working group 2 – Safe design practice’, International workshop ‘Fire and blast considerations in the future design of offshore facilities’, June 2002, Houston Texas. http://www.fireandblast2002.com

1.21

‘Hydrocarbon release reduction campaign’, HSE books, HSE OSD report OTO 2001 055, HMSO 2001.

1.22

Successful health and safety management HSG65, ISBN 0 7176 1276 7, HSE Books 1997

1.23

Bleach R., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and mitigation of explosions, CTR 104, Management of explosion hazards’, Genesis Oil and Gas Consultants, August 2002.

1.24

API RP 75: Development of a Safety and Environmental Management Program for Outer Continental Shelf Operations and Facilities, 3rd Edition, Product Number: G07503, May 2004

1.25

ISO 14001: 2004, “Environmental management systems -- Requirements with guidance for use”, International Standards Organisation, 2004

Issue 1

May 2007

Page 399 of 493

FIRE AND EXPLOSION GUIDANCE A2 - References – Chapter 2 2.1

‘Interim Guidance Notes for the Design and Protection of Topside Structures Against Explosion and Fire’, Various Authors, Joint Industry Project on Blast and Fire Engineering for Topside Structures, November 1992

2.2

FABIG, Technical note 3, ‘Use of ultimate strength techniques for fire resistant design of offshore structures’, 1995

2.3

NORSOK, ‘Guideline for Risk and Emergency preparedness Analysis, Z-013, 2001

2.4

ISO 19901-3: 2003 Petroleum and natural gas industries – Specific requirements for offshore structures – Part 3: Topsides Structure, International Standards Organisation, 2003

2.5

Offshore Technology Report 2001/055; OSD hydrocarbon release reduction campaign; Report on the hydrocarbon release incident investigation project -1/4/2000 to 31/3/2001, 2001 ISBN 0 7176 2142 1

2.6

‘Worldwide offshore accident database’, (WOAD), DNV Publications,

2.7

‘OREDA – Offshore reliability data’, Penwell Books.

2.8

‘Offshore Accident and Incident Statistics Report 1998’, OTO 98: 952, HSE, HMSO, 1998.

2.9

‘Accident statistics for fixed offshore units on the UK continental shelf 1991–1999’, DnV for the HSE, OTO 2002 012, HMSO 2002.

2.10

‘UKOOA Hydrocarbon release statistics review’, UKOOA, January 1998.

2.11

Offshore Hydrocarbon Releases Statistics And Analysis, 2002 - HID Statistics Report HSR 2002 002 – February 2003

2.12

“Ignition Probability Review, Model Development ISBN 978 0 85293 454 8, Energy Institute, January 2006

2.13

“Handbook for fire calculations and fire risk assessment in the process industry”, available from Sintef and Scandpower, (see www.scandpower.com)

2.14


2.15

Cullen, The Public Enquiry into the Piper Alpha Disaster, Department of Energy, Report Cm1310, Her Majesty's Stationery Office, London, 1990

2.16

Oil and Gas Fires: Characteristics and impact, OTI 92-596:, ISBN 011 882034 6, HSE Books, 1992

2.17

Dalzell, G., FABIG Technical meeting – ‘Inherently Safer design’, January 1997

2.18

Alderman J.A., Carter D., ‘White paper – working group 1 – Philosophy and management strategy’, International workshop ‘Fire and blast considerations in the future design of offshore facilities’, June 2002, Houston Texas. http://www.fireandblast2002.com

2.19

‘A Review of Potential Ignition Sources on Offshore Platforms’, HSL Report, FS 99/09.

2.20

UKOOA Publication EHS13, “Guidelines for Quantitative Risk Assessment Uncertainty” (Issue No. 1), March 2000

2.21

API RP75, "Recommended Practice for Development of a Safety and Environmental Management Program (SEMP) for Outer Continental Shelf Operations and Facilities.", American Petroleum Institute, 1993

Issue 1

May 2007

and

Look-up

Correlations”,

Page 400 of 493


EN ISO 13702:1999 ‘Petroleum and natural gas industries – Control and Mitigation of fires and explosions on offshore production installations – Requirements and Guidelines’ International Standards Organisation, 1999

2.23


2.24

‘JIP - Gas build up from high pressure natural gas releases in naturally ventilated offshore modules – Workbook on gas accumulation in a confined and congested area’, BP Amoco, CERC, BG Technology, May 2000

2.25

‘Explosion assessment guidelines’, Genesis oil and gas consultants, report J6838 for the HSE June 2001

Issue 1

May 2007

Page 401 of 493

FIRE AND EXPLOSION GUIDANCE A3 - References – Chapter 3 3.1

IEC 61508; “Functional safety of electrical/electronic/programmable electronic safety-related systems”; Parts 0 to 7, International Electro technical Commission, 1998-2005

3.2

IEC 61511; “Functional safety - Safety instrumented systems for the process industry sector”; Parts 1 to 3, International Electro Technical Commission, 2003-2004

3.3

ISO 23251:2006 “Petroleum, petrochemical and natural gas industries -- Pressure-relieving and depressuring systems”, International Standards Organisation, 2006

3.4

International Convention for the Safety of Life at Sea (SOLAS), 1974, International Maritime Organization, Adoption: 1 November 1974, Entry into force: 25 May 1980

3.5

Walker S and Tahan N., FABIG (Fire and Blast Information Group) Article R139 - 'A Rational Approach to Fire Consequence Assessment', Issue 9, June 1994

3.6

Recommended Practice for the planning, Designing and Construction Fixed Offshore Platforms – Working Stress Design, API RP 2A-WSD, 21st Edition. API (American Petroleum Institute), 2000

3.7

Bob Bruce, ‘The online offshore hydrocarbon releases (HCR) system’, Paper 11, ERA Conference, ‘Major hazards offshore’, London, December 2003.

3.8

OTO 55 2001 Hydrocarbon release reduction campaign - Report on the hydrocarbon release incident investigation project -1/4/2000 to 31/3/2001, ISBN 0 7176 2142 1, HSE Books, 2001

3.9

‘Worldwide offshore accident database’, (WOAD), DNV Publications

3.10

OTO 98: 952, Offshore Accident and Incident Statistics Report 1998, (Provisional Data), HSE Books 1998

3.11

‘OREDA – Offshore reliability data’, Penwell Books

3.12

OTO 2002 012; Accident statistics for fixed offshore units on the UK Continental Shelf 19911999, , ISBN 0 7176 2339 4, HSE Books 2002

3.13

ISO DIS (22899-1) “Determination of the resistance to jet fires of passive fire protection materials -- Part 1: General requirements”, International Standards Organisation, 2006

3.14

‘Offshore Installations (Safety Case) Regulations’ (SCR), HMSO 1992

3.15

Natabelle Technology Ltd, ‘Explosion Loading on Topsides Equipment: Part 1 - Treatment of Explosion Loads, Response, Analysis and Design’, Health and Safety Executive Report OTO 1999 046, March 2000

3.16


3.17

BS EN 60079-10: 2004 “Electrical apparatus for explosive gas atmospheres Part 10. Classification of hazardous areas”, BSI 2004

3.18

‘Control of risks at gas turbines used for power generation’, HSE Guidance note PM84.

3.19

Bleach R., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and mitigation of explosions, CTR 104, Management of explosion hazards’, Genesis Oil and Gas Consultants, August 2002

3.20

Tahan, N., Nicholson, R.W, Walker S. and Tandberg, D. ‘The Design and Testing of a Louvered Blast Relief System’, 3rd Intl. Conference and Exhibition - Offshore Structures Design - Hazards and Safety Engineering, London, 15 - 16 November 1994

Issue 1

May 2007

Page 402 of 493


FABIG Technical note 2, ‘Technical note on Explosion mitigation systems’, SCI 1994

3.22

Walker S and Klair M, 'The Escalation Consequences of Accidental Shock Loads', 3rd Intl. Conference and Exhibition - Offshore Structures Design - Hazards and Safety Engineering, London, 15 - 16 November 1994

3.23

Morrison G., ‘Strong Vibration and Design for Robustness’ HSE - ERA Conference Offshore Structural Design – Hazards, Safety and Engineering, November 1994

3.24

Evans J.A., Johnson D.M. and Lowesmith B., ‘Explosions in full scale offshore module geometries – Main report’, (Phase 3A) HSE books OTO 1999 043, 1999

3.25

‘Electrostatic hazards associated with water deluge and explosion suppression systems offshore’, HSE books, OTO 95 026, 1995

3.26

ISO 13702: 1999, “Petroleum and natural gas industries – Control and mitigation of fires and explosions on offshore production installations – Requirements and guidelines”, 1st Edn. International Standards Organisation 1999

3.27

Tam, V.H.Y. ‘Barrier Methods for Gas Explosion Control, Safety on Offshore Installations’, ERA Report, 99-0808, December 1999

3.28

FPSO Design Guidance Notes, Report no. VES06, UKOOA, March 2002

3.29

OGP F(P)SO Design Guidance for Marine Hazards, (under review prior to issue)

3.30

International Safety Guide for Oil Tankers and Terminals (ISGOTT), 4th Edition, Oil Companies International Marine Forum (OCIMF)/International Chamber of Shipping (ICS)/International association of Ports & Harbors (IAPH), 1996

3.31

“Offshore Loading Safety Guidelines: with special relevance to harsh weather zones”, 1st Edition, Oil Companies International Marine Forum, 1999

3.32

UKOOA FPSO COMMITTEE Tandem Loading Guidelines Volume 1- FPSO / Tanker Risk Control During Offtake, and Volume 2 - The Use of Towing Assistance for Tandem Offtake, 2002

3.33

International Convention for the Prevention of Pollution from Ships, 1973, as modified by the Protocol of 1978 relating thereto (MARPOL 73/78), 1973, amendments 1984 to 2006

3.34

International Convention on Load Lines, 1966, International Maritime Organization, Adoption: 5 April 1966, Entry into force: 21 July 1968

3.35

Standards of Training, Certification and Watch-keeping Convention 1978 amended 1995, (see http://www.stcw.org)

3.36

Convention on the International Regulations for Preventing Collisions at Sea, 1972 (COLREGs); International Maritime Organization, Adoption: 20 October 1972, Entry into force: 15 July 1977

3.37

International Convention on Tonnage Measurement of Ships, 1969; International Maritime Organization, Adoption: 23 June 1969, Entry into force: 18 July 1982

3.38

The Code for the Construction and Equipment of Mobile Offshore Drilling Units, 1989 (1989 MODU Code), International Maritime Organization, Adopted by Assembly resolution A.649 (16) The 1989 MODU Code superseded the 1979 MODU Code adopted by Assembly resolution A.414(XI)

3.39

Issue 1

The Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Office of Public Sector Information, Statutory Instrument 1995 No. 743

May 2007

Page 403 of 493


CAP 437, Offshore Helicopter Landing Areas – Guidance on Standards, Civil Aviation Authority, Safety Regulation Group, ISBN 0 11790 439 2, 2005 (see http://www.caa.co.uk/docs/33/CAP437.PDF)

3.41

“The offshore installations and pipeline Regulations”, HMSO, (SI 1995/738), (MAR)

3.42

“Policy and Guidance on reducing risks to ALARP in Design”, HSE web site http://www.hse.gov.uk/dst/alarp1.htm

3.43


3.44

Johnson D.M., Cleaver R.P., ‘Gas explosions in offshore modules following realistic releases (Phase 3B) - Final summary report’, Advantica report R4853, February 2002

3.45

BS EN 1991:2003 “Eurocode 1: Basis of design and actions on structures Part 1: Basis of design”, and Part 1-2: 2002 “Actions on structures exposed to fire”, BSI 2002-3

3.46

BS 476:1987: “Fire tests on building materials and structures”, BSI 1987

Issue 1

May 2007

works

(Management

and

Administration)

Page 404 of 493


A4- References – Chapter 4 4.1


4.2

American Petroleum Institute (API), Sizing, selection and installation of pressure-relieving devices in refineries, Part 1 – Sizing and selection, Recommended Practice RP 520 Part 1, 7th Edition, 2003

4.3

A.J. Gosse and G. Hankinson, Use of water deluge to minimise hazards of oil and gas fires offshore, Proceedings of the IGRC, Amsterdam 2001

4.4

D.M. Johnson, R.P. Cleaver, Advantica Technology Inc., J.S. Puttock, Shell Global Solutions, C.J.M. Van Wingerden, GexCon, Investigation of gas dispersion and explosions in offshore modules, OTC Paper 14134, May 2002

4.5

C.A.J. Gregory and D.M Johnson, Explosions in Offshore Modules: Assessment and Research, Offshore Structural Design Against Extreme Loads, 2nd International Conference and Exhibition (ERA Technology), UK, 3-4th November 1993

4.6

NFPA 15: Standard for Water Spray Fixed Systems for Fire Protection, National Fire Protection Association, 2001 (next revision cycle 2006)

4.7

G. Hankinson, B.J. Lowesmith, J.A. Evans and L.C. Shirvill, Jet fires involving releases of crude oil, gas and water. Forthcoming article in Trans IchemE Process Safety and Environmental Protection

Issue 1

May 2007

and

Look-up

Correlations”,

Page 405 of 493


A5- References – Chapter 5 5.1

Guidelines for Chemical Process Quantitative Risk Analysis, Center for Chemical Process Safety (CCPS), ISBN: 0-8169-0720-X, 1999

5.2

NORSOK, ‘Guideline for Risk and Emergency preparedness Analysis, Z-013, 2001

5.3

Incropera F P, De Witt D P, Fundamentals of heat and mass transfer, John Wiley and Sons, ISBN 0-471-38650-2, 2002

5.4

Energy Institute (formerly The Institute of Petroleum), Guidelines for the design and protection of pressure systems to withstand severe fires, ISBN 0 85293 279 0, 2003

5.5

McGuire J H, Heat transfer by radiation, Fire Research Special Report No. 2, HMSO, 1953

5.6

Weast R C, Edited by Lide D R, Beyer W H and Astle M J, “CRC Handbook of Chemistry and Physics”, ISBN: 0849304709, 1989

5.7

Roberts T A, Gosse A and Hawksworth S, 2000, Thermal radiation from fireballs on failure of liquefied petroleum gas storage vessels, Trans IChemE. Vol. 78 Part B, pp. 184-192, 2000

5.8

Committee for the Prevention of Disasters, Methods for the calculation of physical effects (“Yellow Book”), CPR 14E, 3rd Edition, ISBN 9012084970, 1997

5.9

Society of Fire Protection Engineers (SFPE), Handbook of fire protection engineering, NFPA, ISBN 0-87765-451-4, 2002

5.10

Lees' Loss prevention in the process industries, edited by Sam Mannan, Mary Kay O’Connor, Imprint: Butterworth Heinemann, ISBN: 0-7506-7555-1,2005

5.11

Carsley A J., A model for predicting the probability of impingement of jet fires, IChemE Symp. Series 139, pp. 177-193, ISBN 0 85295 366 6, 1995

5.12

Cracknell R F, Davenport J N and Carsley A J, A model for heat flux on a cylindrical target due to the impingement of a large-scale natural gas jet fire, IChemE Symp. Series 139, pp. 161-175, ISBN 0 85295 366 6, 1995

5.13

Chamberlain, G., The hazards posed by large-scale pool fires in offshore platforms, IChemE Symp. Series 139, pp. 16213-226, ISBN 0 85295 366 6 , 1995

5.14

FABIG Technical note 1, ‘Fire resistant design of offshore structures’ 1993.

5.15

Association for Specialist Fire Protection (ASFP), Fire protection for structural steel in buildings, 3rd edition, ASFP ISBN 1 870409 20 5, 2002

5.16

DD ENV 13381-4:2002; Test methods for determining the contribution to the fire resistance of structural members. Applied protection to steel members, 2002

5.17

BS EN 1993-1-2:2005 (Eurocode 3) “Design of steel structures. General rules. Structural fire”, BSI 2005

5.18

BSEN 1994-1-2:2005 (Eurocode 4) “Design of composite steel and concrete structures. General rules. Structural fire design”, BSI 2005

5.19

‘Interim Guidance Notes for the Design and Protection of Topside Structures Against Explosion and Fire’, Various Authors, Joint Industry Project on Blast and Fire Engineering for Topside Structures, November 1992.

5.20

ISO 23251: 2006, “Petroleum, petrochemical and natural gas industries – pressure relieving and depressuring systems”, International Standards Organisation 2006

Issue 1

May 2007

2nd

Edition,

Page 406 of 493


API RP 520, Sizing, Selection and Installation of Pressure-relieving Devices in Refineries, Part I, 7th Edition, 2000 and Part II, 5th Edition, 2003

5.22

Roberts T A, Medonos S and Shirvill L C, Review of the response of pressurised process vessels and equipment to fire attack, Offshore Technology Report OTO 2000 051, HSE Books

5.23

“Handbook for fire calculations and fire risk assessment in the process industry”, available from Sintef and Scandpower, (see www.scandpower.com)

5.24

Persaud M A, Butler C J, Roberts T A, Shirvill L C and Wright S, Heat-up and failure of liquefied petroleum gas storage vessels exposed to a jet fire, Loss Prevention and Safety Promotion in the Process Industries, 10th Int. Symp. Proceedings 2, Elsevier ISBN 0 444 50699 3, 2001

5.25

Roberts T A, Gosse A and Hawksworth S, 2000, Thermal radiation from fireballs on failure of liquefied petroleum gas storage vessels, Trans IChemE. Vol. 78 Part B, May 2000, pp. 184192

5.26

Gayton, P.W. and Murphy, S.N. Depressurisation Systems Design. IChemE Workshop: The Safe Disposal of Unwanted Hydrocarbons, Aberdeen 1995

5.27

Hekkelstrand B and Skulstad P, Guidelines for the protection of pressurised systems exposed to fire, Scandpower report no. 27.207.291/R1 Version 2, 2004 (www.scandpower.com)

5.28


5.29

Fire Offices' Committee, 1979, “Tentative rules for medium and high velocity water spray systems”, 1979

5.30

Shirvill L C and White G C, Effectiveness of deluge systems in protecting plant and equipment impacted by high-velocity natural gas jet fires, ICHMT Int. Symp. on heat and mass transfer in Chemical Process Industry Accidents, , Rome, Italy, Sept. 15-16 1994

5.31

Lev Y, Water protection of surfaces exposed to impinging LPG jet fires, J. Loss Prev. Process Ind., 4(7), pp. 252-259, 1991

5.32

Shirvill L C, Efficacy of water spray protection against propane and butane jet fires impinging on LPG storage tanks, J. Loss Prevent. Process Ind., 17 pp. 111-118, 2004

5.33

Hankinson G and Lowesmith B J, Effectiveness of area and dedicated water deluge in protecting objects impacted by crude oil/gas jet fires on offshore installations, J. Loss Prevention in the Process Industries, 17 (2004) pp. 119-125

5.34

Special edition of the Journal of Loss Prevention in the Process Industries, March, 2003

5.35

Roberts T A, Directed deluge system designs and determination of the effectiveness of the currently recommended minimum deluge rate for the protection of LPG tanks, J. Loss Prevent. Process Ind., 17 (2004) pp. 103-109, 2004

5.36

Roberts T A, 2004, Effectiveness of an enhanced deluge system to protect LPG tanks and sensitivity to blocked nozzles and delayed deluge initiation, J. Loss Prevent. Process Ind., 17 (2004) pp. 151-158.

5.37

Roberts T A, 2004, Linkage of a known level of LPG tank surface water coverage to the degree of jet-fire protection provided, J. Loss Prevent. Process Ind., 17 (2004) pp. 169-178.

5.38

Roberts A F and Moodie K, J. oil & Colour Chemistry, pp. 192-195, 1989

5.39

Jet Fire Resistance Test of Passive Fire Protection Materials, Jet Fire Test Working Group, OTI 95 634, HSE Books, 1995

Issue 1

May 2007

Page 407 of 493


Code of Practice 1, Bulk LPG storage at fixed installations part 1: design, installation and operation of vessels located above ground, LP Gas Association (LPGA), 1998

5.41

Hymes I, Boydell W and Prescott B, Thermal radiation: Physiological and pathological effects, IChemE. ISBN 0 85295 328 3, 1996

5.42

Lees' Loss prevention in the process industries, edited by Sam Mannan, Mary Kay O’Connor, Imprint: Butterworth Heinemann, ISBN: 0-7506-7555-1,2005

Issue 1

May 2007

Page 408 of 493

FIRE AND EXPLOSION GUIDANCE A6- References – Chapter 6 6.1

Fairlie G., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and mitigation of explosions, CTR 105, Derivation of explosion loadings – method support dossier’, Century Dynamics Ltd., August 2002

6.2

Warwick A., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and mitigation of explosions, CTR 105, Preparation of updated guidance for fire and explosion hazards - Derivation of explosion loadings’, W.S. Atkins Inc., August 2002

6.3

Gregory J., ‘Early design blast analysis’, RISX Ltd. report RISX/12-01-01/01, November 1998

6.4

Lea C. J., Ledin H. S., ‘A Review of the State-of-the-art in Gas Explosion Modelling’, Health and Safety Laboratory Report CM/00/04, 19 February 2002

6.5

Marsano S, Bowen P.J., O’Doherty T. ‘Modelling the Internal/External Interaction from Vented Explosions, 13th Australasian Fluid Mechanics Conference, Melbourne, Australia, 13-18 December, 1998

6.6

‘Structural Analysis and Design of Nuclear Plant Facilities’, ASCE 58, 1980

6.7

Structures to Resist the Effects of Accidental Explosions - Department of Army, Washington, D. C - TM5-1300, November 1990

6.8

NORSOK, Guideline for Risk and Emergency Preparedness Analysis, Z-013

6.9

‘Hydrocarbon release reduction campaign’, HSE books, HSE OSD report OTO 2001 055, HMSO 2001

6.10

‘Worldwide offshore accident database’, (WOAD), DNV Publications

6.11

‘Offshore Accident and Incident Statistics Report 1998’, OTO 98: 952, HSE, HMSO, 1998

6.12

‘OREDA – Offshore reliability data’, Penwell Books

6.13

‘Accident statistics for fixed offshore units on the UK continental shelf 1991–1999’, DNV for the HSE, OTO 2002 012, HMSO 2002

6.14

‘UKOOA Hydrocarbon release statistics review’, UKOOA, January 1998.

6.15

HSE, SRD, ‘Discharge Rate Calculation Methods for Use in Plant Safety Assessments’ SRD/HSE/R352.

6.16

‘Area Classification Code for Petroleum Installations’, Institute of Petroleum. March 1990. (IP 15)

6.17

Gregory J., ‘Early design blast analysis’, RISX Ltd. report RISX/12-01-01/01, November 1998

6.18

‘JIP - Gas build up from high pressure natural gas releases in naturally ventilated offshore modules – Workbook on gas accumulation in a confined and congested area’, BP Amoco, CERC, BG Technology, May 2000

6.19

Design of Offshore Facilities to Resist Gas Explosion Hazard, Engineering Handbook, Ed. Czujko J., Corrocean 2001

6.20

Cleaver R P, Humphreys C. E., Robinson C. G., ‘Accidental generation of gas clouds on offshore process installations’, J. Loss Prev. Process Ind., 7, pp 273-280, 1994

Issue 1

May 2007

Page 409 of 493


Hansen O R, Bergonnier S, Renoult J ,Wingerden K, ‘Gas Explosions in Offshore Modules Following Realistic Releases (Phase 3B): Final Summary Report, Appendix E Phase 3B – Lessons Learnt from CFD’, Gexcon Report Number Gexcon-01-F36018-1, Advantica Report Number R4853, 2001

6.22

Pappas J., The NORSOK Procedure on Probabilistic Explosion Simulation, Paper 5.5.1, ERA Conference, ‘Major Hazards Offshore’, London 27-28 November 2001, ERA Report 20010575

6.23

Cleaver R P, Halford A R, ‘Gas Explosions in Offshore Modules Following Realistic Releases (Phase 3B): Final Summary Report, Appendix H An Analysis of the Phase-3B Large-Scale Gas Explosion Experiments’, Advantica Report Numbers R4853 and R5107, 2001

6.24

Johnson D.M., Cleaver R.P., ‘Gas explosions in offshore modules following realistic releases (Phase 3B) - Final summary report’, Advantica report R4853, February 2002

6.25


6.26

“Ignition modelling – Time dependent ignition probability model”, Technical report no. 963629, rev 04, DNV 1998

6.27

“Development of a method for the determination of on-site ignition probabilities”, WS Atkins, HSE Research Report 226, HSE Books, ISBN 0 7176 1657 6, 1998

6.28

Cox A W , Lees and Ang , ‘Classification of Hazardous Locations’, IChemE Books

6.29

OGP (formerly E&P Forum), ‘Hydrocarbon Leak and Ignition Database’, May 1992

6.30

Mercx W P M, Johnson D M, Puttock J, ‘Validation of scaling techniques for experimental vapour cloud explosion investigations’. Process Safety Progress, 14, No. 2, 120-130, 1995

6.31


6.32

Bray K.N.C., ‘Studies of the turbulent burning velocity’, Proc. Roy. Soc. London. A 1990 431, pp315-335

6.33

Harris R.J., ‘The investigation and control of gas explosions in building and heating plant’, ISBN 0 419 13220 1, E&FN Spon Ltd., 1983

6.34

Walker S., Corr R. B., Tam V.H.Y., ‘Guidance for the protection of Offshore Structures against Fires and Explosions’, BP Corporation, Document Reference CH152R002 API Draft 0, September 2001

6.35


6.36

Shearer M J, Tam V Y H, Corr R.B, ’ Analysis of results from large scale hydrocarbon gas explosions’, J. Loss Prev. Process Ind. 13, 167-173, 2000

6.37

CREA Consultants Limited. ‘Analysis of Structural Response Measurements – Phase 3B Spadeadam’, OTO 055/2000, 2000

6.38

Det Norske Veritas, ‘Offshore Standard DNV-OS-A101, Safety Principles and Arrangements’, January 2001

6.39

Puttock J S, ‘The use of a combination of explosion models in explicit overpressure exceedence calculations for an offshore platform’, Major Hazards Offshore Conference, London, November 2000

6.40

Hoiset S, Hjertager B H, Solberg T, Malo K A, ‘Properties of simulated gas explosions of interest to the structural design process’, AIChE Process Safety Progress 17, 1999

Issue 1

May 2007

and

Look-up

Correlations”,

Page 410 of 493


‘Assessment principles for offshore safety cases’ (APOSC), HSE Books, HSG181, ISBN 0 7176 1238 4, HMSO 1998

6.42

‘Acts, Regulations and Provisions for the Petroleum Activity’, Volume 2, NPD, December 1992

6.43

http://www.ptil.no/regelverk/r2002/frame_e.htm PSA Regulations website

6.44

Yasseri S.F., An Approximate Method for Blast Resistant Design, Paper R429, FABIG Newsletter January 2002, SCI publication

6.45

Walker S., Corr R.B.., Tam V.H.Y., Bucknell J. and O’Connor P., Simplified Approaches to Fire and Explosion Engineering, Paper 3.3.1, ERA Conference, ‘Major Hazards Offshore’, London 27-28 November 2001, ERA Report 2001-0575

6.46

Yasseri S.F., ‘Target explosion loads for offshore installations – strength level and ductility level events’, FABIG newsletter, October 2002

6.47

Lund J K, ‘COSAC, The Tool for Efficient Hazard Identification and Risk Assessment in the early phase of a field development’, ERA Major Hazards Offshore Conference, London, November 2000

6.48

Puttock J S, ‘Improvements in guidelines for prediction of vapour cloud explosions’, Int. Conf. and Workshop on Modelling the Consequences of Accidental Releases of Hazardous Materials, San Francisco, September 1999

6.49

Bruce R L, ‘Blast Overpressure Prediction - Modelling the Uncertainties’, Offshore Structural Design – ERA conference, Hazards, Safety and Engineering London November 1994, ISBN 0 7008 0587 7

6.50

Mood, M.A., Graybill, R.A., Boes, D.C. ‘Introduction to the theory of statistics’, 3rd Edn, McGraw-Hill, 1974

6.51

Vinnem J.E., ‘Blast load frequency distribution assessment of historical frequencies in the North Sea’, Preventor report 19816-04, November 1998

6.52

‘A Review of Potential Ignition Sources on Offshore Platforms’, HSL Report, FS 99/09

6.53


6.54

Corr R B, Tam V Y H, Snell R O, Frieze P A, ‘Development of the limit state approach for the design of offshore platforms’ ERA Conference, London, 1999

6.55

Corr R.B. and Tam V.H.Y., ‘Gas explosion drag loads in offshore installations’, Journal of Loss Prevention in the process industries, 11 (1998) 43-48

6.56

Walker S and Haworth M.W.,’ Sensitivity of response of topside structures to fires and explosions’, HSE OTO 97 043, 1996

6.57

‘A Guide to the offshore installations (Safety Case) regulations 1992’, HSE L39, HMSO 1992. (ACOP)

6.58

Bowerman H., Owens G W, Rumley J H, Tolloczko J.J.A., ‘Interim Guidance Notes for the Design and Protection of Topside Structures Against Explosion and Fire’, Steel Construction Institute Document SCI-P-112/487, January 1992

Issue 1

May 2007

Page 411 of 493


Catlin C.A. et al. ‘The blast loading imparted to a cylinder by venting of a confined explosion’, ERA Conference, Offshore structural design against extreme loads, London, 3-4 November 1993

6.60


Issue 1

May 2007

Page 412 of 493


FABIG Technical Note 6, ‘Design Guide for Steel at Elevated Temperatures and High Strain Rates’, 2001

7.2

DD ENV 1994: Eurocode 4: Design of composite steel and concrete structures Part 1.2 Structural fire design (including UK NAD) British Standards Institution , 1998

7.3

ISO 834:1999 Fire-resistance tests, Parts 1, 4 to 8, International Standards Organisation, 1999 to 2002

7.4

BS EN 1993-1-2:2005 (Eurocode 3) “Design of steel structures. General rules. Structural fire”, BSI 2005

7.5

ISO/DIS 22899-1, Determination of the resistance to jet fires of passive fire protection materials -- Part 1: General requirements, International Standards Organisation, 2005

7.6

BRITISH STEEL PLC (CORUS) The behaviour of multi-storey steel framed buildings in fire Report of a joint European joint research programme Corus, Swindon Technology Centre, 1999

7.7

Statutory Instrument 1996 No. 913 “The Offshore Installations and Wells (Design and Construction, etc.) Regulations 1996,”

7.8

BS 476:1987: “Fire tests on building materials and structures”, BSI 1987

7.9

ISO 834, Parts 1 to 9, Fire-resistance tests -- Elements of building construction, International Standards Organisation, 1999-2003

7.10

BS EN: 1363 Parts 1 and 2: 1999 “Fire resistance tests”, BSI 1999

7.11

EN ISO 13702:1999, Petroleum and natural gas industries – Control and Mitigation of fires and explosions on offshore production installations – Requirements and Guidelines, International Standards Organisation, 1999

7.12

BS 5950: 2005 “The structural use of steelwork in buildings”, BSI 2005

7.13

UK National Annex to BS EN 1991-1-2:2002. Eurocode 1. “Actions on structures. Actions on structures exposed to fire”, ISBN: 0 580 40831 0, BSI 2002

7.14

ECCS Model code on fire engineering, ECCS Publication 111, 2001

7.15

Rules for the determination of coat-back requirements, Steel Construction Institute Joint industry Project, SCT report RT543, March 1996

7.16

Parry C F, 1994, Relief systems handbook, IChemE, ISBN 0 85295 267 8, 1994

7.17

Design Institute for Emergency Relief Systems (DIERS), Emergency relief system design using DIERS technology, AIChemE, ISBN 0-8169-0568-1, 1992

7.18

Guidelines for Fire Protection in Chemical, Petrochemical, and Hydrocarbon Processing Facilities, Center for Chemical Process Safety/AIChE, 2003

7.19

Energy Institute (formerly The Institute of Petroleum), Guidelines for the safe and optimum design of hydrocarbon pressure relief and blowdown systems, ISBN 0 85293 287 1, 2001

7.20

OTO 2000 051, Review of the response of pressurised process vessels and equipment to fire attack, HSE Books, 2000

7.21

‘Interim Guidance Notes for the Design and Protection of Topside Structures Against Explosion and Fire’, Various Authors, Joint Industry Project on Blast and Fire Engineering for Topside Structures, November 1992

Issue 1

May 2007

Page 413 of 493



7.23

American Petroleum Institute, Petroleum, petrochemical and natural gas industries – pressure relieving and depressuring systems, Recommended Practice RP 521, 5th edition, Draft ISO 23251, 2005

7.24


7.25

NFPA 30: Flammable and Combustible Liquids Code, National Fire Protection Association, 2003

7.26

NFPA 58: Liquefied Petroleum Gas Code, National Fire Protection Association, 2004

7.27

ISO 4126, Parts 1 to 10, 2003 to 2006, “Safety devices for protection against excessive pressure”, Parts 9 & 10 still under development, 2003-2006

7.28

BS 6759 “Safety Valves”, Parts 1, 2 and 3 replaced by Reference 7.27

7.29

Gayton, P.W. and Murphy, S.N. Depressurisation Systems Design. IChemE Workshop: The Safe Disposal of Unwanted Hydrocarbons, Aberdeen 1995

7.30

Moodie K, Cowley L T, Denny R B, Small L M and Williams I, Fire engulfment tests on a 5 tonne LPG tank, J. Haz. Mats, 20 (1988) pp. 55-71

7.31

Roberts T and Beckett H, Hazard consequences of jet-fire interactions with vessels containing pressurised liquids: Project final report, HSL Internal Report PS/96/03 (to be published on the HSE/HSL website), 1996

7.32

Hekkelstrand B and Skulstad P, Guidelines for the protection of pressurised systems exposed to fire, Scandpower report no. 27.207.291/R1 Version 2, 2004 (downloadable from www.scandpower.com)

7.33

Benham P P, Crawford R J and Armstrong C G, “Mechanics of Engineering Materials”, 2nd edition, Longman Group Limited, ISBN 0-582-25164-8 1996

7.34

BS 7910: 1999 “Guide on methods for assessing the acceptability of flaws in metallic structures”, BSI 1999

7.35

Burgan B, Elevated temperature and high strain rate properties of offshore steels, Offshore Technology Report 2001/020, HSE Books ISBN 0 7176 2023 9, 2001

7.36

Billingham J, Sharp J V, Spurrier J and Kilgallon, 2003, Review of the performance of high strength steels used offshore, HSE Books, ISBN 0 7176 2205 3, 2003

7.37

Hymes I, Boydell W and Prescott B, Thermal radiation: Physiological and pathological effects, I.ChemE. ISBN 0 85295 328 3, 1996

Issue 1

May 2007

Page 414 of 493


Louca L.A., Friis J. and Carney S.J., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and mitigation of explosions, CTR 106, Response to explosions’, IC Consultants and Aker Kvaerner, August 2002

8.2

Bowerman H., Owens G W, Rumley J H, Tolloczko J.J.A., ‘Interim Guidance Notes for the Design and Protection of Topside Structures Against Explosion and Fire’, Steel Construction Institute Document SCI-P-112/487, January 1992

8.3

Hoiset S, Hjertager B H, Solberg T, Malo K A, ‘Properties of simulated gas explosions of interest to the structural design process’, AIChE Process Safety Progress 17, 1999

8.4

Walker S., Corr R.B.., Tam V.H.Y.., Bucknell J. and O’Connor P., Simplified Approaches to Fire and Explosion Engineering, Paper 3.3.1, ERA Conference, ‘Major Hazards Offshore’, London 27-28 November 2001, ERA Report 2001-0575

8.5

Biggs J.M., ‘Introduction to Structural Dynamics’, McGraw Hill, 1964

8.6

NORSOK Standard N-001, Structural design, Rev 3, August 2000

8.7

Clough, R.W, Penzien, J. ‘Dynamics of Structures’, McGraw-Hill, 1975

8.8

‘Blast and fire engineering project for topside structures’, BRI, ‘The effects of simplications of the explosion pressure-time history. Second impression’, 1991

8.9

‘Blast and fire engineering project for topside structures’, Report BR4, OTI:602 ‘The effects of high strain rates on material properties’, 1991

8.10

FABIG Technical note 6, ‘Design Guide for Steel at Elevated Temperatures and High Strain Rates’, SCI 2001

8.11

BS EN 10002-1: 2001 “Tensile testing of metallic materials. Method of test at ambient temperature”, Edition: 01, ISBN: 0580384594, BSI 2001

8.12

BS EN 10225: 2001 “Weldable structural steel for fixed offshore structures – Technical delivery conditions” BSI 2001

8.13

Jones, N. and Birch, R.S. ‘Elevated Temperature and High Strain Rate Properties of Offshore Steels’, The Steel Construction Institute. OTO Report 2001/020

8.14

BS EN 10088-2:1995, ‘Stainless steel – Technical delivery conditions’, BSI 1995

8.15

Jones, N. ‘Structural Impact’, Cambridge University Press, 1997

8.16

‘Offshore Installations (Safety Case) Regulations’ (SCR), HMSO 1992

8.17

‘Offshore Installations and Wells (Design and Construction, etc.) Regulations’ (DCR), HMSO 1996

8.18

‘Assessment principles for offshore safety cases’ (APOSC), HSE Books, HSG181, ISBN 0 7176 1238 4, HMSO 1998

Issue 1

May 2007

Page 415 of 493


Earthquake Resistant Design for Engineers and Architects - Dowrick, D. J. - 2nd Edition, Wiley, 1987

8.20

Norsok Standard N-004 “Design of steel structures” Annex A, Norsok 2004

8.21

BS 6399 – Part 1: 1996 “Loading for Buildings – Code of Practice for Dead and Imposed Loads”, BSI 1996

8.22

The Management of Integrity of Bolted Pipe Joints, Draft Issue 1, Jan 2000, UKOOA

8.23

Walker S, Corr BR, Tam VHY, O’Connor PA, Bucknell J, ‘New guidance on fire and explosion engineering’, paper OMAE02-28623, OMAE 2002, June 23-28, Oslo, Norway

8.24

Yasseri S.F., ‘Fire and Blast Information Group Newsletter, Retrofitting of Blast walls for Offshore Structures’. Issue No.15, 1996

8.25

Walker S and Haworth M.W.,’ Sensitivity of response of topside structures to fires and explosions’, HSE OTO 97 043, 1996

8.26

‘Recommended Practice for the planning, Designing and Construction Fixed Offshore Platforms – Working Stress Design’, API RP 2A-WSD, 21st Edition. API (American Petroleum Institute)

8.27

BS 5950: 2005 “The structural use of steelwork in buildings”, BSI 2005

8.28

FABIG Technical Note 4, ‘Explosion resistant design of offshore structures’

8.29

Kato B., ‘Rotation capacity of steel members subject to local buckling’, Proc. 9th World Conference on Earthquake Engineering, Japan 1989

8.30

Explosion Hazards and Evaluation - Baker, W. E. et al - Elsevier Science Publishers, 1988

8.31

‘Bulletin on design of flat plate structures’, API Bulletin 2V (BUL 2V) 1st Edn., May 1 1987

8.32

Taylor P.H., Stewart G., Harwood R.G., ‘Blast wall strength estimated using finite displacement theory’, OMAE98-1423, 17th conference on Offshore Mechanics and Arctic Engineering, 1998

8.33

Izzuddin, B., ‘Simplified Methods for Dynamic Response Analysis’. - FABIG Technical Meeting, January, 2002

8.34

FABIG Technical note 7, ‘Simplified methods for analysis of response to dynamic loading’, 2002

8.35

Louca, L. A., Punjani, M. and Harding, J. E., ‘Non-Linear Analysis of Blast walls and Stiffened Panels Subjected to Hydrocarbon Explosions’ - J. Constructional Res. Vol. 37, No.2, pp. 93113, 1996

8.36

‘Structural Analysis and Design of Nuclear Plant Facilities’, ASCE 58, 1980

8.37

Morrison G., ‘Strong Vibration and Design for Robustness’ HSE - ERA Conference Offshore Structural Design – Hazards, Safety and Engineering, November 1994

8.38

‘The Public Enquiry into the Piper Alpha Disaster’, Cullen The Honourable Lord, HMSO, London, 1990

Issue 1

May 2007

Page 416 of 493

FIRE AND EXPLOSION GUIDANCE A9- References – Chapter 9 No references cited.

Issue 1

May 2007

Page 417 of 493


ISO 13702:1999 Petroleum and natural gas industries – Control and Mitigation of fires and explosions on offshore production installations – Requirements and Guidelines, International Standards Organisation, 1999

10.2

Norsok S-001 Technical Safety (Rev. 3), Jan. 2000)

10.3

UKOOA Publication,EHS08 Industry Guidelines on a Framework for Risk Related Decision Support, 1999

10.4


10.5


10.6

IEC 61508; “Functional safety of electrical/electronic/programmable electronic safety-related systems”; Parts 0 to 7, International Electro technical Commission, 1998-2005

10.7

IEC 61511; “Functional safety - Safety instrumented systems for the process industry sector”; Parts 1 to 3, International Electro Technical Commission, 2003-2004

10.8

ISO 22899-1:2006, Determination of the resistance to jet fires of passive fire protection materials -- Part 1: General requirements, International Standards Organisation, 2006

10.9

American National Standards Institute (ANSI)/American Petroleum Institute, (API), Petroleum, petrochemical and natural gas industries – pressure relieving and depressuring systems, Recommended Practice RP 521, 4th Edition, 1997

10.10

ISO 23251:2006, Petroleum, petrochemical and natural gas industries -- Pressure-relieving and depressuring systems, International Standards Organisation, 2006

10.11

Fire Offices' Committee, 1979, “Tentative rules for medium and high velocity water spray systems”, 1979

10.12


Issue 1

May 2007

Page 418 of 493


Carney S.J., Gall D., Louca L.A., Friis J., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and mitigation of explosions, CTR 108, Guidance on detailed design’, Aker Kvaerner, IC Consultants, August 2002

11.2

API Recommended Practice 521, ‘Guide for Pressure-Relieving and Depressuring Systems’, 4th Edition, March 1997

11.3

Medonos S. and Berge Dr. G., ‘Why API Recommended Practice may Lead to Unsafe Design of Pressurised Systems’. ERA Major Hazards Offshore Conference Nov. 2001

11.4

HSE Offshore Division Safety Notice 2/2002 May 2002 “Balanced bellows pressure relief valves – problems arising from modification of the bonnet vent”, HSE 2002

11.5

Rockey, K.C. and Evans, H.R., ‘The Behaviour of Corrugated Flooring Systems, Thin Walled Structures’, Crosby Lockwood, 1967

11.6

FABIG Technical note 5, ‘Design guide for stainless steel blast walls’, June 1999

11.7

Yasseri, S.F., ‘Fire and Blast Information Group Newsletter, Retrofitting of Blast walls for Offshore Structures’. Issue No.15, 1996

11.8

“Equipment intended for use in Potentially Explosive Atmospheres (ATEX)”, Directive 94/9/EC of the European Parliament and the Council, CEC 1994

11.9

“Minimum requirements for improving the safety and health protection of workers potentially at risk from explosive atmospheres”, Directive 1999/92/EC of the European Parliament and the Council, CEC 1999

11.10

PD 5500: 2006 “Specification for unfired fusion welded pressure vessels”, BSI, 2006

11.11

ASME BPV Code: Section VIII, Division 1 – “Design and Fabrication of Pressure Vessels” and Section VIII Division 2 “Alternative Rules”, ASME International, 2004

11.12

The Management of Integrity of Bolted Pipe Joints, Draft Issue 1, Jan 2000, UKOOA

11.13

Guidelines for the Management, Design, Installation and Maintenance of Small Bore Tubing Systems, Institute of Petroleum, June 2000

Issue 1

May 2007

Page 419 of 493


Annex B

Glossary of terms

Term

Description

Acceptance criteria

Stated limits, thresholds or boundaries of performance and/or behaviour within which performance is deemed to be acceptable to the various stakeholders.

Accident

See 'incident'

Accidental event (AE)

Event or chain of events that may cause loss of life, or damage to health, the environment or assets NOTE - The events that are considered in a risk analysis are acute, unwanted and unplanned. For instance; planned operational exposure that may be hazardous to health or to the environment, are usually not included in a risk analysis.

Active Fire Protection

A fire protection method that requires activation – switching on, directing, injection or expulsion – in order to combat smoke, flames or thermal loadings.

Active Mitigation

Mitigation technique in which the release of suppressant is triggered as a result of flame or gas overpressure detection.

ALARP

As Low As Reasonably Practicable, a concept that forms the primary basis for determining the tolerability of risks and the adequacy of arrangements for managing risks to health and safety. Duty holders (The owner or operator of an existing installation or the designer of a new one) have a responsibility to reduce risk to ALARP.

ALARP

To reduce a risk to a level which is 'as low as reasonably practicable' involves balancing reduction in risk against the time, trouble, difficulty and cost of achieving it. This level represents the point, objectively assessed, at which the time, trouble, difficulty and cost of further reduction measures become unreasonably disproportionate to the additional risk reduction obtained.

Artificial ventilation

That ventilation which is not supplied from the action of the environmental wind alone.

As low as reasonably practicable (ALARP)

ALARP expresses that the risk level is reduced (through a documented and systematic process) so far that no further cost effective measure is identified. The requirement to establish a cost effective solution implies that risk reduction is implemented until the cost of further risk reduction is grossly disproportional to the risk reducing effect.

Issue 1

May 2007

Page 420 of 493

FIRE AND EXPLOSION GUIDANCE Term

Description

Auto-Ignition Temperature

The minimum temperature of a vapour and air mixture at which it is marginally self igniting.

Availability

The proportion of the total time that a component, equipment, or system is performing in the desired manner.

Availability

The probability of the system being available to perform the function when required.

Average Individual Risk (AIR)

The average chance of any individual in a defined population sustaining a given level of harm from incidents which are considered to be limited to that population. (Sometimes called Individual Risk – IR)

Blast Relief Panel

Parts of a module wall, ceiling or roof which are designed to increase the area of venting in an explosion by being opened or removed by the force of the explosion.

Blast Wall

A structural division which has been designed expressly for the purpose of resisting blast loads.

Blast Wave

A pressure pulse formed by an explosion.

BLEVE

Boiling Liquid Expanding Vapour Explosion; the result of a catastrophic rupture of a pressurized vessel containing a liquid at a temperature above its normal boiling point. Simultaneous ignition of the vaporizing fluid gives a short duration, intense fireball.

Blockage Factor

The fraction of an area which does not provide open venting or free passage for a flame.

Blow down

The rapid controlled or accidental depressurization of a vessel or network.

Blow-out (ignited)

A form of jet resulting from ignition of a high pressure flow of oil and/or gas issuing from an uncontrolled well, possibly with substantial fallout of heavy fractions which may also ignite on or around the platform as pool fires.

Boiling liquid expanding vapour explosion (BLEVE)

The sudden rupture due to fire impingement of a vessel system containing liquefied flammable gas under pressure. The pressure burst and the flashing of the liquid to vapour creates - a blast wave and potential missile damage, and immediate ignition of the expanding fuelair mixture leads to intense combustion creating a fireball

Burning Velocity

The rate at which the flame consumes the unburnt gas/vapour. Also the velocity of the flame relative to the unburnt gas/vapour.

Caisson

A vertically aligned pipe, running from the module deck to a sub sea level, forming a service line for seawater suction or sewage/drilling disposal.

Issue 1

May 2007

Page 421 of 493


Description

Can

Verbal form used for statements of possibility and capability, whether material, physical or causal

Cellulosic Fire

A fire with a fuel source predominantly of cellulose (e.g. timber, paper, cotton). A fire involving these materials is relatively slow growing, although its intensity may ultimately reach or exceed that of a hydrocarbon fire.

Chemical Composition

The proportion by weight of constituent elements in a particular batch of steel as determined by ladle analysis.

Coatback

The extension of PFP from protected primary members along secondary, tertiary or plate to prevent heat conduction from a flame impingement reaching welded joints and causing a weakening of those joints.

Common Mode Failure

The failure of components from the same cause.

Company

An organisation engaged, as principal or contractor, directly or indirectly, in the exploration for and production of oj I and/or gas. For bodies or establishments with more than one site, a single site may be defined as a company.

Compartment fires

A fire that starts and continues within a confined volume on the installation, such as a contained process area, equipment enclosure or designated room (e.g. control room).

Computational Fluid Dynamics (CFD)

A mathematical model in which the region of the flow is subdivided by a grid into a large number of control volumes.

Confinement

Confinement is defined as a measure of the proportion of the boundary of the explosion region which prevents the fuel/air mixture from venting or being released to the external atmosphere.

Confined Explosion

An explosion of a fuel-oxidant mixture inside a closed system (e.g. vessel or module).

Congestion

Congestion is a measure of the restriction of flow within the explosion region caused by the obstacles within that region.

Contractor

Person, company or other association that performs work for an Operator or in other ways is a supplier of products or services to the Operator.

Control

Means of intervention permitted by the design (e.g. pressure relief valves, emergency power supplies) safety hardware (eg. dump tanks, coolant sprays), or the presence of manually or automatically initiated ESD procedures which are intended to contain a developing situation so that escalation and a major accident may be avoided.

Issue 1

May 2007

Page 422 of 493


Description

Convection (Heat)

Heat transfer associated with fluid movement around a heated body; warmer, less dense fluid rises and is replaced by cooler, more dense fluid.

Convection

Transfer of material (fluid or gas) from one place to another.

Convective heat flux

The measured or calculated heat flux crossing a boundary or surface due to convection heat transfer only.

Cost Benefit Analysis (CBA)

A quantitative technique to assess the overall value of a proposal taking into account likely benefits and detriments.

Creep

The time dependent straining of a material. It is measured under a constantly applied load and, in the context of this report, at a fixed temperature.

Criticality (of SCEs)

Defined by the criticality classes 1 (highest) to 3 (lowest) with respect to the explosion hazard and the consequences of failure. In particular the impact on the TR, EER systems and associated supporting structure.

Decision Basis/Bases

The basis/bases for assessing the performance of decision options. These range from technical codes and standards based ways of assessing options to values based assessments based on company or wider societal values and stakeholder expectations and perceptions.

Decision Context

The background or environment in which the decision needs to be made. The decision context affects the importance of the various decision bases. For the purposes of the model the context is represented as a gradual transition from a technical basis to a values basis.

Decision Factors

Aspects of performance or influencing factors that can have a bearing on the decision, either because they directly affect option performance or because they determine the context in which the decision needs to be made.

Decision Framework

The decision framework consists of the model and accompanying guidance on the decision context and means of calibration. It provides the practical tool to aid decision making.

Decision Option(s)

The different options or solutions which are to be considered as means to resolve the problem.

Deflagration

Mechanism for propagation of an explosion reaction through a flammable gas mixture which is thermal in nature. It is a relatively slow process and the velocity is always less than the speed of sound in the mixture (see Detonation).

Deflagration

The chemical reaction of a substance in which the reaction front advances into the unreacted substance at less than sonic velocity. Where a blast wave is produced which has the potential to cause damage, the term explosive deflagration may be used.

Issue 1

May 2007

Page 423 of 493


Description

Design accidental event

An accidental event for which SCEs on the installation should perform their function as designed.

Design basis checks

Design basis checks consist of checking the basis of the existing design for the installation and determining if the methods used for the design are acceptable in the context of the explosion hazard.

Design explosion loads

Explosion loads used for design. SCEs must be designed to resist these load levels within the constraints of the associated element specific performance standards.

Detonation

Mechanism for propagation of an explosion reaction through a flammable gas mixture which is more mechanical in nature and acts through shock pressure forces. It is a very rapid process and velocity is always greater than the speed of sound in the mixture (see Deflagration).

Detonation

An explosion caused by the extremely rapid chemical reaction of a substance in which the reaction front advances into the unreacted substance at greater than sonic velocity.

Detonation Limits

The range of fuel-air ratios through which detonations can propagate.

Diffracted Wave

That component of the blast wave which propagates into the sheltered region behind the structure.

Diffusivity

An expression relating to the range of mass transmitted through a given medium to that absorbed by the medium. It has units m2 s-1.

Dilution

Addition of inert gas to flammable mixture.

Dimensioning accidental event (DAE)

Accidental Events (AEs) that serve as the basis for layout, dimensioning and use of installations and the activity at large, in order Ito meet the defined RAC.

Design accidental load (DAL)

Load (action) that is sufficient in order to meet the risk acceptance criteria.

Dimensioning explosion loads

Explosion loads which are of such a magnitude that when applied to a simple elastic analysis model, the code check results in members dimensioned to resist the ductility level explosion.

Dirivent

An HVAC system whereby increased mixing is achieved by way of directed jet nozzles.

Dose

The accumulated exposure of an individual to harmful conditions.

Drag Coefficient

An empirical multiplying constant used to relate the drag load on a structure to the stagnation overpressure.

Issue 1

May 2007

Page 424 of 493


Description

Drag force

The drag load on a small obstacle due to the movement of gas past a small obstacle less than 0.3 m in the direction of flow, form drag – Presented Area x Pdrag.

Ductility level blast (DLB)

Representative peak overpressure used in design (10-4 to 10-5 p.a. probability level) – Pduct.

Ductility level design event

See DLB.

Ductility Ratio

The ratio of the peak deflection to the deflection at first effective yield.

Ductility ratio μ

The ratio of the maximum displacement of the element to the deflection required to cause first yield at the extreme fibres.

Duty Holder

The organisation or company responsible for the safety of the installation or its design under UK legislation.

Dynamic pressure

Representative peak out of balance loads over target area, includes drag, pressure difference and gas acceleration effects. Used for calculation of loads on equipment and piping – Pdyn, sometimes referred to as dynamic overpressure.

Effectiveness analysis

Analysis which documents the fulfilment of performance standards for safety and emergency preparedness. NOTE - Effectiveness analyses in relation to technical performance standards for essential safety systems are carried out in relation to risk analyses. It is therefore a prerequisite that quantitative risk analyses in relation to design include quantitative analyses of escape, evacuation and rescue. Similarly, effectiveness analyses of emergency preparedness measures are done in connection with emergency.

Element specific performance standard

Measurable performance standard for specific key items or systems relating to systems’ functionality, availability and survivability. (Sometimes referred to as low level performance standard).

Emergency preparedness

Technical, operational and organisational measures that are planned to be implemented under the management of the emergency organisation in case hazardous or accidental situations occur, in order to protect human and environmental resources and assets.

Emergency preparedness analysis (EPA)

Analysis which includes establishment of OSHA, including major AEs, establishment of Performance Standards for emergency preparedness and their fulfilment and identification of emergency preparedness measures.

Emergency Shutdown System

A safety shutdown system comprising detection, signalling and logical control, valves and actuators, which can, in tandem with alarm and direct control mechanisms, enable the safe and effective shutdown of plant and machinery in a controlled manner.

Issue 1

May 2007

Page 425 of 493


Description

Emergency Shutdown Valve (ESDV)

A valve mounted in a pipeline, pipe or marine riser specifically for the purpose of cutting of the supply of its normal contents in an emergency.

Emissivity

A constant used to quantify the radiation emission characteristics of a flame. The emissivity of a perfectly black body is 1.

Entrainment

The process by which surrounding fluid is drawn into a jet to cause its dilution.

Environment

The surroundings and conditions in which a company operates or which it may affect, including living systems (human and other) therein.

Environmental effect

A direct or indirect impingement of the activities, products and services of the company upon the environment, whether adverse or beneficial.

Environmental effects evaluation

A documented evaluation of the environmental significance of the effects of the company's activities, products and services (existing and planned).

Equivalent static overpressure

An overpressure derived from an overpressure trace with respect to a target which gives the same peak deflection when applied as a static load as the original trace.

Escalation

Consequences subsequent to an explosion or other major hazard.

Essential safety system

System which has a major role in the control and mitigation of accidents and in any subsequent EER activities.

Establishment of emergency preparedness

Systematic process which involves planning and implementation of suitable emergency preparedness measures on the basis of risk and EPA, see above “Emergency Preparedness Analysis”.

Exceedance curve

A plot of the value of a variable against the plot of the probability or frequency of exceedance of that variable.

Expansion Ratio

The ratio of burnt to unburnt gas volumes of a given mass of gas.

Explosion

A release of energy which causes a pressure discontinuity or blast wave. (see gas explosion).

Explosion risk

risk from the initiating event and possible subsequent escalation.

External explosion

External or secondary explosions which may result as an unburnt fuel/air mixture comes into contact with the external (oxygen rich) atmosphere as it is vented from a compartment.

Extreme (residual) events

Events for which design is not reasonably practicable may result in loss of functionality of SCEs.

Issue 1

May 2007

Page 426 of 493


Description

F Factor

The fraction of the net combustion energy of a flame transmitted as radiation.

Fail-Safe Valve

An actuated valve which automatically assumes a safe position (open or closed depending on the needs of the system) in the event of loss of power to the actuator.

Finite element (analysis)

FEA consists of a computer model of a material or design that is stressed and analyzed for specific results.

Fire

A process of combustion characterized by heat or smoke or flame or a combination of these.

Fire and explosion risk analysis

The analytical study of the likelihood and severity of both defined fire hazard and explosion hazard scenarios.

Fire Ball

This phenomenon, which may occur as the result of a deflagration of a vapour cloud that does not result in a blast wave. Alternatively, a fire, burning sufficiently rapidly for the burning mass to rise into the air as a cloud or ball.

Fire Curve

A temperature/time curve devised for a fire tests that is intended to represent (but not necessarily reproduce) the temperature development of a ‘real’ fire, either cellulosic or hydrocarbon.

Fire Endurance

The length of time that an element can resist fire either up to the point of collapse or alternatively to the point when the deflection reaches a limiting value.

Fire hazard analysis

The application of hazard analysis techniques solely to fire hazards.

Fire Point

The temperature at which a liquid fuel flashes and then marginally sustains a flame.

Fire Prevention

Measures taken to prevent the outbreak of fire at a given location.

Fire Protection

Measures taken to minimize effects of damage from fire should it occur.

Fire Protection System

An integrated detection, signalling and automated fire control system.

Fire risk analysis

The analytical study of the likelihood and severity of defined fire hazard scenarios.

Fire Test

A test designed to quantify the resistance to fire of elements of construction and/or materials applied thereto. Conventionally, such tests are carried out in purpose-built furnaces operating to a defined temperature/time curve.

Issue 1

May 2007

Page 427 of 493


Description

Fire Wall

A designated partition, which by nature of its construction and certification status, is warranted to resist a standard or hydrocarbon fire test for a particular time period. The term can apply to a floor or roof panel.

Fire Water Pump

A submersible electric or diesel pump, mounted in or capable of being lowered into a fire water pump caisson, which feeds into the firewater ring main.

Flammability Limits

The range of fuel-air ratios which can support non-detonative combustion such as laminar and turbulent flames.

Flash Fire

The combustion of a flammable vapour and air mixture in which flame passes through that mixture and negligible damaging overpressure is generated.

Flash Point

The flash point of a liquid is the temperature at which the vapour and air mixture lying just above its vaporizing surface is capable of just supporting a momentary flashing propagation of a flame prompted by a quick sweep of a small gas pilot flame near the surface.

Flashing

The rapid evaporation of a volatile liquid when suddenly released from pressurized storage.

Flow stress

Flow stress (a combination of UTS and elongation stress).

Forced Ventilation

Ventilation by mechanical means, e.g. a fan.

Free flame release

The flame resulting from a gas or liquid release but that subsequently has no impingement on any other bodies (such as equipment or structure).

Frequency

The number of occurrences anticipated during a unit of time.

Fuel Controlled Fire

A fire in which the rate of fuel consumption is controlled by the rate of supply of fuel to the fire, rather than the availability of oxygen for combustion.

Functionality

The capacity of a system to perform the function required of it during and after a major accidental event.

Fundamental Burning Velocity

The burning velocity of a laminar (non-turbulent) flame under stated conditions of composition, temperature and pressure of the unburnt gas.

Fusible

The basis of protective devices with a component of valves or detectors causes the protective device to function when the component melts in the early stages of a fire hazard in that locale. Includes fusible links, plugs and loops.

Issue 1

May 2007

Page 428 of 493


Description

Gas explosion

Gas explosions can be defined as the combustion of a premixed gas cloud containing fuel and an oxidiser that can result in a rapid rise in pressure.

Gas oil ratio

The ratio of gas to oil within the hydrocarbon fluid, a high GOR indicates a high gas content which has implications for the potential for gas fires from a depressurisation and release.

Gauge points

Points defined in a CFD analysis where information on overpressure/dynamic pressure time histories is derived.

General platform alarm

A platform wide alarm indicating the onset of an emergency.

Harm criteria

Statements of adverse (environmental) conditions such as heat, degradation of air quality or introduced toxic substances which will start to cause harm (both short and long term) to the average individual. Often linked with vulnerability.

Hazard

A physical situation with a potential for human injury, damage to property, damage to the environment or some combination of these.

Hazard

The potential to cause harm, including ill health or injury; damage to property, plant, products or the environment; production losses or increased liabilities.

Hazard

A physical situation with a potential for human injury, damage to plant/equipment, damage to the environment or some combination of these.

Hazard analysis

The identification of undesired events that lead to the realisation of a hazard, the analysis of the mechanisms by which these undesired events could occur and usually the estimation of the extent, magnitude and likelihood of any harmful effects.

Hazardous substance

A substance which by virtue of its chemical properties constitutes a hazard.

HAZID

Hazard identification exercise, usually a brainstorm review of the potential hazards that may impact an installation.

Health, safety and environmental (HSE) management plan

A description of the means of achieving health, safety and environmental objectives.

Health, safety and environmental (HSE) management review

The formal review by senior management of the status and adequacy of the health, safety and environmental management system and its implementation, in relation to health, safety and environmental issues, policy, regulations and new objectives resulting from changing circumstances.

Issue 1

May 2007

Page 429 of 493


Description

Health, safety and environmental (HSE) policy

A public statement of the intentions and principles of action of the company regarding its health, safety and environmental effects, giving rise to its strategic and detailed objectives.

Health, safety and environmental (HSE) strategic objectives

The broad goals, arising from the HSE policy, that a company sets itself to achieve, and which should be quantified wherever practicable.

Health, safety and environmental management system (HSMES)

The company structure, responsibilities, practices, procedures, processes and management system (HSEMS) resources for implementing health, safety and environmental management.

Heat Flux (heat density)

The rate of heat transfer per unit area normal to the direction of heat flow. A convenient unit is kW m-2 s-1 (1 kW m-2 s-1 = 317 BTU ft-2 h-1). It is a total of heat transmitted by radiation, conduction and convection.

Heating Rate

The rate (normally measured in degrees C per minute) that a sample is heated.

High level performance standard

See element specific Performance Standard.

High (Higher) risk methodology

Methodology of assessment appropriate for High Risk installations or compartments as defined in this Guidance.

Homogeneous

In two-phase flow the vapour and liquid phases are assumed to be travelling at the same speeds and to be mixed uniformly throughout.

Human factors

The study and assessment of the impact of systems, equipment and hazards on human beings. Includes, ergonomic issues, human reliability and human error assessment. See also Man Machine Interface

Hydrocarbon

A hydrocarbon is a molecule comprised of carbon and hydrocarbon atoms.

Hydrocarbon Fire

A fire fuelled by hydrocarbon compounds, having a high flame temperature achieved almost instantaneously after ignition. A hydrocarbon fire will spread rapidly, burn fiercely and produce a high heat flux.

Hydrocarbon Fire Test

A furnace fire test using a time/ temperature curve which supposedly represents a hydrocarbon fire and which results in an ‘H’ rating for successful specimens.

Hyperthermia

Prolonged exposure to heated environments.

Impulse

The integral of a force or load over an interval of time.

Issue 1

May 2007

Page 430 of 493

FIRE AND EXPLOSION GUIDANCE Term Incident

Description An event or chain of events which has caused or could have caused injury, illness and/or damage (loss) to assets, the environment or third parties. (The word 'accident' is used by some writers and organisations to denote an incident which has caused injury; illness and/or damage, but the term also has connotations of 'bad luck' in common speech, and is therefore avoided by others. In this Guidance, only the term 'incident' has been used; in the above sense which embraces the concept of 'accident'.)

Incident heat flux

The total heat flux from within the flame on an exposed pipe, equipment, vessel or structure to heat transferred by all heat transfer mechanisms. For analyses within this guidance, these constitute mainly a combination of heat transferred by radiation and convection.

Incident Wave

The blast wave as it approaches a structure just before it impacts on its surface.

Individual Risk

The frequency at which an individual may be expected to sustain a given level of harm from the realization of specified hazards.

Individual Risk (IR)

The frequency at which an individual may be expected to sustain a given level of harm from the realization of specified hazards.

Inergen ©

A proprietary medium used to prevent continue escalation of fires by restricting the oxygen available, whilst maintaining adequate oxygen to sustain life.

Infrared

The non-visible red end of the visible spectrum of light.

Inhibitor

Substance which reduces explosion overpressures by chemically interfering with combustion.

Initiating events

The events which initiates an explosion event.

Intumescent

An epoxy coating, sealing compound or paint that swells up under thermal loading to produce a fire resisting covering.

Inventory

The quantity and type of fuel stored. A platform inventory lists the fuel types and total volumes stored on board an installation. The term inventory is also used to describe the quantity and type of fuel stored in vessels and pipe assemblies.

IR flame detectors

Flame detectors functioning in the infrared region of emitted light from a flame.

Jet Fire or Jet Flame

The combustion of material emerging with significant momentum from an orifice.

Issue 1

May 2007

Page 431 of 493


Description

Jetting Length

The length of a jet flow over which the effects of its initial momentum are dominant.

Laminar Flame

A smooth surfaced flame with low burning velocity.

Large Deflection Analysis

A type of non-linear structural analysis based on the final deflected shape of the structure rather than the initial, undisplaced shape.

Life Safety Risk

Risk to life.

Lift-off

That region of a jet flame where the jet discharge has not adequately mixed with air to combust.

Lift off distance

The distance from the discharge point (hole) to where flaming starts.

Liquid spray release

High pressure release of a liquid hydrocarbon which gives rise to a suspension of the fuel in the air similar to a gas cloud which is capable of deflagration on ignition.

Logit equation or model

See Probit equation or model

Loss Prevention

The general term used to describe a range of activities carried out to minimize any form of accidental loss, such as damage to people, property or the environment or purely financial loss due to plant outage.

Loss Prevention

A systematic approach to preventing accidents or minimizing their effects. The activities may be associated with financial loss or safety/environmental issues.

Lower flammability limit (LFL)

The lower level of gas concentration which will result in combustion of the gas. This is the same as Lower explosive limit (LEL).

Low level performance standard

See element specific Performance Standard.

Low risk installation/compartment

An installation or compartment identified as being low risk by the risk matrix and screening method described in this Guidance.

Major Hazard

An imprecise term for a large-scale chemical hazard, especially one that may be released through an acute event. A popular term for an installation that has on its premises a more than prescribed quantity of a dangerous substance.

Man machine interface

The interaction of human beings with equipment and control systems, covering issues of ergonomics but also information and alarm management.

Mass Burning Rate

The mass burning rate of a pool fire is the mass of fuel supplied to the flame per unit time, per unit area of the pool, typically in kg m-2 s-1.

Issue 1

May 2007

Page 432 of 493


Description

may

Verbal form used to indicate a course of action permissible within the limits of a standard.

Means of Calibration

Means of checking or benchmarking the performance of a decision option with respect to a given decision basis. For example what is thought to be 'good practice' or sound ‘engineering judgment’ can be checked by peer review and benchmarking of practices in other parts of the industry. Similarly, stakeholder consultation can be used to assess the values of the company or society at large.

Medium risk installation/compartment

An installation or compartment identified as being low risk by the risk matrix and screening method described in this Guidance.

Mitigation

Means taken to minimise the consequences of a major accident to personnel and the installation after the accident has occurred.

Monitoring activities

All inspection, test and monitoring work related to health, safety and environmental management.

Muster area

The area (notionally safe) where the crew congregate whilst awaiting instructions whether to return to the main areas of the installation (i.e. when safe) or whether to effect an evacuation.

Natural Period

The time required for a freely vibrating structure to complete one cycle of motion.

Natural Ventilation

The ventilation of an enclosure by natural means, either through the action of an external wind or gravitational forces.

Nominal explosion frequency

The frequency of occurrence of a release which is ignited and results in detectable overpressure (>50 mbars). This is used as the top point in the simplified generation of an exceedance curve - Prexp

Nominal explosion loads

Representative nominal overpressures and nominal dynamic pressures on equipment ranges, outliers and sensitivity measures.

Nominal overpressures

Nominal overpressures are defined as peak representative overpressures by installation/module type determined on a nonstatistical basis from acquired experience or simulation for a demonstrably similar situation.

Nominal Value

Value assigned to a basic variable determined on a non-statistical basis, typically from acquired experience or physical conditions.

Non-Linear Analysis

A type of structural analysis that allows the geometry and/or the material properties to be non-linear.

Offtake

The process by which tankers or other mechanisms unload the stored hydrocarbon from a floating production installation.

Overpressure

The excess pressure above ambient conditions.

Issue 1

May 2007

Page 433 of 493


Description

Overpressure

In a pressure pulse (blast wave), the pressure developed above atmospheric pressure at any stage or location is called the overpressure. Overpressure is also sometimes used to describe exposure of equipment to internal pressure in excess of its design pressure, but the term over-pressurisation is preferred.

Overpressure Loading

Loading imparted to a body as a result of overpressure acting normal to the surface of the structure.

Passive Fire Protection (PFP)

A coating, cladding or free-standing system that provides thermal protection in the event of fire and which requires no manual, mechanical or other means of initiation, replenishment or other intervention.

Passive Mitigation

Mitigation technique that is ‘non-triggered’ and generally utilized the kinetic energy of an explosion to disperse an extinguishing agent or suppressant.

Peak Overpressure

The maximum overpressure generated at a given location.

Penetration Seal

Purpose-made seals or seals formed in-situ to ensure that penetrations to firewalls do not impair fire resistance.

Performance criteria

Performance criteria describe the measurable standards set by company management to which an activity or system element is to perform. NOTE - Some companies may refer to performance criteria as 'goals' or 'targets'.

Performance standard

A statement which can be expressed in qualitative or quantitative terms of the performance required of a system, item of equipment, person or procedure and which is used as the basis for managing the hazard.

Performance standards for safety and emergency preparedness

Requirements to the performance of safety and emergency preparedness measures which ensure that safety objectives, authority minimum requirements and established norms are satisfied during design and operation. NOTE - The term 'performance' is to be interpreted in a wide sense and Include availability, reliability, capacity, mobilisation time, functionality, vulnerability, personnel competence, expressed as far as possible in a verifiable manner.

Phenomenological models

Simplified physical models, which seek to represent only the essential physics of explosions.

Plastic Deformation

That deformation which occurs following yield.

Plastic Hinge

A plastic hinge is a zone of yielding due to flexure in a structural member.

Issue 1

May 2007

Page 434 of 493


Description

Plastic Regime

That region of structural behaviour dominated by plastic response rather than elastic response. It is associated with plastic strain and large plastic deformations.

Plastic Strain

Strain beyond the elastic limit.

Pool Fire

The combustion of material evaporating from a layer of liquid at the base of the fire.

Potential loss of life (PLL)

The (fractional) number of individuals predicted to become fatalities over a specified period of time, usually one year.

Practice

Accepted methods or means of accomplishing stated tasks.

Preparedness analyses

The analysis has to be traceable and will normally, though not necessarily, be quantitative.

Pressure Burst

The rupture of a system under internal pressure, resulting in the formation of missiles which may have the potential to cause damage, and perhaps a blast wave.

Pressure difference

The pressure difference across an obstacle greater than 0.3 m in the direction of flow, calculated from the pressure time histories at the front and back of the obstacle. - Pdiff

Prevention

Means intended to prevent the initiation of a sequence of events which could lead to a hazardous outcome of significance (i.e. major accident). Such means include management systems applied to the design, engineering and construction standards, the operation of the installation, its inspection and maintenance.

Primary means of escape

The means of escape which was assumed during design.

Primary Structure

The structural components whose failure would seriously endanger the safety of a significant part of the installation.

Probability

A number in a scale from 0 to 1 which expresses the likelihood that one event will succeed another.

Probit equation or model

A probit model is a model in which the dependent variable yi can be only one or zero, and the continuous independent variable xi are estimated in Pr(yi=1)=F(xi'b). Where b is a parameter to be estimated and F is the normal cumulative distribution function. The logit model is the same but with a different cumulative distribution function for F.

Procedure

A documented series of steps to be carried out in a logical order for a defined operation or in a given situation.

Procedure

Established and documented step by step activity which allows a specific task to be completed.

Issue 1

May 2007

Page 435 of 493


Description

Proof Stress

The stress at which the plastic strain of a material reaches a particular value, for example 0.2 %. Proof stress, is a valuable concept in materials which do not exhibit a sharp yield point.

Quantified risk analysis

The quantitative evaluation of the likelihood of undesired events and the likelihood of harm or damage being caused, together with the value judgements made concerning the significance of the results. May also be referred to as quantitative risk analysis or with assessment used interchangeably with analysis.

Quality Assurance

All systematic actions that are necessary to ensure that quality is planned, obtained and maintained.

Quality Control

That part of the Quality Assurance which, through measurements, tests or inspections, ascertains whether a product, service or activity is in accordance with specified requirements.

Quality

A product, service or activity's ability to fulfil specified requirements.

Radiation

Thermal radiation involves the transfer of heat by electromagnetic waves confined to a relatively narrow region of the electromagnetic spectrum.

Radiative heat flux

The measured or calculated heat flux crossing a boundary or surface due to radiation heat transfer only.

Redundancy

The performance of the same function by a number of equivalent means, possibly independent and possibly identical.

Redundancy analysis

The structural analysis indicating which members can be removed without the collapse of the structure.

Release

The type and quantity of fuel which can possibly be ignited.

Reliability

The probability that an item is able to perform a required function under stated conditions for a stated period of time.

Reliability

The probability that an item is able to perform a required function under stated conditions for a stated period of time or for a stated demand.

Representative peak overpressure

Time averaged over 1.5 ms and space averaged over explosion affected area, Prep.

Required endurance time

The estimated time for people to travel from their work stations to the TR, then to the primary or secondary means of escape, allowing for the possibility of helping injured colleagues.

Residual events

Initiating events which cannot be eliminated by design or operating procedures.

Issue 1

May 2007

Page 436 of 493


Description

Rise Time

The time taken for the overpressure to increase from zero to the peak overpressure.

Risk

The product of the chance that a specified undesired event will occur and the severity of the consequences of the event.

Risk

The likelihood of a specified undesired event occurring within a specified period or in specified circumstances. It may be either a frequency (the number of specified events occurring in unit time) or a probability (the probability of a specified event following a prior event), depending on the circumstances.

Risk

Combination of the probability of occurrence of harm and the severity of that harm. NOTE - Risk may be expressed qualitatively as well as quantitatively. Probability may be expressed as a probability value (between 0 and 1 and dimensionless) or as a frequency, with the inverse of time as dimension. The definition implies that risk aversion (i.e. an evaluation of risk which places more importance on certain accidental consequences than on others, where risk acceptance is concerned) should not be included in the quantitative expression of risk. It may be relevant to consider on a qualitative basis certain aspects of risk aversion in relation to assessment of risk and its tolerability. The implication of the definition is further that perceived risk (i.e. subjectively evaluated risk performed by individuals) should not be included in the expression of risk.

Risk acceptance criteria (RAC)

Criteria that are used to express a risk level that is considered tolerable for the activity in question. NOTE - RAC are used in relation to risk analysis and express the level of risk which will be tolerable for the 9 activity, and is the starting point for further risk reduction according to the ALARP-principle. Risk acceptance criteria may be qualitative or quantitative.

Risk analysis

The quantified calculation of probabilities and risks without making any judgements about their relevance.

Risk analysis

Use of available information to identify hazards and to estimate the risk. NOTE 1 - The risk analysis term covers several types of analyses that will all assess causes for and consequences of AEs, with respect to risk to personnel, environment and assets. Examples of the simpler analyses are SJA, FMEA, preliminary hazard analysis, HAZOP, etc. NOTE 2 - Quantitative analysis may be the most relevant in many cases, involving a quantification of the probability and the consequences of AEs, in a manner which allows comparison with quantitative RAC.

Issue 1

May 2007

Page 437 of 493


Description

Risk assessment

The quantitative evaluation of the likelihood of undesired events and the likelihood of harm or damage being caused together with the value judgments made concerning the significance of the results.

Risk assessment

Overall process of risk analysis and risk evaluation.

Risk Evaluation

The evaluation of the likelihood of undesired events and the likelihood of harm or damage being caused, together with the value judgements made concerning the significance of the results and their tolerability, including issues of risk perception where appropriate.

Risk Issues

Issues that impact on the nature and perception of safety related risks and the role of risk based analysis techniques.

Robustness

Insensitivity of response to variations of load.

Safety critical element (SCE)

Any structure, plant, equipment, system (including computer software) or component part whose failure could cause or contribute substantially to a major accident is safety-critical, as is any which is intended to prevent or limit the effect of a major accident.

Safety objective

Objective for the safety of personnel, environment and assets towards which the management of the activity will be aimed.

Safety Plan

All documented policies, standards and practices which the Operator shall initiate to ensure the activity is planned, organized, executed and maintained to achieve safety and protect the environment in accordance with the acts or regulations.

Safety-critical elements (SCEs)

As for SCE, those elements of the installation which are critical to safety.

Sauter mean diameter

Defined as the diameter of a drop having the same volume/surface area ratio as the entire spray.

Screening criteria

The values or standards against which the significance of the identified hazard or effect can be judged. They should be based on sound scientific and technical information and may be developed by the company and industry bodies, or provided by the regulators.

Secondary means of escape

Means of escape which should be available if the primary means of escape is not available.

Section Factor

The ratio of heated perimeter (Hp) to cross-sectional area (A).

Serviceability Limit

A design limit beyond which the structure may become unserviceable, for example, a specified maximum deflection.

Shall

Verbal form used to indicate requirements strictly to be followed in order to conform to the standard and from which no deviation is permitted, unless accepted by all involved parties.

Issue 1

May 2007

Page 438 of 493


Description

Shock Load

The load imparted to a structure by a passing shock wave.

Shock Wave

A pressure pulse formed by an explosion in which a sharp discontinuity in pressure travels as a wave through a gas at a supersonic velocity.

Should

Verbal form used to indicate that among several possibilities one is recommended as particularly suitable, J without mentioning or excluding others, or that a certain course of action is preferred but not necessarily required.

Shuttle tankers

The tankers undertaking the offloading of the stored oil from a floating installation.

Significant Overpressure

An overpressure > 50 mbars, this is the pressure at which pressure relief panels should operate.

Single-Phase Flow

A flow consisting of either a liquid or gas.

Skin Friction

The frictional force caused by the passing fluid flow which acts tangentially to the surface of the body.

Skyscape ©

A proprietary evacuation mechanism based on folding Kevlar screens, not permanently deployed but unfolded when required.

Societal Risk

The relationship between frequency and the number of people suffering from a specified level of ham1 in a given population from the realization of specified hazards.

Smoothed overpressure

Overpressure trace which has been smoothed by using a moving average over a period of 1.5 milliseconds (1 millisecond or ms equals one thousandth of a second).

Source terms

The characteristics (prior to ignition) of a fluid which affect its combustion, i.e. the composition, pressure, temperature.

Space averaged overpressure

A peak overpressure for a compartment/area or installation which is the average of all measured or simulated peak overpressures within a compartment. It is assumed in the case for measured overpressures that they have been smoothed.

Specific Heat

The amount of heat, measured in Joules, required to raise one kilogram of a substance by one degree C, units are J kg-1 ºC-1.

Stagnation Overpressure

The excess pressure above that in the approach flow which occurs on the front face of a surface where the gas velocity is brought to rest.

Standard Fire Test

A furnace fire test using a time temperature curve which simulates a standard fire and which results in an ‘A’ or ‘H’ rating for successful specimens.

Steady State

Conditions which do not change with time.

Issue 1

May 2007

Page 439 of 493


Description

Stoichiometric mix (mixture)

Air/fuel mixture is such that it contains exactly the required amount of oxygen to completely consume the fuel.

Strain Hardening (work hardening)

The tendency of an elastic-plastic material to exhibit increased resistance to high strains.


An explosion response assessment where the SCEs including structure and supports are required to remain elastic. An elastic method is used for structural response with code/utilization checks as the performance standard.

Strength level blast (SLB)

Representative peak overpressure used to test robustness of equipment and structure. Elastic structural analysis is appropriate.

Suppressant

Substance which reduces explosion overpressures by removing heat from the flame, chemically interfering with combustion or diluting the flammable mixture.

Surface emissive power

The heat flux emitted from the surface of the flame by thermal radiation.

Survivability

The ability of a system to function in the conditions of an accidental event for the time required.

System audit

Planned and systematic examination of systems to ensure that these have been established, followed and maintained as specified.

Temporary refuge

The place of “greater safety” on an offshore installation, required in UK law as a place for crew members to congregate prior to evacuation or to withstand the major accident.

Tenability (limits and/or analysis)

An analysis of 3 components of fire and smoke exposure; 1) the source of the combustion products, 2) the transport of the products; and 3) the effect of the exposure.

Thermal Analysis

A calculation in which the results are temperature distributions for a given heat input. The heating may be described in terms of either temperatures or radiation levels.

Thermal Capacity

The ability of a material to store heat.

Thermal Conduction

Heat transfer through a medium via random molecular motion.

Threshold overpressure

Peak overpressure below which explosion assessment need not be performed.

Time Domain

A solution technique for structural dynamics in which results are obtained at regular time intervals when a time variable force or other load is applied.

Issue 1

May 2007

Page 440 of 493


Description

Transmissivity

The fraction of the radiated heat that transmits through a medium (usually the atmosphere).

Turbulence

Rapid irregular local fluctuations in physical variables, such as velocity or concentration, that arise due to the presence of eddies within the flow.

Turbulent Burning Velocity

The burning velocity of the flame when turbulence is present in the flammable mixture.

Turbulent Flame

A flame burning in a turbulent flammable mixture.

Two-Phase Flow

A flow in which both the liquid and vapour phases co-exist within close proximity.

Ultimate overpressure

Peak representative overpressure resulting from a CFD simulation where it is assumed that the area is engulfed in a stoichiometric gas cloud and ignited at the worst position and time. – Pult.

Ultimate tensile stress

The ultimate tensile stress of a material is the limit stress at which the material actually breaks, with sudden release of the stored elastic energy (released as noise and/or heat and/or more cracks e.g. for brittle materials).

Ultra-violet

The non-visible violet end of the visible spectrum of light.

Unconfined Vapour Cloud Explosion

Defined as for VCE and is an imprecise term (see Vapour Cloud Explosion (VCE) below).

Unity Checks

A summation of non-dimensional terms in an equation in structural design, each of which relate to a component of loading or structural response. A summation greater than unity indicates failure of the member.

Upper flammability limit (UFL)

The fuel concentration above which combustion will not occur. Same as upper explosive limit (UEL).

UV flame detectors

Flame detectors functioning in the ultra-violet region of emitted light from a flame.

Vapour Cloud Explosion (VCE)

The preferred term for an explosion of a cloud made up of a mixture of a flammable vapour or gas with air in open or semi-confined conditions.

Vent

An opening through which gas escapes from a confining enclosure as a result of the expansion caused by combustion.

Ventilation

The process by which an enclosure is supplied with fresh air. Ventilation rates are often given for an enclosure in units of air volume changes per hour.

Issue 1

May 2007

Page 441 of 493


Description

Ventilation Controlled Fire

A fire in which the combustion rate is controlled by the availability of oxygen rather than the supply of fuel.

Venting

The escape of gas through openings (vents) in the confining enclosure.

Verification:

Examination to confirm that an activity, product or service is in accordance with specified requirements.

View Factor

The proportion of the field of view of a receiving surface that is filled by a flame.

Volume blockage ratio

The ratio of the volume occupied by the obstacles to the total volume.

Volume Production

The overall rate of increase in volume caused by the combustion process.

Wake Region

The region on the downstream side of the structure.

Water Deluge System

A network of small bore pipe work nozzles connected to the firewater main which is capable of delivering the design water spray to the protected area.

Water Screen

A series of wide angle and/or mist spray nozzles connected to the firewater main that protect a specific area in the module from the passage of heat, smoke and billowing flames.

Wellbay

The area of the topsides structure which accommodates the wellheads.

Worst case (explosion) scenario

CFD or phenomenological simulation where it is assumed that the explosion area or compartment is filled with a stoichiometric gas cloud ignited at the worst position and time.

Written scheme of examination (or verification)

The detailed, formally submitted and monitored scheme of verification required in the UK.

Yield Point

The stress at which a steel sample departs from linear elastic behaviour to plastic deformation in a standard tensile test.

Yield, Dynamic

The apparent yield stress exhibited by metals such as steel when they are strained at a rate which is significantly faster than the normal testing rate.

Yield, Effective

For materials which exhibit no clear yield point, such as mild steels at elevated temperatures, the stress corresponding to a particular plastic strain, often 0.2 % (see also Proof Stress).

Issue 1

May 2007

Page 442 of 493


Annex C Acronyms

Acronym

Description

ABS

American Bureau of Shipping

ach

Air Changes per Hour

AE

Accidental event

AFFF

Aqueous film forming foam

AIR

Average individual risk

ALARP

As low as reasonably practicable

ALS

Accidental collapse limit state

API

American Petroleum Institute

APOSC

Assessment Principles for Offshore Safety Cases

ASFP

Association for Specialist Fire Protection

ATEX

Potentially Explosive Atmospheres (EU Directive)

BDV

Blowdown valve

BLEVE

Boiling Liquid Expanding Vapour Explosion

BOP

Blowout preventor

BRE

Building Research Establishment

BS

British Standards

BSI

British Standards Institution

CAD

Computer Aided Design

CAM

Congestion Assessment Method

CAP

Civil Aviation Publication

CBA

Cost benefit analysis

CCPS

Center for Chemical Process Safety

CCTV

Closed Circuit Television

CEC

Commission of the European Community

CEN

Comité Européen de Normalisation

CFD

Computational fluid dynamics

CIA

Chemical Industries Association

CMC

Conditional Moment Closure

COLREG

Collision Regulations

CoP

Code of Practice

Issue 1

May 2007

Page 443 of 493

FIRE AND EXPLOSION GUIDANCE Acronym

Description

CRA

Concept risk analysis

DAE

Dimensioning accidental event

DAF

Dynamic Amplification Factor

DAL

Design accidental load

DCR

Design and Construction Regulations

DES

Detached-Eddy Simulation

DLB

Ductility level blast

DNV

Det Norske Veritas

DP

Dynamic positioning

DTM

Discrete Transfer Model

DSHA

Defined situations of hazard and accident

E&P

Exploration and production

EBU

Eddy Break-Up

EC

European Commission

ECCS

European Convention for Constructional Steelwork

EDPV

Emergency Depressurisation Valve

EER

Escape, evacuation and rescue

EN ISO

Euro Norm International Standards Organisation

ENV

European Standard (Eurocode)

EOA

Emergency Overnight Accommodation

EPA

Emergency preparedness analysis

EPCI

Engineering, procurement, construction and installation

EPDV

Emergency de-pressurisation valve

ER

Emergency Response

ERA

Early Risk Analysis

ESD

Emergency shutdown

ESD2

Emergency Shut Down (level 2), i.e. one step down from highest level (level 1)

ESDV

Emergency Shutdown Valve

F&G

Fire and gas

FABIG

Fire And Blast Information Group

FAR

Fatal accident rate

FE

Finite Element

FEA

Fire and Explosion Analysis

FEED

Front End Engineering Design

FEHM

Fire and Explosion Hazard Management

FEHMG

Fire and Explosion Hazard Management Guide

FERA

Fire and Explosion Risk Analysis

Issue 1

May 2007

Page 444 of 493


Description

FES

Fire Explosion Strategy

FHA

Fire Hazard Analysis

FLACS

FLame ACceleration Simulator

FOC

Fire Offices’ Committee

FMEA

Failure mode and effects analysis

F(P)SO

Floating Production, Storage and Offloading

FRA

Fire Risk Analysis

FRED

Fire, Release, Explosion and Dispersion scenarios (Shell Global Solutions software)

FSI

Fluid-Structure Interaction

FSO

Floating Storage and Offloading

FSU

Floating Storage Unit

GASCET

Guidance for the topic assessment of major accident aspects of safety cases

GBS

Gravity base structure

GOR

Gas Oil Ratio

GPA

General Platform Alarm

GRP

Glass Reinforced Plastic

HAZID

Hazard Identification Study

HAZOP

Hazard and operability study

HC

Hydrocarbons

HCLIP

Hydrocarbon leak and ignition project

HEM

Homogeneous Equilibrium Model

HES

Health, environment and safety

HIPPS

High integrity pressure protection system

HMS

Hazard Management System

HMSO

Her Majesty's Stationery Office

HRA

Health risk assessment

HS&E

Health Safety & Environmental

HSAWA

Health And Safety At Work Act (UK law)

HSE

Health and Safety Executive or Health, Safety and Environment

HSEMS

Health, safety and environmental management

HSG

Health & Safety Guidance series

HSL

Health and Safety Laboratory

HSSD

High Sensitivity Smoke Detection

HTA

Hierarchical Task Analysis

HVAC

Heating Ventilation & Air Conditioning

ICAF

Implied Cost of Averting a Fatality

Issue 1

May 2007

Page 445 of 493


Description

ICAO

International Civil Aviation Organisation

IEC

International Electro-technical Commission

IGN

Interim Guidance Notes

IMO

International Maritime Organisation

IP

Institute of Petroleum

IR

Individual risk or Infra-red

IRPA

Individual risk per annum

ISGOTT

International Safety Guide for Oil Tankers and Terminals

ISO

International Standards Organisation

ISO/CD

International Standards Organisation/ Consultative Draft

IVB

Independent Verification Body

JIP

Joint Industry Project

JIVE

Jet Fire Interactions with Vessels

LCC

Life cycle cost

LEL

Lower explosive limit

LES

Large-Eddy Simulation

LFL

Lower Flammability Limit

LIER

Local Instrument and Electrical Room

LL

Loading Lines

LNG

Liquefied Natural Gas

LPG

Liquid Petroleum Gas

LPGA

Liquid Petroleum Gas Association

MARPOL

International Convention for the Prevention of Pollution from Ships, 1973, as modified by the Protocol of 1978 relating thereto

MCC

Motor Control Centre

MDOF

Multiple degree of freedom

MEG

Mono-Ethylene Glycol

MHSW

Management of Health and Safety at Work (UK regulation)

MMI

Man-Machine Interface

MODU

Mobile Offshore Drilling Unit

MOU

Mobile Offshore Unit

MSF

Modular Support Frame

MV

Medium Velocity (as applied to deluge nozzles)

NCS

Norwegian Continental Shelf

NDT

Non-Destructive Testing

NFPA

National Fire Protection Association (USA)

NLFEM

Non-linear finite element method

NLFEA

Non-linear finite element analysis

Issue 1

May 2007

Page 446 of 493


Description

NNS

Northern North Sea

NORSOK

Norwegian Petroleum Industry Standards

NPD

Norwegian Petroleum Directorate

NPV

Net present value

NRV

Non-Return Valve

NTS

Norwegian Technology Centre

NUI

Normally Unattended Installation

OCIMF

Oil Companies International Marine Forum

OGP

Oil and Gas Producers (formerly E&P Forum)

OIM

Offshore Installation Manager

OIR

Offshore Incident Report (UK regulatory requirement)

OLF

The Norwegian Oil Industry Association

OPEX

OPerational EXpenditure

OREDA

Offshore REliability DAta

OSD

Offshore Safety Division (of HSE)

OTI

Offshore Technology Information series

OTO

Offshore Technology Report

P&ID

Piping & Instrument Diagram

PA / GA

Public Address / General Alarm

PDF

Probability Density Function

PDO

Plan for development and operation

PDUQ

Process, Drilling, Utilities, Quarters (similarly PUQ)

PFD

Process flow diagram

PFEER

Prevention of fire and explosion and emergency response

PFEER

Prevention of Fire and Explosion, and Emergency Response

PFP

Passive Fire Proofing

PHAST

Process Hazard Analysis Software Tool)

PLL

Potential loss of life

PM

Permanent Manual (of the Hazardous Installations Directorate of the UK HSE)

PMP

Protected Muster Point

POB

Persons on Board -----or Personnel?

ppm

parts per million

PS

Performance Standard(s)

PSV

Pressure Safety Valve

PUQ

Production, Utilities and Quarters

QRA

Quantitative risk analysis

R&D

Research and Development

Issue 1

May 2007

Page 447 of 493


Description

RAC

Risk acceptance criteria

RBI

Risk based Inspection

RCM

Reliability centred maintenance

RP

Recommended Practice

RQT

Roller Quenched and Tempered steel

RRM

Risk reduction measure

RV

Relief valve

S/D

Shut Down

SAR

Search and rescue

SBSD

Scenario based system design

SBV

Stand-by vessel

SCE

Safety Critical Element

SCI

Steel Construction Institute

SCR

Safety Case Regulations

SDOF

Single degree of freedom

Semi-sub

Semi-submersible

SEP

Surface Emissive Power

SFPE

Society of Fire Protection Engineers

SIL

Safety integrity level

SIMOPs

SImultaneous OPerations

SINTEF

The Foundation for Scientific and Industrial Research at the Norwegian Institute of Technology

SJA

Safe job analysis

SLB

Strength level blast

SMS

Safety Management System

SNS

Southern North Sea

SOLAS

International Convention for the Safety of Life at Sea

SSIV

Sub-Surface Isolation Valve

STCW

International Convention on Standards of Training, Certification and Watch-keeping for Seafarers, 1978

TBL

Federation of Norwegian Manufacturing Industries

TEMPSC

Totally Enclosed Motor Propelled Survival Craft

TMCR

Thermo-Mechanically Controlled Rolled steel

TR

Temporary Refuge

TRA

Total risk analysis

TREPA

Total risk and emergency preparedness analysis

TRIF

Temporary Refuge Impairment Frequency

TTA

Tabular Task Analysis

Issue 1

May 2007

Page 448 of 493


Description

UK

United Kingdom

UKCS

United Kingdom Continental Shelf

UKOOA

UK Offshore Operator’s Association

UPS

Un-interruptible Power Supply

UR

Utilisation Ratio

UTS

Ultimate Tensile Strength

UV

Ultra-Violet

VCE

Vapour Cloud Explosion

VESDA

Very Early Smoke Detection

VOC

Volatile Organic Chemicals

WOAD

WOrldwide Accident Database

WSE

Written Scheme of Examination

WSV

Written Scheme of Verification

Issue 1

May 2007

Page 449 of 493


Annex D Human factors – man/machine interface

D1 - Introduction This section describes the ways in which operators and maintenance personnel implement and maintain the systems and practices put in place to manage fire hazards. The following areas will be reviewed:

•

Ergonomics;

•

Working conditions;

•

Working environment;

•

Information presentation and availability;

•

Organizational factors including culture.

The designers of fire hazard management systems should optimise the allocation of system tasks and functions between humans and technology. However, taking tasks away from personnel is not always the best solution as a number of considerations are involved, for example:

•

The potential consequences of human failure;

•

The flexibility that the human can bring to the situation;

•

The long-term well-being of the human, the feeling of “being of value and needed”;

•

Interest levels and boredom thresholds (leading to enthusiastic engagement to the task or potentially dangerous disengagement);

•

Design to minimise fatigue;

•

Clarity and consistency of instrumentation;

•

Layout of man/machine interface; and

•

Clarity of emergency procedures.

In all areas where the performance of safety critical elements is at stake, operational tasks must be set within the limits of human operators. Physical stress levels must be acceptable, for example for turning, lifting, reaching etc. The presentation of information and the issuing of instructions must be prioritised and unambiguous. Personnel response must be planned in the context of the hazard.

D2 – Overview of assessment techniques Several types of analyses may be used to identify and analyse scenarios leading to or arising from fires. The first two describe means of identifying tasks, allocating them logically and then defining potential errors that may result from erroneous actions. The latter two assessment techniques are from normal risk analysis approaches and may be expanded to include human error and response. Issue 1

May 2007

Page 450 of 493

FIRE AND EXPLOSION GUIDANCE D2.1 - Commonly applied techniques include; 1. Task analysis, 2. Human error analysis, 3. Fault tree analysis, 4. Event tree analysis. The two specific Human Factors analysis techniques (items 1. and 2.) are discussed in more detail below.

D2.2 - Task analyses Task analyses identify error modes, criticality and potential improvements by:

•

Adding details to the scenario description;

•

Specifying the context in which important actions (task steps) take place;

•

Identifying aspects in relation to information, control and co-ordination which contribute to performance shortfalls.

Task analyses are the premier technique to confirm that operational and maintenance tasks on fire hazard management tools and systems were achievable. Task analyses confirm that the implementation of the emergency response plans can happen within the time scale of an escalating incident and identifies preferred steps to be taken to intervene to control escalation. Hierarchical Task Analysis (HTA) and Tabular Task Analysis (TTA) are the two variants of task analysis techniques that may be applied. Hierarchical Task Analysis describes the relevant task or operation from its overall objective down to individual operations. Tabular Task Analysis identifies the context in which important task steps take place and the aspects which may be improved. The TTA format concentrates on:

•

Cues; which indicate to the operator that a task step can/should be initiated;

•

Feedback; which indicates the effects of carrying out a task step;

•

Traces; which indicate to the operator that the task step has actually been performed and finalized successfully.

D2.3 - Human error analyses Human Error Analysis provides a framework for understanding human errors, their causes and consequences. Human error analysis is often referred to as the slips, lapses, mistakes and violations model. The Action Error Mode Analysis technique resembles the Human HAZOP and identifies human errors for each task to be analysed. For each task step, possible erroneous actions are identified using guide words such as ‘omitted’, ‘too early’, ‘too late’, etc. Possible abnormal system states are identified, in order to consider the consequences of carrying out the task step (correctly or incorrectly) during abnormal system states (e.g. specific hardware failures). The consequences of erroneous actions, combinations of erroneous actions, abnormal system states and possibilities for recovery are identified and described in order to support criticality ratings. Issue 1

May 2007

Page 451 of 493

FIRE AND EXPLOSION GUIDANCE Human error models provide an understanding of the pressures on the maintenance team to “get the job done” and assist the operating and emergency response teams in understanding their role during a fire hazard emergency.

D3 - Awareness and competence Key personnel at different levels of the organisation must understand and fulfil their respective contributions to the fire safety of the installation. There will be many roles in design and operation but the following personnel have essential requirements concerning fire hazards: Project managers need to understand:

•

The iterative nature of the fire-safety design process;

•

The need to build contingency into time and cost estimates for reiterations;

•

The importance of documenting the decision process for ALARP demonstration.

Safety engineers need to understand:

•

That their role is to keep the discipline engineers fully involved in the fire hazard management process;

•

The importance of passing their knowledge of the key safety issues to offshore personnel.

All discipline engineers need to be aware of:

•

Basic fire / smoke & explosion science;

•

The “inherent safety / prevent / detect / control / mitigate /respond protection hierarchy.

OIMs need to understand:

•

The fire scenarios, escalation mechanisms, escalation times and the role of protective systems (including their failure to work);

•

That Emergency response drills/exercises should be based on the platform specific fire scenarios;

•

Team response to fire of both trained and untrained (visitors) personnel.

Senior management need to know:

•

Their legal obligations and how to discharge these duties;

•

The wisdom of early consideration of, and investment in, fire issues;

•

What to budget for platform specific fire response training of OIMs and supervisors transferring from one platform to another. (Very few platforms are alike, this is especially important for older installations, which may have a lower level of fire-safety provision than new ones).

Issue 1

May 2007

Page 452 of 493


Annex E Legislation, standards, guidance and other initiatives

E1 - Legislation in the UK E1.1 - Legislation background This section details major legislation covering explosion risk. It is not exhaustive as any legislation covering general safety or requiring a safety risk assessment to be performed, will be relevant where the potential for a fire event exists. Legislation may be added during the lifetime of this guidance. The primary legislation governing safety in the workplace is the ‘Health and Safety at Work Etc. Act 1974 (HASWA)’, [E.1]. This imposes a responsibility on the employer to ensure the safety at work for all employees. Employers have to take reasonable steps to ensure the health, safety and welfare of their employees. Various regulations are enacted under the HASWA. These include the ‘Management of Health and Safety at Work Regulations 1999’, MHSW [E.2] which place an obligation on the employer to actively carry out a risk assessment of the workplace and act accordingly. Risks assessed will include those from fire and explosion.

E1.2 – Offshore legislation More specifically related to fire and explosion risk are the Prevention of Fire and Explosion and Emergency Response on offshore installations (PFEER) [E.3] Regulations which place on the Duty Holder the requirement to take appropriate measures to protect persons from major hazards including fires and explosions. Regulations 9 to 12 of PFEER specify the types of measures which are required for prevention, detection, communication and control of emergencies. The regulations also require mitigating measures to be specified and put in place and for performance standards to be set for safety critical measures to prevent, control and mitigate explosion hazards. The Duty Holder must ensure that effective evacuation, escape recovery and rescue will occur in the case of an explosion event (see Regulations 14 to 17 of PFEER). The Safety Case Regulations SCR [E.4] require that all installations in UK waters have an acceptable Safety Case. Information regarding the following issues is required to be addressed in the Safety Case:Identification of major hazards;

•

evaluation of risks associated with the identified hazards;

•

details of appropriate measures taken to reduce these risks to as low a level as is reasonably practicable;

Issue 1

May 2007

Page 453 of 493


details of the Duty Holder’s (Safety) Management Systems.

The Design and Construction Regulations DCR [E.5] amend the SCR by placing a responsibility on duty holders to prepare a suitable verification scheme for their installations to ensure independent and competent evaluation of those elements of the installation which are critical to safety (known as safety-critical elements - SCEs). Performance standards are used to define the functionality and integrity of these safety critical elements. They define how these SCEs are expected to function during and after explosion events.

E2 – Documents/guidance issued by the HSE E2.1 - Assessment principles for offshore safety cases The ‘Assessment principles for offshore safety cases’ document (APOSC) [E.6] provides guidance for duty holders on how the regulator intends to enforce the SCR and its supporting regulations, PFEER [E.3], SI 1995/743, Management and Administration Regulations MAR1995 [E.7] and the DCR 1996 [E.5]. The APOSC document requires the following be demonstrated for Major Accident Hazard assessments: Acceptable safety cases will demonstrate that a structured approach has been taken which:

•

identifies all major accident hazards (APOSC paragraphs 38-48);

•

evaluates the risks from the identified major accident hazards (APOSC paragraphs 4974);

•

describes how any quantified risk assessment (QRA) has been used and how uncertainties have been taken into account (APOSC paragraphs 75-82);

•

identifies and describes the implementation of the risk reduction measures (APSOC paragraphs 83-89);

•

describes how major accident risks are managed (APOSC paragraphs 90-112);

•

describes the evacuation, escape and rescue arrangements (APOSC paragraphs 113144).

The structured approach listed above is generic, so that there are no specific requirements for how an assessment of fire hazards should be carried out.

E2.2 – Fire and explosion strategy The HSE have recently compiled and published issue 1 of a Fire and Explosion Strategy [E.8] to illustrate their approach. The overall objective of the document is to identify the areas which OSD has identified as requiring possible future work to address significant areas of uncertainty in fire and explosion issues on offshore installations. The document covers a number of areas of relevance to this guidance, the topics covered briefly in the strategy document are:

•

Fluid characteristics (often referred to as “Source Terms”);

•

Ignition;

•

Fire and gas detection;

•

Dispersion and ventilation;

•

Fire and explosion hazard assessment;

•

Fire and explosion consequence assessment;

Issue 1

May 2007

Page 454 of 493


Prevention, control and mitigation of fires and explosion.

The more detailed scope covered by the strategy document is as follows:

•

Provide an introduction to each topic area, e.g. describing the scope of the review, the nature of the hazard etc (as appropriate to the topic area);

•

Describe the significance of the topic with regard to the risk of major accidents on offshore installations;

•

Summarise current knowledge of the topic (i.e. reference to completed and on-going research, standards, codes of practice, design guidance etc);

•

Summarise existing modelling capabilities (as appropriate to the topic area);

•

Based on the results of the knowledge summary and the model capabilities above, identify areas of uncertainty;

•

Summarise current industry practice (i.e. reference to approaches taken in Safety Cases, extent of implementation of existing codes, guidance etc, awareness of issues);

•

Summarise areas identified to potentially be carried forward as part of Offshore Safety Division 3’s strategy development.

The strategy document emphasises that individual topics are subject to continuous change and their priority is not addressed in the strategy document.

•

The document presents an overview of the current state of knowledge with respect to fires and explosions. As would be expected, it is focussed around the hazard rather giving any specific guidance on designing against it. It highlights that there is still much uncertainty in certain topic areas and suggests further work in a number of areas.

E2.3 – Other internal HSE guidance HSE has published a number of documents offering explanation or guidance in fire and explosion areas for their own inspectors. These documents lay out the principles and methodologies which HSE expect to be followed by Duty Holders in their design process in compliance legislation and demonstrated in the Safety Case. These documents also assist offshore oil and gas industry engineers, who can use these documents to ensure that their designs meet the expectations of the regulatory authority.

•

Fire, Explosion and Risk Assessment Topic guidance [E.9] - The aim of the guidance is to promote greater consistency and effectiveness in the assessment of safety cases and greater transparency for duty holders. It gives guidance to HSE specialist inspectors assessing those sections of the safety case addressing fire and explosion issues. It serves as a useful checklist for all persons involved in analysis, design or assessment of fires or explosions and associated protection methods, to ensure fire and explosion issues are covered in line with HSE’s expectations.

•

Guidance for the Topic Assessment of the Major Accident Hazard Aspect of Safety Cases (GASCET) [E.10] – This document is intended primarily to assist topic assessors in undertaking Safety Case assessment activities. It addresses the fire and explosion hazard as well as other hazard topics and contains useful references to codes and standard that HSE expect to see Operators using in their design processes.

Issue 1

May 2007

Page 455 of 493

FIRE AND EXPLOSION GUIDANCE E3 - Codes, standards and guidance E3.1 - Introduction There are additional codes, standards and guidance are available, covering elements related to the hazard, namely: For general fire and explosion hazard management; Alongside UK legislation, EN ISO 13702 [E.11] also addresses the need to develop a fire and explosion strategy (FES) which describes the role, essential elements and performance standards for each of the systems required to manage possible hazardous events on the installation. For ignition prevention and Hazardous Area Classification;

•

Institute of Petroleum, ‘Area Classification Code for installations handling flammable fluids’, August 2002, (IP15) [E.12].

•

The ATEX (Atmospheric Explosion) Directives 94/9/EC [E.13] and 1999/92/EC [E.14] cover electrical and mechanical equipment and protective systems, which may be used in potentially explosive (and ignitable) atmospheres.

•

BS EN 60079-10. ‘Electrical apparatus for explosive gas atmospheres Part 10. Classification of hazardous areas’, [E.15].

•

For equipment in hazardous areas ‘BS EN 1127-1: 1998 Explosive atmospheres. Explosion prevention and protection’ [E.16] is available.

•

BS 5958: 1991 ‘Code of practice for control of undesirable static electricity’, [E.17].

These documents only cover operational leaks rather than accidental releases. They do not define the extent of hazardous areas from the point of view of explosion and fire risk. Guidance on the demonstration of ALARP is available throughout this Guidance and from the following sources;

•

Policy and guidance on reducing risks http://www.hse.gov.uk/risk/theory/alarp3.htm

to

ALARP

in

design

[E.18],

Principles and Guidelines to Assist HSE in its Judgement that Duty Holders Have Reduced Risk as Low as Reasonably Practicable [E.19]. http://www.hse.gov.uk/risk/theory/alarp1.htm HSE Books have published a guide which sets out an overall framework for decision taking by the HSE (Reducing risks, protecting people) [E.20].

E3.2 - Recent developments In this section, two documents which are currently under development are discussed, compared and contrasted. These are:1. ISO development of a standard dealing with accidental actions as part of ISO CD/19901-3 [E.21]. 2. API Recommended Practice (API RPFB) [E.22] for the Design of Offshore Facilities against Fire and Blast Loading. Issue 1

May 2007

Page 456 of 493

FIRE AND EXPLOSION GUIDANCE Whilst the status, scope and applicability of these documents vary, it is still possible to compare the technical content and approaches in a meaningful way. There is now widespread recognition that a multidisciplinary approach to design and assessment is required, involving structural, mechanical, process, control and instrumentation and other engineering disciplines. In the case of fire hazard analysis, probabilistic methods appear to be of lesser importance than for explosions, as the extreme events are not so disproportionately severe and can largely be prevented or designed against. In Fire assessment, nominal fire loads and modified code check methods have been in widespread use for some years. Recent developments have given rise to the consideration of similar techniques for application in the explosion case.

E3.2.1 - The new API RPFB In 2001 it was agreed that the existing guidance on fire and blast engineering which formed part of the 21st edition of API Recommended Practice (RP-2A-WSD) [E.23] should be augmented by a new separate RP on fire and explosion engineering. This document is limited largely to a discussion of consequence assessment, with philosophy and hazard management, including mitigation, dealt with by reference to API and other reference documents. The required scope of assessment for both conceptual and detailed design may be limited for installations that can be considered less safety-critical. Simplified assessment methods are described.

E3.2.2 - ISO 19900 update The new suite of ISO codes for offshore structures is currently being prepared by a large number of national and international experts. Resistance to fire and explosion is covered particularly in ISO 19901-3 for Topside Structures [E.21]. The section on Accidental Actions includes requirements and useful guidance on fire and explosion hazard management as well as vessel collision, dropped objects and helicopter crash scenarios. (Natural hazards such as extreme weather and earthquake are dealt with in other codes.). Although the code will have a very wide audience, ISO 19901-3 is written with practising project engineers in mind. It makes full use of (and reference to) recently validated research so as to set out the minimum requirements and to indicate current good practice for design. Part of the code is Normative (mandatory), whilst the remainder is Informative to provide additional information about other considerations and to indicate sources of guidance. Like the API code [E.23], which is proceeding in parallel, the ISO code recognises that the significance to life from fire and explosion events depends to a large extent on mitigation by the structural barriers that are fitted to protect the people and safety critical equipment on board an installation. There is agreement that the ISO codes for offshore structures should apply across the European Union and other countries in place of any specific European (CEN) standards.

Issue 1

May 2007

Page 457 of 493

FIRE AND EXPLOSION GUIDANCE E3.2.3 – EI Guidance on design and protection of pressure systems to withstand severe fires Following research work on the development of BLEVEs, the Energy Institute has published guidance on design and protection of pressure systems to withstand severe fires [E.24]. The research showed that for certain fire scenarios the guidance provided by API RP 520 [E.25] and API RP 521 [E.26] is insufficient to protect against BLEVE, or other severe fire events.

E3.2.4 – Guidance on preventing hydrocarbon releases Following analysis of the statistics collected by the HSE on offshore hydrocarbon releases since 1994, three guidance documents were produced through the Institute of Petroleum. In an additional effort to disseminate the learning throughout the industry, the document entitled “Hydrocarbon Release Reduction Toolkit” [E.27] was produced by UKOOA’s Hydrocarbon Release Reduction Workgroup and is available through the Step Change website. The IP Guidance addresses the most common causes of loss of containment in process related systems. These are:

•

Corrosion, erosion and fatigue in steel pipework;

•

Vibration or mechanical failure in instrumentation;

•

Improper make-up of flanges or other types of joints;

•

Use of flexible hoses.

As a result of investigating and understanding the most common failure modes in these areas the following IP guidelines were issued to assist in avoiding releases:

•

Management of Integrity of Bolted Pipe Joints [E.28];

•

Flexible Hose Management Guidelines [E.29];

•

Guidelines for the Management, Design, Installation and Maintenance of Small Bore Tubing Systems [E.30].

A fourth guidance document was produced by the Marine Technology Directorate:

•

Guidelines for the Avoidance of Vibration Induced Fatigue in Process Pipework [E.31].

In the similar vein of working to reduce the frequency of occurrence of leaks, HSE have worked with BP and a leading wellhead manufacturer on development of an inherently safer wellhead design. [E.32].

E3.2.5 – Guidance on improved ignition modelling An updated ignition probability model [E.33] has been developed and at time of writing has been issued; sponsored by UKOOA and the Offshore Safety Division of HSE. It is based on input from OIR12 data.

Issue 1

May 2007

Page 458 of 493

FIRE AND EXPLOSION GUIDANCE E3.2.6 – Research on effects of PFP degradation Work is being carried out to better understand the impact of degradation of PFP on its performance. At the time of writing, a conference is planned in Aberdeen reporting on the weathered PFP project, [E.34].

E3.2.7 – Collation of existing technical guidance relating to offshore major accident hazards The industry has recognised that while there is a wide range of informative technical guidance, codes and standards available to the industry, a concise catalogue of this key information has hitherto not been available to the industry and the HSE. A catalogue has now been compiled through the Energy Institute [E.35], and is freely available from the Energy Institute’s website.

E4 - References E.1

Health and Safety at Work Etc. Act 1974’, Office of Public Sector Information, 1974

E.2

The Management of Health and Safety at Work Regulations 1999, Office of Public Sector Information, Statutory Instrument 1999 No. 3242

E.3

The Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Office of Public Sector Information, Statutory Instrument 1995 No. 743

E.4

The Offshore Installations (Safety Case) Regulations 2005, Office of Public Sector Information, Statutory Instrument 2005 No. 3117

E.5

The Offshore Installations and Wells (Design and Construction, etc.) Regulations 1996, Office of Public Sector Information, Statutory Instrument 1996 No. 913

E.6

Assessment Principles for Offshore Safety Cases’ (APOSC) HSE Books, 2006

E.7

‘The Offshore Installations and Pipeline Works (Management and Administration) Regulations, Office of Public Sector Information, Statutory Instrument 1995 No. 738

E.8

Hazardous Installations Directorate, Offshore Division, “Fire and explosion strategy”, Issue 1, http://www.hse.gov.uk/offshore/strategy/index.htm

E.9

Hazardous Installations Directorate, Offshore Division, “Fire, Explosion and Risk Assessment Topic Guidance”, Issue 1, http://www.hse.gov.uk/offshore/fireexp/images/fire_exp.pdf

E.10

Hazardous Installations Directorate, Offshore Division, “Guidance for the topic assessment of the major accident hazard aspects of safety cases”, April 2006, http://www.hse.gov.uk/offshore/gascet/gascet.pdf

E.11

EN ISO 13702:1999 ‘Petroleum and natural gas industries – Control and Mitigation of fires and explosions on offshore production installations – Requirements and Guidelines’, International Standards Organisation, 1999

E.12

IP 15, Area classification code for installations handling flammable fluids: Model code of safe practice in the petroleum industry Part 15, 3rd edition, ISBN 0 85293 418 1) was published in July 2005.

E.13

Equipment and protective systems intended for use in potentially explosive atmospheres (ATEX), EU Directive 94/9/EC

E.14

The minimum requirements for improving the safety and health protection of workers potentially at risk from explosive atmospheres (ATEX), EU Directive 1999/92/EC

Issue 1

May 2007

Page 459 of 493

FIRE AND EXPLOSION GUIDANCE E.15

BS EN 60079-10. ‘Electrical apparatus for explosive gas atmospheres Part 10. Classification of hazardous areas’, BSI 2003

E.16

BS EN 1127-1, Explosive atmospheres – explosion prevention and protection – Part 1: Basic concepts and methodology, BSI 1998

E.17

BS 5958: 1991 ‘Code of practice for control of undesirable static electricity’, Parts 1 and 2, BSI 1991

E.18

Policy and Guidance on reducing risks as low as reasonably practicable in Design (www.hse.gov.uk/risk/theory/alarp3.htm)

E.19

Principles and guidelines to assist HSE in its judgements that duty holders have reduced risk as low as reasonably practicable (www.hse.gov.uk/risk/theory/alarp1.htm )

E.20

Reducing risks, protecting people HSE (http://www.hse.gov.uk/risk/theory/r2p2.pdf )

E.21

ISO 19901-3 Petroleum and natural gas industries – Specific requirements for offshore structures – Part 3: Topsides Structure

E.22

API 'Recommended Practice for the Design of Offshore Facilities against Fire and Blast Loading', API RPFB, 2005

E.23

Recommended Practice for the planning, Designing and Construction Fixed Offshore Platforms – Working Stress Design, API RP 2A-WSD, 21st Edition. API (American Petroleum Institute), 2000

E.24


E.25

API RP 520, Sizing, Selection and Installation of Pressure-relieving Devices in Refineries, Part I, 7th Edition, 2000 and Part II, 5th Edition, 2003

E.26

ISO equivalent of API 521, ISO 23251:2006, Petroleum, petrochemical and natural gas industries -- Pressure-relieving and depressuring systems, International Standards Organisation, 2006

E.27

“Hydrocarbon release reduction toolkit”, Step Change http://stepchangeinsafety.net/ResourceFiles/toolkit final version.pdf

E.28

“Guidelines on the Management of Bolted Pipe Joints”, UKOOA/IP document, published by UKOOA Issue No.1, June 2002

E.29

“Flexible Hose Management Guidelines”, HSE/UKOOA/IP document, published by UKOOA issue No.1, Jan 2003

E.30

“Guidelines for the Management of Small Bore Tubing Fittings”, Energy Institute, (formerly IP), November 2000

E.31

“Guidelines for the Avoidance of Vibration Induced Fatigue in Process Pipework”, (Originally published by Marine Technology Directorate, available from the Energy Institute (EI),

E.32

M. Copland, J. McKenzie and P. Webb “Improving the Fundamental Safety of Xmas Trees and Wellheads for Platforms”, Offshore Europe, Aberdeen, 2003

Issue 1

May 2007

Books

2001

ISBN 071762151

in

Safety,

0

2003

Page 460 of 493

FIRE AND EXPLOSION GUIDANCE E.33

IP Research Report “Ignition probability review, model development and look-up correlations”, ISBN 978 0 85293 4548, 2006

E.34

The Use and Abuse of Passive Fire Protection Offshore, Hilton Aberdeen Treetops, Aberdeen, Health & Safety Laboratory, Tuesday 28 November 2006 http://www.hsl.gov.uk/news/pfp_prog.htm

E.35

Energy Institute, “Offshore technical guidance catalogue with specific relevance to major accident hazards: home page” http://www.energyinst.org.uk/offshorecatalogue/

Issue 1

May 2007

Page 461 of 493


Annex F Review of models

F1 - Introduction Traditionally large-scale experiments were carried out to study fires. However, mathematical modelling of fires is now becoming the preferred tool, due to the high cost associated with large-scale experiments. Computational Fluid Dynamics (CFD) modelling done properly is not cheap and there are outstanding uncertainties associated with the physical sub-models implemented in the code. Modelling and experiments are mutually exclusive, but should be viewed as complementary tools. The very rapid development of faster computer processors and more memory at reasonable prices enables the user to use finer meshes that will yield to solutions that are more accurate. The development of physical sub-models is not as rapid, but there are, nevertheless, some interesting models coming on-stream – some of which are only now becoming feasible to use due to the improved performance of the computers. There are two important steps to complete before any model can be used in anger and its results to be trusted: verification – ensuring that the correct equations with correct source terms are solved, and validation – showing the model’s accuracy. It is rare to find that the models are not verified. The validation process is time-consuming, expensive and laborious – validation is often incomplete. The lack of validation of the fire models was recognised by the Model Evaluation Group, part of a CEC sponsored project on fire modelling. The outcome of the Modelling Evaluation Group was a number of documents outlining minimum requirements for validation of jet fire models. The pool fire models did not undergo the same level of scrutiny, though most of the points made on jet fire model validation also apply to pool fire models.

F2 - Types of model F2.1 - General: There are a number of mathematical models of varying level of complexity that can be used for modelling hydrocarbon fires on offshore installations:

•

Probabilistic models

•

Empirical models

•

Zone models

•

CFD models

•

Evacuation models

•

Video analysis

Issue 1

May 2007

Page 462 of 493

FIRE AND EXPLOSION GUIDANCE F2.2 - Probabilistic models Probabilistic models have as yet found limited use for modelling fires on offshore installations. These models work on defining an event tree and assigning different levels of probability of an event occurring, thus taking into account uncertainties in the underlying processes. There is little or no reliance on fluid flow models with inaccurate or incomplete representation of the fire. However, these models do rely on the identification of all credible events and their associated probabilities. Another application of probabilistic models is to provide a realistic heat release rate. A probabilistic approach to estimating the heat release rate could be used to ensure that the heat release rates used in make CFD simulations are more realistic. An extrapolation of the probabilistic heat release rate model to other scenarios, i.e. jet fires on an offshore installation, may not be straightforward.

F2.3 - Empirical correlations Empirical correlations are based on experiments. Empirical correlations are easy to use and yield results instantaneously. The correlations provide information such as heat fluxes, wall temperatures as functions of distance through a material, etc. Empirical correlations are very useful for a quick assessment of the problem. There are limitations with empirical correlations. Only very simple configurations can be modelled. The models cannot take account of buildings and other structures, or the topography of the site. The estimates could be conservative, but it cannot be guaranteed to be the case for all situations. This type of model is only valid for the fuels and conditions that were studied in the experiments. One should therefore be wary of extrapolating the results to situations not covered in the experiments.

F2.4 - Zone models Zone models are also based on empirical information, but these models also incorporate some flow physics. The flow is divided into different zones that can exchange information, e.g. mass, momentum and heat. A set of ordinary differential equations for mass, momentum, energy and species mass fractions is solved for each zone. These models require more input from the user, but tend to have short computer run times, usually (much) less than an hour. The output from zone models would include heat fluxes, wall temperatures, species concentrations, temperatures, pressure and velocities. This type of model is very useful as a scoping tool, to identify scenarios that require the use of more sophisticated tools, i.e. CFD models. Zone models are also limited to modelling relatively simple geometries. The models should not be used for fuels or conditions that were not covered in the experiments.

Issue 1

May 2007

Page 463 of 493

FIRE AND EXPLOSION GUIDANCE F2.5 - Computational fluid dynamics models CFD models are the most complex of the fluid flow modelling tools. A number of strongly coupled non-linear partial differential equations provide a more realistic representation of the flow physics. There are uncertainties associated with modelling turbulent flow and combustion, as well as in the definition of the fire source and ambient conditions. The output from a CFD simulation includes velocities, density, pressure, fluid and wall temperatures, species concentrations (mean and fluctuating component), heat fluxes, etc. There is still a reliance on empirical data, especially for combusting flows, but the CFD models are by far the most generally applicable and flexible tools. Furthermore, the more realistic representation of the physics comes at a cost. It can be time-consuming to define a CFD model, the run-times can be very long, up to the order of weeks, and the simulations will not always converge. CFD is a knowledge-based activity and the user of CFD must have a thorough understanding and experience of a range of topics, including fluid mechanics, chemical kinetics, and numerical mathematics.

F2.5.1 - Industry standard Routine calculations are usually carried out using either the k- model, k-ζ model or Menter’s SST model. The weaknesses of these models are well documented. The models are sometimes applied in situations where it would be advisable to use some other turbulence model. Nevertheless, these models do quite well in many applications. While the models might not be able to provide very accurate results at all times they nevertheless provide the opportunity to study trends, i.e. how geometrical changes might affect the solution.

F2.5.2 - State of the art State of the art in turbulence modelling is Large-Eddy Simulation (LES) or Detached-Eddy Simulation (DES). These techniques were originally aimed at (external) aerodynamic flows, but are now finding widespread use for other applications. LES requires fine meshes in order to resolve all relevant length scales. The LES simulations must also be carried out for a long time, in real-time, to build up reliable flow statistics. It is also necessary to provide a sensible initial guess for fluctuating velocities, etc. There are also problems with the treatment of walls in wall-bounded flows, since there are no large-eddy structures in the near-wall region. DES is a hybrid approach where a simple turbulence model, like Spalart-Allmaras, is used in the nearwall region and LES is used in the free shear flow. DES is not as computer intensive as LES, while still providing the same amount of flow information. It might be sensible to reduce the problem size, by only considering a subset of the installation. It is not feasible to model the whole offshore installation, including parts of the surroundings, as well combustion, multi-phase or single-phase flow, phase change in the vessels subjected to impact of a jet fire with a CFD model. The run times would be prohibitively long. There are also large uncertainties in some of the physical sub-models in the CFD codes that make the use of CFD less attractive. A more in-depth review of the various modelling techniques has been carried out by the Health and Safety Laboratory, both in terms of current industry standard and of state of the art and much of this information is reproduced in this annex. The emphasis is on the CFD models as these incorporate the most realistic representations of the physical processes. There is a definite need to revise the assessments of applicability of the modelling techniques as the models and the available computer resources develop further.

Issue 1

May 2007

Page 464 of 493

FIRE AND EXPLOSION GUIDANCE F2.6 - Evacuation models Evacuation models have been used in conjunction with CFD models, but can also be run on their own. The evacuation models can be run as a post-processor, since it is usually assumed that the movement of people does not affect the flow significantly, though this is not always the case. Some of the models are becoming sophisticated in that relationships between individuals can be prescribed; individuals can make their decisions on which exit to use. Validation of evacuation models is difficult, as it is very difficult to recreate in a controlled experiment the urgency, indecision and stress brought on in an individual when being subjected to a real fire.

F2.7 - Video analysis Statistical analysis of video footage of jet fires has been used to provide information on the likelihood that the fire engulfs a vessel. This information has been used with empirical correlations. This information would not normally be used on its own.

F2.8 - Miscellaneous In light of uncertainties with the various types of models, it might be prudent to carry out simulations where a zone model and a CFD model can provide input to and output to each other. Ideally a great number of scenarios, different wind directions, wind speeds, release locations, release directions, need to be investigated. This is not feasible to do with CFD due to the long computer runtimes. The use of simpler models as scoping tools could highlight scenarios that warrant an in-depth investigation with CFD. It is vitally important that the simple model includes all the important physical processes. Therefore the suitability of a simple model as a scoping tool will have to be assessed on a case-by-case basis. Traditionally fluid flow modelling and structural analysis have been carried out separately. However, it would be desirable to model, say, escalation due to the collapse of parts of the structure, i.e. Fluid-Structure Interaction (FSI). It is now more feasible to integrate the two types of modelling due to the availability of faster computers with large memory, and FSI is therefore finding increasingly widespread use. Nevertheless, the computer runtimes are roughly an order of magnitude greater than for a comparable fluid flow simulation. There are a number of different packages in which the fluid flow solver and the structures solver are fully integrated. Filters for converting the fluid flow results into something that can be read by the structural analysis code enabling the coupling of separate a fluid flow and structural solver are also available. Some of the integrated fluid flow solvers are limited to inviscid flows and are thus not suitable to fire modelling. The required outputs from the CFD code are heat fluxes, concentration of toxics, transport of toxic products and provision of output from a fluid flow simulation using CFD in the correct format to be used in structural analysis using a Finite Element code.

Issue 1

May 2007

Page 465 of 493

FIRE AND EXPLOSION GUIDANCE F3 - Status of the sub-models in CFD models F3.1 - Turbulence models F3.1.1 - Industry standard Routine calculations are usually carried out using either the k-ε model, k-ζ model or Menter’s SST model. The weaknesses of these models are well documented. The models are sometimes applied in situations where it would be advisable to use some other turbulence model. Nevertheless, these models do quite well in many applications. While the models might not be able to provide very accurate results at all times they nevertheless provide the opportunity to study trends, i.e. how geometrical changes might affect the solution.

F3.1.2 - State of the art State of the art in turbulence modelling is Large-Eddy Simulation (LES) or Detached-Eddy Simulation (DES). These techniques were originally aimed at (external) aerodynamic flows, but are now finding widespread use for other applications. LES requires fine meshes in order to resolve all relevant length scales. The LES simulations must also be carried out for a long time, in real-time, to build up reliable flow statistics. It is also necessary to provide a sensible initial guess for fluctuating velocities, etc. There are also problems with the treatment of walls in wall-bounded flows, since there are no large-eddy structures in the near-wall region. DES is a hybrid approach where a simple turbulence model, like Spalart-Allmaras, is used in the nearwall region and LES is used in the free shear flow. DES is not as computer intensive as LES, while still providing the same amount of flow information.

F3.2 - Multi-phase flow F3.2.1 - Industry standard The choice of multi-phase model depends on the flow, i.e. whether it is a gas-liquid, gas-solid, liquid-solid or a gas-liquid-solid system. The fraction of dispersed phase is also of importance when choosing which model to use. When dealing solids and droplets that have are not monodisperse, i.e. distribution of different sizes, one would not normally attempt to follow each individual particle or droplet but rather consider groups of particles, with all particles in each group having same size and properties. Two situations that are of particular importance on an offshore installation are when a jet release is made up of gas and condensate, where both phases are combustible, and water mitigation. For larger problems the dispersed phase is treated as continuous, i.e. as a part of the bulk fluid.

F3.2.1 - State of the art A two-flow model, where the phases have different momentum, energy and heat, and the inter-phase exchange of these quantities represent state of the art. However, there are great uncertainties associated with the modelling of the interfacial information transfer between the phases. A transported-PDF method where a velocity-scalar PDF is combined with either LES or Reynolds Averaged Navier-Stokes could be used to model dispersed multi-phase flows.

Issue 1

May 2007

Page 466 of 493

FIRE AND EXPLOSION GUIDANCE F3.3 - Combustion models F3.3.1 - General There are uncertainties associated with the modelling of combustion processes. Some of these are related to the complexity of the chemical kinetics, with a large number of intermediate species and reactions describing the combustion of even the simplest hydrocarbons, and the lack of understanding of the processes involved. Further uncertainty is introduced, as it is not possible to accurately resolve the flame front for flows considered in the present report. The simpler combustion models introduce constants that are not universally applicable and need to be adjusted for each fuel.

F3.3.2 - Gaseous combustion Industry standard: Routine simulations of combusting flows usually involve the use of the Eddy Dissipation Model or, less likely, a laminar flamelet model with a prescribed PDF, for non-premixed combustion, and the Eddy Break-Up (EBU) model for premixed combustion and the Zimont model for partially premixed or premixed combustion. Fires are also sometimes represented by a volumetric heat source. This will provide a means of heat release (location and magnitude) but will not provide any information of the amount of toxic products that are produced. State of the art techniques in gaseous combustion modelling are the Probability Density Function (PDF) approach and the Conditional Moment Closure (CMC) model. The PDF method involves solving a transport equation for the PDF. This is then coupled to a detailed or reduced chemical kinetics scheme. However, these calculations place great demands on the available computer resources. The need for detailed treatment of chemical kinetics in fires in offshore installations is not likely to great. The CMC model can also be used to represent detailed chemical kinetics and does not place the same demand on the computer resources as the PDF transport approaches

F3.3.3 - Liquid combustion Industry standard: It would appear that relatively simple combustion models, such as mixedis-burnt or Eddy Break-Up-type models, are being used. Heavier hydrocarbons are well characterised and will of course change with time and location of the wellhead within each reservoir. The complexity of the combustion of heavier hydrocarbons makes it intractable to attempt to use more sophisticated combustion models. State of the art: It might be possible to use a transported PDF method with either detailed or reduced chemical kinetics or the Conditional Moment Closure model. However, no references to combustion modelling of mixtures of heavy hydrocarbons using either of these two methods have been found in the open literature.

F3.3.4 - Multi-phase combustion Industry standard: One cannot afford model the combustion of each individual droplet in a spray. However, a Eulerian-Lagrangian approach where one tracks groups of droplets, and particles in each group have the same size and properties might be feasible. The actual combustion would be modelled using a simple combustion model, i.e. mixed-is-burnt, Eddy Dissipation or the Zimont model.

Issue 1

May 2007

Page 467 of 493

FIRE AND EXPLOSION GUIDANCE State of the art: The computational cost of CFD calculations for non-reacting multi-phase flows is already high. The added complexity of the combustion processes makes modelling of multi-phase combustion very expensive computationally for the flows considered in the present report. It might be possible to use a transported PDF method with either detailed or reduced chemical kinetics or the Conditional Moment Closure (CMC) model. However, no references to combustion modelling of mixtures of heavy hydrocarbons using either of these two methods have been found in the open literature.

F3.4 - Heat transfer models F3.4.1 - Conduction Conduction of heat is of great importance. One possible scenario is when a jet fire impacts on a vessel. Passive Fire Protection (PFP), i.e. coating of process equipment and vessels, is used to protect the equipment from the fire. However, PFP ages and is affected by the weather. There is also a risk that the coating is removed due to the erosive effect exerted by a high momentum jet. The subsequent heating up of the content of the vessel could lead to pressure build-up due vaporisation of hydrocarbons. The complexity of the problem that involves fluid flow, combustion, heat conduction (possibly with deteriorating PFP) and phase transition makes this problem intractable for CFD models in many cases. It might be feasible to combine the CFD model with a zone model that can provide the conditions in the vessel.

F3.4.2 - Convection Convection plays a very important part in the heat transfer processes from a fire. The momentum imposed on the plume greatly affects where and how fast the hot exhaust gases travel. This has implications for the evacuation of personnel. The use of wall functions is the industry standard for modelling convective heat transfer at walls. These wall functions have usually been derived for natural convection. The state of the art wall functions are the scaleable wall functions that are more accurate than the old equilibrium wall functions. CFD modelling of smoke transport carried out at Cambridge University and HSL showed that the choice of convective heat boundary condition greatly affects the flow, i.e. wall functions should be modified to account for forced convection if the heat transfer is a combination of forced and natural convection.

F3.4.3 - Radiation Industry standard: The Discrete Transfer Model (DTM) is frequently used and offers accurate predictions at a relatively reasonable cost. Though there is a trade-off between accuracy and speed, as more rays used will up to a point result in more accurate radiative flux predictions. Also frequently used are radiation models based on the Discrete Ordinate Model which solve the radiative energy transfer equation for a number of solid angles. Another commonly used simple model is the P1 radiation model that was developed for coal combustion. State of the art in radiation modelling is stochastic modelling using Monte Carlo simulations with either a narrow band or a wide band model. This is an expensive technique, but it is suitable for complex geometries and is potentially a very accurate method. The accuracy is dependent on the number of rays used.

Issue 1

May 2007

Page 468 of 493

FIRE AND EXPLOSION GUIDANCE F3.4.4 - Dispersion of toxics The term “toxics” encompasses many products of combustion including carbon monoxide, soot and smoke. It is important to be able to model the movement of these toxic substances, as it can be used to determine how long time the occupants have before, say, the smoke concentration becomes too high, and thus provide information upon which to draw up an emergency evacuation plan. Dispersion of toxic products can be modelled in a number of ways. CO and smoke are frequently treated as a single passive scalar, respectively. There are correlations that would provide an estimate for the amount of CO and smoke produced by a particular fuel. It is also possible to model the production of CO and smoke via a combustion model, i.e. Eddy Dissipation model. Soot can also be modelled with a version of the Eddy Dissipation model that has been adapted to soot modelling. A more sophisticated approach is to use a laminar flamelet method. It is then necessary to solve two transport equations for mixture fraction and mixture fraction variance and two transport equations for the soot volume fraction and soot number density. LES and DES techniques are likely to be used for modelling of smoke transport, but the high computational cost of LES and DES will probably preclude the use of these approaches for modelling of an entire offshore installation.

F4 - Miscellaneous issues F4.1 - General Committee of the European Community (CEC) sponsored a project in the area of Major Industrial Hazards with the aim to establish suitable criteria and procedures for model verification and validation, surveying the state of the fire models for jet fires and pool fires, and propose further development and validation of the physical sub-models. This Model Evaluation Group (MEG) held a number of open meetings where mode developers and academics discussed the state of fire modelling at great length. Unfortunately, the pool fire models were never properly assessed. The jet fire models on the other hand were scrutinised a much detail. A number of recommendations for how the models should be validated and the results of the validation studies be reported were presented.

F4.2 - Verification The purpose of the verification process is to show that the correct transport equations are solved, i.e. that all the important terms have been included in the equations. Most CFD codes and the models implemented therein will have been verified.

F4.3 - Validation Definition:

Validation is the process of demonstrating that the model provides a sufficiently accurate representation of the real world.

Validation is a very difficult, costly and time-consuming exercise. One of main difficulties lies in that there are an infinite number of different scenarios that ideally should be investigated. This is clearly not feasible. It is therefore important to select a set of representative scenarios that are run each time a new release of the code is due to be distributed. There should be no differences in the results obtained with the old and news releases unless bug fixing to a particular, relevant model has been carried out. The results should be investigated if there are any differences between two solutions.

Issue 1

May 2007

Page 469 of 493

FIRE AND EXPLOSION GUIDANCE F4.4 - Issues affecting accuracy of predictions There are a number of factor that influence the accuracy of the CFD model predictions. These are listed below in no particular order:

•

Mesh quality;

•

Computational cell size in the near-wall region;

•

Grid dependency;

•

Ray dependency (radiation model), if applicable;

•

Time step dependency, if transient simulation;

•

Convergence;

•

Sensitivity to choice of boundary conditions, if applicable;

•

Settings of turbulence and combustion model constants;

•

Effects of choice of spatial and temporal discretisation methods on the solution; and

•

Inclusion of buoyancy in the transport equations for momentum and turbulence quantities.

These factors should always be taken into consideration in CFD simulations. It is important that reports describing CFD modelling should also include this information, to show that these factors have been investigated. There are a number of guidance documents on the use of CFD for various types of flows; ERCOFTAC has produced a document providing Best Practice guidelines on the general use of CFD, Casey and Wintergeste (2000) [F.1]; NAFEMS has also produced guidance document on the general use of CFD, NAFEMS (1996) [F.2] and HSL has produced a Best Practice guidance on modelling of smoke transport, Gobeau et al. (2002) [F.3].

F4.5 - Future developments The rapid development and availability of cheap and powerful computers with large memory will yield more accurate results without making any improvements to the numerical algorithms and the physical sub-models. It is therefore not sensible to make hard and fast rules about mesh sizes. A sensitivity study comparing the results of simulations on three meshes of different fineness will show whether the solution is grid independent. It is also not sensible to specify the number of rays to use when modelling radiative heat transfer. A sensitivity study of the effect of changing the number of rays on heat fluxes should be carried out. The use LES to model combusting flows has increased greatly, though there are concerns over the coarseness of the meshes that are used in the calculations. Many simulations using an LES technique are also not run for a sufficiently long time (in real-time) to provide reliable flow statistics. The DES or similar hybrid technique combining LES and a simple turbulence model will find increased use and be applied to combusting flows, as a great deal of effort is going into further refinement of the models. DES-like techniques are also better suited to wallbounded flows than LES.

Issue 1

May 2007

Page 470 of 493

FIRE AND EXPLOSION GUIDANCE Combustion modelling using the CMC model holds great promise for the future. The computational overhead with CMC model is considerably lower compared to that of the transported PDF methods. However, it is not certain that the extra information about the combustion provided by the CMC and the transported PDF methods is required, especially given the level of uncertainty in the modelling and the increased computational cost. It is therefore likely that the simpler models, i.e. Eddy Dissipation model, the Zimont model and laminar flamelet models with prescribed PDF, will continue to be used for the foreseeable future There is great uncertainty in the modelling of interfacial transfer of momentum, heat and mass between different phases. It is also very difficult to measure interfacial transfer of momentum, heat and mass between different phases in experiments. This is an area that should see improvements as more sophisticated measurement techniques are employed. However, it may be necessary to be to resolve the interface between the different phases, which would significantly increase the computational overhead, in terms of computer runtimes and memory requirement.

F5 - References F.1

Casey, M., and Wintergerste, T., Special Interest Group on Quality and Trust in Industrial CFD – Best Practice Guidelines, ERCOFTAC, 2000

F.2

NAFEMS, CFD Analysis: Guidance for good practice, NAFEMS Document Ref. No. R0063, 1996

F.3

Gobeau, N. Ledin, H. S., and Lea, C. J., Guidance for HSE Inspectors: Smoke movement in complex enclosed spaces - Assessment of Computational Fluid Dynamics, HSL Report No. HSL/2002/29, 2002

F6 - Further reading Carregal Ferreira, J., Forkel, H, Bender, R., Menter, F. R., Improved LES-, DES- and SASModels for the CFD-Simulation of Chemically Reacting Flows, EROFTAC Bulletin No. 64, pp. 57-60, 2005 CRC, The Handbook of Fluid Dynamics, Ed: Johnson, R. W., CRC Press/Springer Verlag, Boca Raton, FL, USA, 1998. Merci, B., and Roekaerts, D., Turbulence-Chemistry Interaction in Turbulent Flame Simulations – Transported Scalar PDF Approach, ERCOFTAC Bulletin No. 64, pp. 25-28, 2005 Model Evaluation Group, Model Evaluation Group – Report of the Second Open Meeting, Cadarache, France, 19 May, 1994, EU Report No. EUR 15990 EN 1995a Model Evaluation Group, Protocol for Model Evaluation, Commission of the European Communities, DG-XII, Brussels, 1995b Model Evaluation Group, Guidelines for Model Developers, Commission of the European Communities, DG-XII, Brussels, 1995c

Issue 1

May 2007

Page 471 of 493


Annex G Checklists

G1 - Potential hazards by process system Process system

Characteristics

Production fluids manifolding and mixing

The manifolds collect the reservoir fluids from the wells via the flowlines, mix the fluids and direct them to the appropriate separators. They contain well fluids which may be a mixture of oil, condensate, gas, water and other materials such as sand.

•

Line, valve and sensor arrangements may be complex to offer operators fine control of routing of fluids. May increase weak points for potential releases.

•

Untreated reservoir fluids, will be more aggressive and abrasive.

•

In later life, may see higher water content with increased corrosion rates.

•

May be periodically subject to high flow rates with potential for erosion.

The fluids arrive in these large vessels (generally over 2-3 stages) and stay whilst settling/separating into component fluid parts (residence time).

•

High(er) inventories.

•

Gas inventories even in oil processes.

•

Many small bore tappings and instrumentation that may be vulnerable to smaller explosions and fires.

Water, gas and oil/condensate separation

Stabilisation dewatering

and

final

Oil/condensate pressurisation for export

Issue 1

Potential hazards

•

Water residues may give rise to localised corrosion.

•

Potential for overpressure if isolated and subject to fire loads.

A final stage of stabilisation or dewatering. This stage requires large vessels which are filled with virtually stable oil plus a small quantity of water in the bottom.

•

As above although operating (generally) at lower pressure and with gas component already taken off.

•

Large liquid spill potential by virtue of their size, bunding or other disposal/containment measures required.

Export pump arrangements may use one or two pumps in series, pumps may be duplicated with manifold arrangements. These complex piping arrangements can give an isolated inventory of up to 15 tonnes for a field with large throughput.

•

The pump seals and the complex jointed piping leak to a high likelihood of a release.

•

Releases on the high pressure sides of the pumps may be significant.

•

Operator error or other hazards arising from the role and status of stand-by pumps (how they are switched in and out and how they are left, pressurised or not?).

•

The inherent design of the plant requires the pumps to be located close to the lowest level of the platform, often beneath the separators. May cause low level external flaming, smoke affecting most of the topsides and escalation to the inventories above.

May 2007

Page 472 of 493

FIRE AND EXPLOSION GUIDANCE Process system

Characteristics

Gas compression including gas liquids condensing and knockout

Gas from the various stages of separation is progressively compressed and cooled allowing liquids such as ethane, propane, butane and water to be condensed and returned to the liquids system. Typically several compressors will be required with the final discharge pressures of 50-60 bar.

•

Compressor sections and their associated condensers and knockout pots are likely to be sectionalised with ESD valves to reduce release inventories.

•

Personnel in the immediate area may be at risk from flash fires or explosions if the area is congested.

•

A moderately high possibility of a gas leak arising from the compressors and associated vibration causing breakage of attached piping.

This will use either glycol units or molecular sieves and can operate at up to 60 barg. The largest inventory is likely to be a contactor with up to 3 tonnes of gas.

•

Some potential for local escalation, due to failures of small bore instrumentation and associated piping.

•

Release potential/severity can be minimised using depressurisation.

Typical pressure for these systems is 150 barg but can be as high as 400 barg for some re-injection requirements. Inventories typically 1-3 tonnes.

•

Some potential for local escalation, due to failures of small bore instrumentation and associated piping.

•

Release potential/severity can be minimised using depressurisation.

•

Potential vibration may cause premature fatigue for attached piping.

•

Operator error or other hazards arising from the role and status of stand-by compressors (how they are switched in and out and how they are left, pressurised or not?).

•

Equivalent to piping with additional potential release sites at the instrument connections.

•

Generally robust systems although running at export pressures and flow rates.

•

Hazards may be introduced by lack of understanding how the process runs when they require maintenance or re-calibration. The production may be recycled to avoid a shut-down, especially in F(P)SOs where storage capacity is available and held for later export.

Gas drying

High pressure export, gas lift and re-injection compression

Oil and gas metering

Issue 1

Metering is generally carried out using inline flow meters.

May 2007

Potential hazards

Page 473 of 493


G2 - Gas detection systems summary (reproduced from Table 3.1) Method of gas detection

Strengths

Weaknesses

Single point Pellistors These detect the presence of gas when it reaches a detector head. They are good at detecting accumulations of gas.

Well-understood item. Good designs should allow gas clouds to be tracked, as they drift through areas of plant, from the safety of the control room.

Susceptible to ‘poisoning’ of the catalyst by oilspray and contact with other chemicals. Always check proposed site and contamination issues with manufacturer. They generally require a high level of maintenance due to drift, and recalibration due to poisoning, as these detectors do not automatically provide indication of a faulty pellistor. Very large numbers are required to adequately cover a typical fire zone Not preferred on new or upgraded installations.

Have historically been used for detection of gas in air supply ducts to enclosed areas containing unclassified electrical equipment or other potential sources of ignition but not recommended now IR, beam detectors available.

Location in an air intake duct is an arduous duty for this type of detector Executive action occurs on 2oo3 voting. Access for frequent maintenance and testing is essential. I/R point detector with duct probe or I/R open path detector are now available, and better, for this service. Not very effective for small leaks in open areas. In this situation use in conjunction with acoustic detectors. Susceptible to drifting if not regularly checked and maintained, leading to unnecessary shutdowns. Unless the gas comes into direct contact with the detector head it will not operate so numerous detectors, suitably located are required. Vapours heavier than air require detector location at floor level. For natural gas releases, detectors need a high level location. Must be calibrated and located appropriately for the vapours they are designed to detect. Calibration settings for LNG (methane), LPG (propane), condensate and hydrogen are all different. Heavier or lighter than air gases require increased numbers of detectors and present difficulties positioning to avoid damage at low level and maintenance access at high level.

Note: On older installations where there is heavy reliance on pellistor type detectors, consideration should be given to setting the devices to give initial (low level) alarm at a levels just above the anticipated drift range of the device and high level alarm slightly above that. Operators have found that alarm at 10 to 20 % LEL and executive action at 25 to 40 % is feasible for a well maintained system. This gives an added margin of safety while avoiding nuisance alarms. Different set points will be necessary for different applications. The suitability of the set point each application should be documented, and not automatically assumed to be 20 % LEL for low level and 60 % for high level alarm.

Issue 1

May 2007

Page 474 of 493


Strengths

Weaknesses

IR point detectors

Very good at detecting flammable gases at potentially known locations. Very little maintenance or calibration required during the life of the detector (in excess of 5 years). These detectors are least sensitive to methane, so when calibrated for methane will also detect other gases i.e. propane, butane etc more readily. This type of detector is good for confined areas, ducts etc (with a duct probe unit).

Not good as the prime detector type for open process areas as large numbers of detectors would be required.

IR Beam (open path) detectors. These detect the presence of a cloud of hydrocarbon gas between a detector head and its reflector

Very good at detecting gas clouds in open process areas, effectively taking the place of numerous point detectors. Very little maintenance necessary, but this can be achieved by one man with an interrogator tool. Not susceptible to poisoning. Detectors can be sited at the boundaries of modules of fire zones to provide economic coverage of large areas, providing good information on gas migration. Care should be taken when subsequent work is being carried out on the installation, when there might be the potential for blocking beams by scaffolding, sheeting for weather protection or painting.

Some early versions could be activated by adverse weather, especially rain and fog and vibration

Leak detectors (acoustic) These detect the noise made by any significant leakage from a high pressure gas (whether flammable, toxic or inert) system.

Will detect any significant leak in vicinity without contact with gas therefore large numbers of detectors not necessary. Usually only two or three detectors are required in a typical process area.

Area mapping of background noise is necessary to enable the correct alarm setting to be established. These detectors need to be located with easy access for routine testing. These detectors will detect a high pressure leak of any gas, whether hydrocarbon, air, N2, CO2 etc. Hence caution is necessary when arranging the shutdown logic and when placing the detectors, with respect to any regular discharges of air (such as near air compressors). Discussions with equipment vendors should be initiated to understand the frequency range over which the detectors will work.

Note: There has been reluctance by the industry to embrace acoustic detection. It is still regarded with suspicion as ‘new technology’ despite nearly ten years of successful use in the Southern North Sea.

Concerns about spurious activations by background noise can be averted by designing in recognition of other noise signature in vicinity and possible use of pre-set time delays before alarm initiation. Initial calibration of detectors in their designated location is essential.

Issue 1

May 2007

Page 475 of 493


Strengths

Manual

Personnel should always be vigilant and report small leaks for Investigation, repair and monitoring. Most small leaks are still detected manually especially on open design platforms

CCTV (see CCTV in Table 3.2 -)

Cheaper and readily fitted especially on large installations or on extensive process areas. Allows operator judgement on how to deal with the situation.

Issue 1

May 2007

Weaknesses

Visibility of large gas releases depends on numerous process, release and atmospheric variables. Small gas releases would not generally be picked up.

Page 476 of 493

FIRE AND EXPLOSION GUIDANCE G3 - Fire detection systems summary (reproduced from Table 3.2) Methods of Fire Detection

Strengths

Weaknesses

Ionisation Smoke detectors detect the visible and invisible products of combustion as they come into contact with the detector.

Widespread use in enclosed areas such as accommodation ceiling voids, electrical equipment and control rooms. The detectors can be wired in series with up to 20 detectors on one loop. These detectors have a high resistance to contamination and corrosion. They are available in a wide range of versions to suit different needs.

Not effective in open modules, as the smoke is usually dispersed before reaching detector. Not advised for use in areas where some smoke is expected in normal operation e.g. above cookers. Care is needed with disposal since they contain a minute radioactive source

Optical Smoke detectors detect only visible smoke and rely on the ‘light scatter’ principle

Widespread use in enclosed areas such as accommodation modules. The detectors can be wired in series with up to 20 detectors on one loop. These detectors have a high resistance to contamination and corrosion and are available in a wide range of versions to suit different needs.

Not advised for use in areas where some smoke is expected in normal operation e.g. above cookers.

Alert personnel to the incipient development of a fire situation e.g. behind instrument panels, especially in unmanned control rooms or in cable routes. These detectors are particularly suitable in areas with high air flow ventilation. The very early warning allows personnel to enter the room to investigate and/or isolate power supplies without undue exposure to risk.

These are being widely used to replace Halon systems removed from control rooms, MCC or switch-rooms. They can be alarm only, or wired to the F&G control panel for executive actions and/or shutdowns. These systems are relatively high unit cost and there are additional maintenance requirements for checking and keeping air-sampling tubes clear.

IR flame detection

Widely used and well understood. Used to detect the infra-red wavelengths of hydrocarbon flames. Typically 4 to 16 detectors would be needed to cover a module depending on module congestion and dimension.

Detect ‘yellow’ flames, but weak on bluer flames (e.g. methanol fires). Vision of units can be obscured by smoke or equipment (especially forgotten ‘temporary’ items). Often used in combination with UV detectors where several types of fire can occur in one module. Generally specialist mapping techniques are used to optimise detection and ensure adequate coverage is achieved. To avoid spurious alarms higher numbers of detectors are required to provide voted logic. Spurious alarms may occur from other, non-fire IR sources, so not suitable in areas where ‘black body radiation’ occurs.

UV flame detection

Widely used and well understood. Used to detect the Ultra-violet wavelength of a flame spectrum. Typically installed under turbine/compressor hoods.

Detect the bluer flame types. As for the infra red detectors, solid objects or smoke will obscure the cone of vision, reducing the effectiveness of the detector. The lens of each detection unit needs regular checking for dirt build-up which prevents effective operations of the device.

Smoke Detection:

VESDA (Very Early Smoke Detection Alarm) or HSSD (High Sensitivity Smoke Detection) These pull air samples from areas susceptible to electrical fires to a small analyser and check for smoke or pre-combustion vapours.

Flame Detection

Issue 1

May 2007

Page 477 of 493


Strengths

Weaknesses

Video flame detector (makes use of specialist flame imaging technology)

Very good at detecting flaming fires. Sophisticated versions can be set up to mask out known flame sources e.g. platform flare. These can provide conventional alarm signals plus a video image if required. Possibly the way forward for ‘Greenfield’ projects.

Unit cost may be high but fewer units are required to cover a typical process area.

Fusible bulbs

These bulbs break at a pre-defined temperature and raise an alarm/ESD. They also usually either release water directly or release air to activate deluge systems. This system does not rely on electrical power for satisfactory operation and deluge release.

A these devices require a heating effect that causes failure, dependent upon their relative location with respect to the fire, they may take significant time to detect a fire (for example compared with optical (IR/UV) detectors). By the time the bulbs operate, significant damage may have been done. The bulbs may also subject to physical damage and corrosion which could lead to false alarms. An extensive pipe network is required (linking the bulbs to the detection system) to provide coverage of full module.

Fusible links

These melt at pre-defined temperatures to raise an alarm/ESD by breaking a circuit. Some directly initiate release of hydraulic fluids to close safety valves on wells or risers.


Fusible plugs

These melt in fire situations to send an alarm signal and release hydraulic fluids thus closing well and riser safety valves.


Rate of heat rise

Detects rapid temperature change. Useful in areas with temperature fluctuations. Highly reliable as a single detector, confirmed fire signal.

Rate of heat rise - Rate Compensated

Detects temperature change. Highly reliable as a single detector, confirmed fire signal

Fixed

Detects a pre-set high temperature. Based on thermocouple design. Highly reliable as a single detector, confirmed fire signal. Gaining in popularity and reducing in price with time.

Conventional CCTV used to supplement traditional fire and gas detection devices

Issue 1

Not as fast reacting as the rate-of-rise detectors.

Systems with good coverage can be expensive to install and maintain.

Particularly good for checking alarms in remote areas such as column bases on semi-subs. Allows escape routes from TR to evacuation points to be checked and state of fire development in process areas without exposing emergency response personnel to danger.

May 2007

Page 478 of 493

FIRE AND EXPLOSION GUIDANCE G4 - Jet fires summary Fire Scenario

Flame Extent And Geometry

Heat Flux To Target Engulfed -2

Combustion Products

Non-Engulfed

Jet fire in the open. Gaseous release.

Use multiple point source model for flame length or surface emitter models for general flame shape.

50-300 kW m . May be higher in larger flames and in those loaded with higher molecular components

Use multiple point source or surface emitter model. In the far field i.e. >5 flame lengths, point source models are acceptable if F factor is known.

2-phase release

Major uncertainties

50-250 kW m-2 for flashing propane up to 20 kg s-1. Major modelling difficulties. No other data exist.

Major uncertainties

Jet fire in module. Fuel controlled.

Caution - flame shape changes due to impingement on objects.

Treat as open fire.

Ventilation controlled.

Major difficulties and uncertainties. The open flame lengths may be extended as air access is denied.

Up to 400 kW m-2 in recirculating gaseous propane flame.

In the extreme, external flames result. Models not developed.

Major uncertainties because of induced recirculation and incomplete burning. Needs to be treated on a case specific basis. There are no validated predictive models.

Field models are good for predicting toxic gas and smoke movement but not concentrations.

Field models predict smoke and toxic gas trajectories adequately. Concentrations and temperatures less well predicted. Probably greater smoke concentrations than open fires.

Jet fire below lower deck

Treat as open fire, but note major difficulties with 2-phase releases, and flame extent for large releases into objects.

Wellhead blow-out

Treat as open fires in naturally vented or explosion damaged well-bays. Treat as ventilation controlled fire in enclosed well-bays. N.B. Major uncertainties with 2-phase blow-outs and liquid dropout.

Issue 1

May 2007

Page 479 of 493

FIRE AND EXPLOSION GUIDANCE G5 - Pool fires summary Source Terms Fire Scenario

Pool Spread

Heat Flux To Target

Mass Burning Rate

Flame Extent Geometry Flame length use Eqn. 6.2 [Appendix A, OTI 92 596]. Flame tilt, use Eqn. 6.5 [Appendix A, OTI 92 596] or Eqn. 6.6 [Appendix A, OTI 92 596]. Flame drag, use Eqn. 6.7 [Appendix A, OTI 92 596]

Engulfed

Pool fire on the open deck.

Limited by walls, edge of deck or local depressions.

Use literature data where applicable. Otherwise use equation 6.1 in Appendix A, OTI 92 596.

Pool fire in module. Fuel controlled.

Normally limited by walls.

Treat as open deck fire.

Treat as open deck fires

Major uncertainties (see [Appendix A, OTI 92 597].

Major problems. Severity may be greater than the same fire in the open. Models are not yet validated (see [Appendix A, OTI 92 597].

Ventilation controlled.

Major difficulties and uncertainties. Models not validated. Open flame length may be extended as air access is denied (see [Appendix A, OTI 92 597].

100-160 kWm-2 (see table 6.4 in Reference [Appendix A, OTI 92 596]).

NonEngulfed Use surface emitter model. Point source models acceptable beyond approx. 5 pool diameters if F factor known.

Pool fire on sea. Oil.

Complex but known (see [Appendix A, OTI 92 596].


Treat as open deck fires.

Subsea gas release.

Some data and theory available (see [Appendix A, OTI 92 596].

Assume all gas burns over effective pool area (see [Appendix A, OTI 92 596].

250-300 kWm-2 for large pools (see [Appendix A, OTI 92 596].

Pool fire at bottom of concrete leg.

Treat as ventilation controlled fire in enclosed well-bays. N.B. Flame may go out through lack of air.

Issue 1

Treat as open deck fire with caution. Check mass burning rate does not far exceed normal pool fire values.

May 2007

Treat as open deck fire with caution.

Combustion Products Field models are good for smoke and toxic gas movements, but not concentration.

Zone or field models can predict trajectories adequately but not concentrations.


May have more smoke and toxic gases than open fires.

Page 480 of 493

FIRE AND EXPLOSION GUIDANCE G6 – Assessment checklists A summary of the assessment checklist contents is given in the Figure below. Key KeyTechnique Technique

Low LowComplexity Complexity Method Method

Medium MediumComplexity Complexity Method Method

High High Complexity Complexity Method Method

A. A. Scenario Scenario Identification Identification

•• Simple SimpleIdentification Identification appropriate appropriatefor forinstallation installation

•• Emission Emissionmodelling modellingto toestimate estimatelikelihood likelihoodof of mixture mixturebuild-up build-upwithin withinenclosure enclosureusing usingCSTRCSTRstyle stylecalculations, calculations,ESD ESD//Blowdown Blowdown •• Effect Effectof ofwind windon onmixture mixturebuild-up build-up •• Special Specialsituations situations--external externalexplosions explosionsetc. etc.

•• Use UseCFD CFDto toanalyse analyseemission emissiondispersion, dispersion,influence influence of ofwind, wind,local localconcentrations concentrationsand andingress ingressfrom from neighbouring volumes to arrive neighbouring volumes to arriveat atscenario scenario definition. definition.

B. B. Blast BlastAnalysis Analysis

•• Simple Simpleestimate estimateof ofventing ventingand and congestion congestionisisrequired requiredto tojudge judge whether whetherexplosion explosioncan canoccur. occur. •• Discourage Discourageuse useof ofventing venting model model •• Use Useof ofhistorical historicalcomparison comparison

•• Represent Representequipment, equipment,vessels vesselsand andpipework pipework down downto toaalevel levelappropriate appropriatefor for phenomenological phenomenologicalmodelling modellingtool. tool. •• Define Defineexplosion explosionexceedence exceedenceusing usingignition ignition point pointarray arrayor orother otherempirical empiricalmethod methode.g. e.g. historical historicaldata. data. •• Model Modelshould shouldbe beable ableto toassess assessmitigation mitigation

•• Use UseCAD CADto torepresent representmodule moduleinternals. internals. •• Model Modelall alllocal localturbulence turbulenceand andflame flamepropagation propagation effects effectsusing usingmesh meshmodel model •• Define Defineaadistribution distributionof ofleak leaksources, sources,release releasehole hole sizes, sizes,wind winddirections directionsto togenerate generatean anoverpressure overpressure exceedence exceedencecurve. curve.

C. C. Blast BlastImpulse Impulse Selection Selection

•• Assess Assess//estimate estimateworst worstcase case blast blastimpulse impulse

•• Assess Assess“basecase” “basecase”overpressure overpressurefor foriteration, iteration, based basedon onestimate estimateof ofpracticable practicablelimit limitof of protection. protection. •• Consider Consideruncertainty uncertaintyaffects affects •• Iterate Iterateby byassessing assessingeffect effectof oflayout layout&&structural structural risk riskreduction reductionmeasures measures

•• Assess Assess“basecase” “basecase”overpressure overpressurefor foriteration, iteration, based basedon onan ananalysis analysisand andreview reviewof ofpracticable practicable design designlimits limitsof ofstructure structure •• Iterate Iterateby byassessing assessingall alllocal localand andglobal globalexplosion explosion effects effectsand andpotential potentialrisk riskreduction reductionstrategies strategies

•• Direct Directimpact impactof ofPersonnel Personnel •• Direct Directimpact impacton onSCEs SCEs

•• Has Hasassessment assessmentof ofescalation escalationpotential potentialbeen been made? made? •• Is fatality estimation method realistic for the Is fatality estimation method realistic for the module moduletype? type?

•• Has Hasaadetailed detailedescalation escalationanalysis analysisbeen beencarried carriedout out that thatconsiders considersthe theeffect effectof ofblast-induced blast-inducedSCE SCE failure failure(structure (structure++designated designatedsystems) systems)on onthe the emergency emergencyresponse responsefunctions functions •• Consider Considerexternal externalexplosions, explosions,blast-funnelling, blast-funnelling,farfarfield fieldoverpressures overpressures

D. D. Layout Layout Optimisation Optimisation

•• Best Bestpractice practicee.g. e.g.EN EN ISO13702 ISO13702etc.. etc..

•• Use Usemodel modelto toassess assessthe theeffect effectof ofequipment equipment location locationchanges. changes. •• Assess the effect of changing wall location, Assess the effect of changing wall location, removal removalof ofblockages blockagesand andcongestion congestion reduction. reduction.

•• Use Usemodel modelto toassess assessthe theeffect effectof ofchanges changesinin layout layoutand andventing ventingareas. areas. •• Show Show that thatlocal localBOPs BOPsand anddrag dragforces forcesare arenot not excessive. excessive. •• Consider Considerexternal externalexplosions explosionsand andbang-box bang-box ignitions. ignitions.

E. E. Structural Structural&& Equipment Equipment Optimisation Optimisation

•• Use Usesimple simplequasi-static quasi-staticload load analysis analysiswith withworst-case worst-caseblast blast impulse estimate to impulse estimate to demonstrate demonstratestructural structural integrity. integrity.

•• Use Usedynamic dynamicanalysis analysisto toassess assessvibration vibration magnitudes. magnitudes. •• Assess overall drag forces on SCEs. Assess overall drag forces on SCEs. •• Check Checkfor forlocal localplastic plasticdeformation deformation&&assess assess against againstredundancy. redundancy.

•• Non-linear Non-linearstructural structuralanalysis analysisto todemonstrate demonstrate residual residualstrength strengthof ofstructure. structure. •• IsIsthe structural response coupled the structural response coupledto tothe theblast blast analysis analysis •• Piping Pipingstress stressanalysis analysisusing usingselected selectedBOP BOPpulse pulseto to demonstrate demonstrateprocess processintegrity. integrity.

•• Demonstrate Demonstratebest bestpractice practiceinin layout, layout,equipment equipmentselection selection and andso soon. on.

•• Use Usesemi-quantitative semi-quantitativearguments argumentsto to demonstrate demonstrateALARP ALARPfor forstructural structural&&equipment equipment protection. protection. •• Use Useof ofcase-by-case case-by-caseCBA CBAto toassess assessthe theworth worth of ofupgrading upgradingblast blastprotection. protection.

•• Use Userobust robustQRA QRAto tofully fullyjustify justifythat thatno nofurther further measures measurescan canbe betaken takento toreduce reduceexplosion explosionrisks risks further, further,supported supportedby byCBA. CBA.

D. D. Assessment Assessmentof of Explosion Explosion Consequences Consequences

F. F.

ALARP ALARP Assessment Assessment

Figure G.1 Summary of assessment checklist contents High sophistication methods may be used where more sophisticated methods of assessment which may result in reductions in conservatism and hence cost are considered more appropriate.

Issue 1

May 2007

Page 481 of 493

FIRE AND EXPLOSION GUIDANCE G7 - Low risk methodology The low risk methodology may be applied to low risk installations and medium risk installations where valid nominal overpressures less than 1 bar are available.

Typical Application

Limited access wellhead platforms Platforms with few SCEs, or where the SCEs vulnerability to blast is low Platforms with little or no congestion or confinement

Heading Scenario Identification

Blast Analysis

Issue 1

Checklist Is the scenario credible?

Guidance The Safety Case should include an account of how scenarios were identified, either by formal HAZID or by judgement. The Safety Case must consider if the possibility of a flammable accumulation exists. For a simple installation, there may be no, or few credible scenarios for the following reasons: •

Little or no confinement e.g. if there is no weather deck, or no process vessels or other venting obstructions;

•

Little or no congestion e.g. pipework, cable trays and so on;

•

There is insufficient inventory to form a cloud of sufficient size to result in damaging overpressures (it is probably impossible to dismiss an explosion scenario on this basis, given that leaks are generally at high pressure, and that anything up to a full bore pipe / valve / flange rupture is possible);

•

It may be physically not credible for a flammable mixture to develop in an area, because the route taken by the flammable gas is so extraordinary;

•

There are no ignition sources present (again, it is probably impossible to dismiss an explosion scenario wherever there is the potential for the human factor to result in a release, as the persons present represent an ignition source).

Is simple assessment of congestion and confinement sufficient?

There must be evidence of a structured approach to congestion and confinement, in order to show that an explosion scenario is credible. This need not be particularly complex, the Shell CAM method appears to cover these issues well, and can be applied to local areas of congestion and confinement.

Is use of simple vent model sufficient?

Venting guidelines have been used in the past for wellhead platforms, sometimes when their applicability has been questionable (in fact, for anything other than an empty box). Continued use of these models for either Design or Operational Safety Cases is not desirable.

Is use of historical comparison sufficient?

If the installation closely resembles other designs, then there seems to be little point in conducting an analysis if one has been done elsewhere for a similar installation. Some sort of comparative assessment is necessary in the Safety Case that has considered whether the installation in question is significantly more congested or confined compared to historical precedent. Consideration may be given to data-basing analysis results for installations, so that industry experience is shared.

May 2007

Page 482 of 493

FIRE AND EXPLOSION GUIDANCE Typical Application

Limited access wellhead platforms Platforms with few SCEs, or where the SCEs vulnerability to blast is low Platforms with little or no congestion or confinement

Heading

Checklist

Guidance

Blast Impulse Selection

Identification of Worst-case blast impulse or lower value for structure and equipment analysis

It is intended that a low sophistication approach should be used wherever personnel exposure is low, but nonetheless there are SCEs protect against. The aim should be to show that there is sufficient inherent strength in the structure and equipment to withstand worst-case conditions. Where there is explosion potential, it appears that most open wellhead platforms and NUIs can only experience overpressures up to approximately 1 bar in any case. It is suggested that this should be used as a base case for new-build designs where the provision of protection is concerned. For existing installations, this approach is more problematic given that it is more difficult to retrofit blast wall detailing and supports to withstand high overpressures, and so the optimal level of protection could be less. This would point toward the need for a medium sophistication analysis.

Assessment of explosion consequences

Impact on personnel

Typically, simple QRA methodologies assume that POB in the fire area containing an explosion will perish immediately.

Impact on SCEs

Unless the SCE is rated for the worst-case overpressure, then the analysis should conclude functional impairment results, either as a result of exposure to the pressure impulse, indirect vibration, or drag forces. These are discussed below.

Layout optimisation

Adoption of best practice in venting and congestion management

For a wellhead platform or NUI, there are typically few options available for layout. The Case should show how layout best practice has been used to reduce overpressures e.g. by reducing congestion, keeping vent paths open, locating SCEs distant from the explosion source, and so on.

Structural and Equipment Optimisation

No SCEs exposed to blast effects

As above, the Case should seek to show that SCEs have sufficient residual strength to withstand worst-case blast effects, or that they are located out of the vent path of the explosion.

Sufficient input information from blast analysis

In order to check whether the structure and pipework is vulnerable to blast, some information is necessary. Typically, these are as follows: •

Overpressure pulse magnitude

•

Pulse duration

•

Associated drag force

In order to take credit for SCE survival to blast, in the associated PS it is necessary to identify the principal explosion parameters. Note that this could be done on the basis of previous analyses based on similar installations.

ALARP Assessment

Issue 1

Simple quasistatic load analysis

A simple quasi-static load analysis, based on the maximum pulse magnitude, will demonstrate the integrity of the structure. It is simultaneously necessary to consider of the period of the pulse in comparison with the natural period of the structure and pipework, to show that there is no possibility of damaging resonance effects.

Best practice in layout, equipment selection, venting and congestion management

It is envisaged that it would in fact be difficult to justify any risk reducing measures at all on cost-benefit grounds for small installations that are only periodically visited. Best practice is exhibited by demonstration e.g. that pipe routings consider blast impact / drag loadings, that grating has been used to ease overpressures where possible, that vent paths are clear, and so on.

May 2007

Page 483 of 493

FIRE AND EXPLOSION GUIDANCE G8 - Medium risk methodology The medium risk methodology may be applied to medium risk installations. Medium risk methods are described in below which substitute for some of the tasks defined in the high risk methodology. The philosophy recommended in this Guidance is that for medium risk installations the choice of methodology for any particular task must be justified where it deviates from the high risk methodology.

Typical Application

Heading Scenario Identification

Issue 1

NUIs with confinement or congestion e.g. due to high equipment density, NUIs with relatively high manning e.g. > four visits per year Manned platforms with separation process, gas treatment, but with considerable segregation between TR and hydrocarbon hazard e.g. bridgelinked. Checklist

Guidance

Have scenarios been considered and excluded? On what basis?

For the low sophistication case, the scenario identification is primarily concerned with the geometry of the area where an explosion could potentially take place. However, a medium complexity analysis will probably entail a probabilistic analysis of the likelihood of an explosion occurring. This must in turn entail a treatment of the likelihood of a flammable mixture being present in an enclosure, which should consider all the influencing factors. It is likely that some scenarios will be omitted from the analysis, and so the inspector must be satisfied that the grounds for omission are firm.

Does the scenario account for available inventory?

Possibly there is insufficient inventory in the leaking system to build-up an explosive mixture throughout the domain being considered. This could be the case for successful ESD / Blowdown. This scenario is therefore not credible. The analysis should consider "partial fill" situations.

Does the scenario account for external effects such as windspeed and direction?

Some scenarios may be omitted from the analysis on the basis that the ambient wind conditions prevent the formation of an explosive mixture. The analysis must consider the full range of wind speeds and directions, and account for uncertainty in order to omit scenarios on this basis.

Are confined explosion scenarios identified?

Does the HAZID address the possibility of explosions in vents and drains e.g. due to the back flow of air into a vent drum and the subsequent formation of a flammable mixture. These should be addressed in the design of vent drums, vent pipes and headers, pipe supports, F(P)SO cargo tanks and so on.

How are unconfined explosions addressed?

Usually, the Fire and Explosion Risk Analysis will consider the potential for gas build-up and ignition. Typically ignitions are characterised as immediate or delayed. Immediate ignitions arise from "near-field" ignition sources, probably associated with the cause of the initial leak e.g. hot-work. Delayed ignitions are caused by "far-field" ignition sources e.g. static or intermittent sources such as faulty electrical equipment. These are in turn variously described as explosions and flash fires, or "strong" and "weak" explosions. A flash fire or weak explosion is usually not considered in terms of overpressure damage, only as a cause of fatality for persons directly exposed to the event. Criteria for assessing a delayed ignition as either a flash fire or a strong explosion should be identified at the outset, if a blast scenario is dismissed as not credible.

Are severe explosions identified?

It is well known that enriched gases and mists result in changes to known flammability limits and blast overpressures, compared to single-component explosions. The inspector must ensure that the scenario identification accounts for this possibility and that this is incorporated into the uncertainty analysis as appropriate.

May 2007

Page 484 of 493


Typical Application

Heading Blast Analysis

Issue 1


Guidance

General

For a small, simple installation it is probably sufficient to identify worst-case overpressure scenarios and determine if the structure and facilities are able to withstand it. Small open structures should not experience severe overpressures and so it is simple and practicable to protect against worst-case or near-worstcase scenarios. Larger geometries will inevitably lead to rather more severe explosions given the increase in inventory size or an increase in the amount of equipment representing both congestion and vent blockage. For larger, more complex geometries it is likely that worst-case overpressures will be much more severe than the structure and equipment can cope with. For a given geometry, the worst-case scenario will depend on ignition source strength and location, and also on the local gas concentration.

Assessment of ignition point array - random?

The analysis should use a variety of ignition point locations to show that worstcase conditions have been determined. These could either be through expert judgement e.g. selection of the most confined or congested areas, or by random selection. It is likely that the use of an ignition point array is used to derive a probabilistic exceedance curve (see below). It is difficult to say how many ignition locations and overpressure calculations have to be carried out to determine an adequate curve, however the case should be convincing that a sufficient number has been carried out.

Is there any effect of flashing liquid / condensate on blast overpressures?

The analysis must account for the possibility that a severe explosion can result from a mist or concentration of enriched gas.

Have drag forces been quantified?

The analysis should be capable of being used to calculate drag forces, in order to demonstrate the survivability of vulnerable SCEs such as hydrocarbon pipework, vent pipework, cable trays and so on.

Has the effect of design "growth" on the analysis been accounted for?

For new-build designs, the initial analysis may only consider the geometry down to crude limits. Calculated overpressures are likely to be exacerbated as more detail is introduced to the analysis e.g. small diameter pipework, cable trays etc., however once the design overpressure is selected it is difficult to iterate the design - the blast wall has already been specified and ordered. The analysis should attempt to show the degree of increase in blast overpressure brought about by design growth or alternatively should calculate the overpressure at the end of the design to demonstrate that there has been no more than a small effect.

Other factors affecting Blast overpressure MODU or windwalling

The calculation of blast overpressure should consider the effect of temporary blockages such as wind-walling / tarpaulins / scaffolding or a workover MODU placed against the platform, if this interacts with the module being analysed e.g. the well bay.

Can the analysis successfully model mitigating effects?

Generally, blast models are most useful in assessing the effect of layout changes such as equipment location and venting. For any level of sophisticated analysis, the model should be able to demonstrate the worth of mitigation measures e.g. deluge to mitigate explosions.

May 2007

Page 485 of 493


Typical Application

Heading Blast Impulse Magnitude Selection


Guidance

What is the methodology for selection of lower-thanworst-case blast loadings for design?

As above - it is likely that for larger more congested modules it is not practicable to stiffen structure and supports to withstand calculated worst-case scenarios. Thus, a methodology is needed to arrive at a design value that is lower than the worstcase. This is likely to be probabilistically based, and result in the production of an "exceedance curve", that shows the probability that an explosion will be greater than a given overpressure. Therefore, if an estimate of explosion frequency is available, this is combined with the exceedance curve probability to arrive at physical impairment frequencies. This approach readily lends itself to cost-benefit analysis in support of ALARP. If an exceedance curve technique is adopted, the methodology needs to be reviewed carefully. If it is constructed from the results of explosion analysis, the inspector must ensure that a sufficient number of calculations has been carried out to reduce uncertainty to a tolerable level. Work has been done to compile data relating to estimates of blast magnitude and frequency for North Sea installations of varying sizes. If statistics are used to compile or compare exceedance probabilities, then the inspector must ensure that they are applicable to the installation type under scrutiny.

How has uncertainty been addressed?

What are the practicable protection limits?

Issue 1

Analytical uncertainty arises as a result of inevitable modelling imperfections compared with actual events. Uncertainty in overpressure estimation could arise due to uncertainties regarding scenario definition, model limitations or uncertainties regarding the value of the input variables. •

Scenario definition. In fact, it is impossible to know the ignition location for a gas cloud with any degree of certainty, and the concentration at the ignition location. The literature describing most models generally claims that they are just as likely to under-predict as over-predict the overpressure for a given blast scenario. Uncertainty is therefore typically reduced by carrying out many calculations for an array of ignition points and gas concentrations, and producing an exceedance curve.

•

Model limitations. Uncertainty can arise if the model is unable to calculate overpressures at a single location e.g. riser ESDV, if within the model domain. Relatively crude phenomenological models are usually unable to meaningfully calculate anything other than a peak throughout the domain. The average overpressure may be close to the SCE survivability, producing a "cliff-edge" risk effect on the QRA results. The inspector must be satisfied that cliff-edges have been identified.

•

Input variables. Model uncertainties mainly affect calculated overpressure by their influence on the flammable cloud burning rate, and suggests that applying a log-normal distribution to the laminar burning velocity within the model. This is quite sophisticated and may not be possible within the confines of "black-box" models bought off-the-shelf. A crude method is to simply adopt a conservative approach and factor up the predictions according to expert judgement, alternatively it may be possible to show that that modelling uncertainties are not significant given the inherent strength of the SCE being considered.

The inspector should establish that the safety case has explored the practicable limits for overpressure protection on the basis of the worst-case overpressure and any probabilistic analysis. Is it possible to design for the worst-case, even though this is a remote event? This goes a long way to removing uncertainty.

May 2007

Page 486 of 493


Typical Application

Heading Assessment of explosion consequences

Layout optimisation


Issue 1


Guidance

Has assessment of escalation been attempted?

It is probably valid to consider escalation effects resulting from SCE failure, given that there could be a significant effect on risk levels. This must consider the failure modes and the likely escalation. Typically, in the event of failure of a blast wall, say, the QRA rule set may assume universal fatality amongst POB on the other side of the blast wall. This may be inappropriately conservative, given that "failure" of the wall is merely exceeding the buckling failure limits of the wall and supports rather than rapid and complete demolition.

Is fatality estimation realistic for the module type?

It is common to assume universal fatality in the area containing the blast. If it is assumed that POB have no chance to escape before the blast, then the likelihood of immediate fatality may be inappropriately high. As a result, the numbers of delayed fatalities e.g. due to escalation effects may be low, and so the benefit of risk reduction methods intended to mitigate and control escalation e.g. TR functions may be under-reported.

Has published guidance been used to lay out the module equipment?

There is a lot of published guidance regarding the most advantageous layout for areas where there is an explosion hazard. The HSE inspector should be satisfied that the explosion analysis has considered the effect of following the guidance.

Have the effect of equipment location changes been addressed?

Location of equipment can affect the degree of blockage. The inspector should be satisfied that e.g. the axis of vessels is along the vent path. If the layouts are fixed, the inspector should look to see that some sensitivity work has been done, to check that the effect of relocating equipment is not significant.

Have the effects of changing wall locations, removal of blockages and congestion reduction been assessed?

Leading on from the above, the inspector should be satisfied that the duty holder is aware of the impact of the effect of layout changes, and has included a process for assessing and controlling the key factors affecting explosion risk in the design or safety management process.

For new-builds, have the benefits changing module shape been assessed?

For an open module, it is generally accepted that a "long & thin" layout should serve to reduce explosion likelihood and magnitude. The layout encourages dispersion, whilst the vent paths are short. On the other hand, high overpressures can result if the available vent path is on the long axis of the module. The inspector should be satisfied that the advantages of this layout have been addressed within the design of the facility.

Has quantification of structural deflections using dynamic analysis been carried out?

In order to assess the survivability of pipework, it is necessary to analyse the deflection of primary structure arising from the design event. This must be realistically done, in order to be able to show that deflection does not result in escalation to e.g. vent header pipework.

Have blast vibration / accelerations been determined?

The Safety Case should include an analysis of local structural accelerations arising from severe explosions. Performance standards should be set for SCEs to withstand blast-induced accelerations where appropriate e.g. TEMPSC davits; UPS; panels.

May 2007

Page 487 of 493


Typical Application

Heading


Guidance

Do Survivability Performance Standards consider all blast effects?

Following from the above, the inspector must ensure that SCE Survivability criteria are based on the ability to withstand: •

Overpressure effects (direct loading);

•

Loading arising from flow effects i.e. drag forces;

•

Acceleration resulting from blast effect on primary structure

Note that SCEs located in non-hazardous or safe areas are vulnerable to blastinduced acceleration. Check for local plastic deformation and redundancy

ALARP Assessment

Is cost-benefit analysis used to assess risk reduction measures? Is it conservative?

Points to consider in the assessment are: •

Has the structural design accounted for heavy explosion loads giving rise to plastic deformation;

•

Has sufficient redundancy been build into the structure;

•

Has the effect of plastic deformation on SCEs been accounted for in the Safety Case?

For larger, more complex installations, it is envisaged that these require greater risk exposure on the part of operations POB to inspect and maintain the plant items. As exposure increases, so the use of cost-benefit analysis (CBA) becomes more meaningful. Care is needed to ensure that the analysis is conservative, and that the criteria used are valid. Conservatism in cost-benefit analysis relates to ensuring: •

Costs associated with implementing remedial measures are not overstated (some remedial measures can be implemented as part of an ongoing scope of work and so offshore mobilisation costs etc. are therefore not applicable);

•

POB exposure is not underestimated;

•

Gross disproportion is accounted for;

•

Where benefits are marginal, other losses - production and so on - are accounted for. These could point to a conclusive overall benefit.

The costs of risk reduction measures require careful "reality" checking, so that the benefit is accurately measured. Where the results of CBA are counter to historical experience, the duty holder must show that the preferred way forward follows best practice.

Issue 1

May 2007

Page 488 of 493

FIRE AND EXPLOSION GUIDANCE G9 - High risk methodology The High risk methodology may be used for medium and low risk installations where more sophisticated methods of assessment which may result in reductions in conservatism and hence cost, are considered more appropriate.

Typical Application Heading Scenario Identification

Blast Analysis

Issue 1

PDUQ platforms, FPSOs, platforms where it is clear that the potential for escalation exists Checklist

Guidance

General

All the points from the low and medium sophistication checklists apply here also. At this high level of sophistication, it is clear that the Duty holder cannot always be expected to have specialist explosion expertise in-house to facilitate and advise. Nonetheless it is clear that such expertise is available in the market-place and so at this level there should evidence that the duty holder has commissioned an appropriate level of consultancy support for scenario identification, blast analysis, response analysis and so on.

Has ingress from neighbouring modules been accounted for?

For large, multi-module installations, the potential for gas migration and gas buildup from remote areas must be considered e.g. in the HAZID. For an FPSO, this could include gas migration and accumulation over the tank top, if the process decks are all plated.

Have local high emission concentrations been identified?

For areas of high congestion around equipment, it may be appropriate to check for local high gas concentrations resulting from small leaks. CFD (design) or real-time tests (existing installations) can be used to see if there are occasions when natural ventilation is insufficient to disperse leaks and to check for mixture build-up. The inspector should be satisfied that the Safety Case accounts for the possibility of small concentrations giving rise to a local explosion hazard.

Have external explosions been identified?

The hazard from external explosions is most severe for large integrated facilities, as it is likely that SCEs are located in modules adjacent to the explosion location. The TR and EER facilities may be directly vulnerable to blast effects (see below).

Is the philosophy for blast analysis clearly stated?

All the points from the Medium Sophistication Checklist apply here also. It is envisaged that the explosion analysis for an integrated facility, FPSO etc. will be carried out using a CFD-based code, due to the inability of phenomenological models to tackle non-standard module configurations and the inability to calculate local overpressures with any degree of confidence. Use of CFD follows from the high explosion risk potential, complex layouts, increased computer power, and the expectation that blast protection can be optimised. Given the resources available to the operators of large integrated facilities, it is expected that they should respond to challenges present at the leading-edge of explosion and structural response research. Operators must be prepared to resource detailed studies and tests which seek to demonstrate the clear interaction between the calculation of blast overpressure coupled with structural response, and which aim to deal with the numerous uncertainties associated with detailed calculations.

Has the effect of cloud turbulence been accounted for?

Explosion overpressures are exacerbated by high cloud turbulence as is likely in the event of a large or catastrophic leak. It is not clear if complex, sophisticated CFD-based explosion modelling techniques can tackle this sort of turbulence. Fullscale trials are intended to investigate the effects of turbulence: hitherto, full-scale experiments have been based on quiescent clouds. The analysis should address this phenomenon and its potential for increasing the likelihood of SCE failure.

Identification of local high Blast Overpressures

It is envisaged that the explosion analysis for an integrated facility, FPSO etc. will be carried out using a CFD-based code. The degree of analysis should be sufficient to indicate areas of high local overpressure to allow suitable mitigating measures to be specified and implemented.

May 2007

Page 489 of 493


PDUQ platforms, FPSOs, platforms where it is clear that the potential for escalation exists

Heading

Checklist

Blast Analysis (contd.)

Assessment of other blast phenomena

Blast Impulse Magnitude Selection

What is the methodology for selection of lower-thanWorst-Case blast impulse magnitude for design?

Guidance Blast analysis is typically carried out within a set "domain" that reflects the extent of the partial confinement and effectively marks the limit of the calculation. In fact, explosion effects are not limited to domains and there are two important phenomena to account for in explosion analysis: •

External explosions arise as a result of turbulent unburnt gas being pushed out of the partially confined volume and subsequently ignited. This can have a magnifying effect on the overpressure in the partially confined volume containing the initial explosion as it prevents venting. External explosions also result in areas not exposed to the initial explosions receiving unexpectedly high incident overpressures and drag forces. The analysis should account for the possibility of external explosions.

•

Blast-funnelling. Vented gases from a module can encounter confinement in neighbouring modules which will "funnel" the gases, producing high local gas velocities. This in turn can result in potentially severe overpressure and drag force effects.

•

Far-field overpressures. In the event of a strong explosion in an area of partial confinement, these can have an effect on items some distance from the limit of confinement as the overpressure pulse decays. The analysis should consider the effect of explosions on exposed SCEs that located outside of the explosion analysis domain.

CFD codes require a lot of computing power to operate and run times are lengthy. At present this probably precludes a full probabilistic analysis arriving at an exceedance curve, as the number of runs required to build up a convincing dataset would be prohibitively time-consuming. CFD codes are of most use in determining local overpressure effects. A transfer function can be arrived at, by combining CFD results at local locations to the exceedance calculation results from a phenomenological model. These can then be used to provide an exceedance curve for a given location - or SCE. A database of dispersion and overpressure results can be used as a basis of a probabilistic analysis. It is clear that effort is being directed to using CFD codes to input to a probabilistic analysis; the inspector must be aware of these and assess whether the installation Safety Case under scrutiny has used such tools in the ALARP demonstration. (See Scenario Identification / General for the duty holder's requirement to ensure they obtain competent consulting support where necessary).

How have practicable protection limits been determined?

It is likely that overpressures in complex multi-module installations can rise to high values. SCE protection may not be practicable for the worst-case. The assessment must show that sufficient structural and piping stress analysis has been carried out to determine ultimate strength for the applied load. This will naturally lend itself to determining whether additional strength can be built into the structure and supports in line with cost-benefit analysis.

Assessment of explosion consequences

Has a detailed escalation analysis been carried out?

At this level, an attempt should be made to properly demonstrate the effect of SCE failure on the capability of the emergency response functions of the installation and ultimately the individual and group risk levels. This is additional to the simple calculation of direct and indirect fatality referred to in the Medium Complexity checklist. It is only by fully considering the effect on SCEs that full cost-benefit analysis of explosion risk reduction measures can be carried out.

Layout optimisation

Show that local overpressures and drag forces are not excessive

The blast analysis should be of a suitable degree to identify areas of locally high overpressures. Evidence should be presented that the layout has been optimised to reduce these potentially damaging local overpressures to a tolerable level in order to demonstrate ALARP.

Issue 1

May 2007

Page 490 of 493


PDUQ platforms, FPSOs, platforms where it is clear that the potential for escalation exists

Heading

Checklist

Guidance


Has non-linear analysis been used to determine the residual strength?

It is likely that structure and supports have a great deal of residual strength after undergoing plastic deformation brought about by blast overpressure. Non-linear analysis of the structure can determine the degree of plasticity and whether actual failure of e.g. the blast wall and primary connections.

Is the structural response analysis coupled to the blast analysis?

Typically, a structure is assumed rigid throughout the applied blast load profile, which is assumed unaffected by any resulting deformation, "coupling" the structural response model to the blast overpressure model may result in a more realistic representation of the effect of blast. Effectively, the structural model allows the loading to interact with the structural deformation so that both loading and deformation were considerably reduced. Uncoupled analysis is the norm, and so it is Robertson suggests that coupling the analyses effectively removes unnecessary conservatism from the response analysis.

ALARP Demonstration

Issue 1

Has non-linear analysis been used to check the effect of structural deflection on pipework?

It is possible that the calculated structural deflections have been used in a relatively simple fashion in assessing the survivability of process pipework. This could be conservative if the survivability is linked to a code stress level rather than the ultimate strength of the pipe then effectively the pipe will never survive any significant deflection. Non-linear analysis can be used to demonstrate the point at which pipework loses containment. It will probably be prohibitively time-consuming to subject every pipe length to such a degree of analysis, but perhaps expert judgement can be used to identify particularly vulnerable sections that can be subject to close study.

Has all vulnerable structure and equipment been accounted for?

Following from the above discussion on "far-field" effects, the analysis must ensure that items outside the blast model domain are also optimised for blast resistance.

Use of robust quantitative risk analysis to demonstrate explosion management reduces risks to ALARP

Following on from the above, a fully integrated QRA is necessary. This should address risk to SCEs as well as directly to POB, because sometimes it is difficult to directly relate SCE failure to the QRA. This will reduce uncertainty in the final risk results, where uncertainty arises in the analysis of causes of fatality.

May 2007

Page 491 of 493


Annex H

Acknowledgements

Note: All affiliations are shown as existed at the time of the contribution.

Name

Affiliation

Role

Alan Richardson

HSE

Sponsor’s Technical Support

Alistair Warwick

W. S. Atkins (Houston)

Phase 1 Technical Author

Andrew Sekulin

Marathon Oil UK


Barbara Lowesmith

Loughborough University


Bassam Burgan


Phase 1 Advisory Panel and Phase 2 Technical Author

Beth Morgan

Morgan Safety Solutions


Bob Brewerton

Natabelle Technology Ltd


Bob Kyle

Oil & Gas UK

Sponsor

Brian Corr

BP Sunbury

Phase 1 Advisory Panel

David Aberdeen

BP Aberdeen


David Galbraith

fireandblast.com limited

Project Management Technical Author

David Gittos

Ward- Kellogg Brown & Root

and

Peer Reviewer

Denis Krahn

Mustang Associates


Doug Angevine

ExxonMobil


Ed Terry

fireandblast.com limited

Project Management Technical Author

Gerry Newman



Geoff Chamberlain

Shell Global Solutions

Phase 1 Peer Reviewer and Phase 2 Technical Author

Graham Dalzell

TBS Cubed


Greg Farley

Century Dynamics


Howard Harte

HSE

Sponsor

Jan Papas

Norsk Hydro

Peer Reviewer

Jan Roar Bakke

Gexcon


Issue 1

May 2007

and

Page 492 of 493

FIRE AND EXPLOSION GUIDANCE Name

Affiliation

Role

John Gregory

Risk Management Decisions

Phase 1 Peer Reviewer and Phase 2 Technical Author

Luke Louca

Imperial College (IC Consultants)


Martin Wheeler

BP Aberdeen


Mike Johnson

Advantica Technologies

Peer Reviewer

Minaz Lalani

MSL Engineering


Morten Sørum

Statoil


Peter Lawrence

Genesis Oil and Gas Consultants


Peter Stock

Aker Kværner


Phil Cheetham

Century Dynamics


Phil Cleaver

Advantica Technologies

Peer Reviewer

Rae McIntosh

HSE

Sponsor

Rod Bleach

Genesis Oil and Gas Consultants


Roland Martland

HSE


Stephan Ledin

Health & Safety Laboratory


Steve Carney

Aker Kværner


Steve Connolly

HSE


Steve Walker

MSL Engineering

Phase 1 Technical Author and Editor and Phase 2 Technical Author

Stuart Jagger



Terry Rhodes

Shell Expro

Peer Reviewer

Terry Roberts



Theresa Roper

Aker Kværner


Trish Sentance

Marathon Oil UK


Vincent Tam

BP Sunbury


Issue 1

May 2007

Page 493 of 493

Oil & Gas UK Fire and Explosion Guidelines Issue 1 2007

Recommend Documents