Professional Documents
Culture Documents
Oil Gas UK Fire and Explosion Guidelines Issue 1 2007 PDF
Oil Gas UK Fire and Explosion Guidelines Issue 1 2007 PDF
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system,
or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or
otherwise, without prior written permission of the publishers.
Copyright © 2007 The United Kingdom Offshore Oil and Gas Industry Association Limited trading as Oil
& Gas UK
ISBN: 1 903003 36 2
London Office: 2nd Floor, 232-242 Vauxhall Bridge Road, London, SW1V 1AU.
Aberdeen Office:
Email: info@oilandgasuk.co.uk
Website: www.oilandgasuk.co.uk
Foreword
This guidance has been sponsored by Oil & Gas UK and the UK Health and Safety Executive,
to provide a source of good practice on designing against fire and explosions on offshore
installations.
The guidance focuses on setting a philosophy for design and assessment in a realistic and
simplified manner. It distils the latest thinking, based on research and practices, contributed by
acknowledged and reputable experts and consolidates the research and development effort
from over 300 projects carried out since 1988 to the present day.
It is intended that the guidance will provide an accepted common base from which to support
design decisions by designers and duty holders for both new installations and in making
operational modifications to existing installations.
Topics addressed by the Guidance include fire and explosion hazard types, fire and explosion
management, the derivation of fire loadings, heat transfer and explosion loads and the
response of equipment and systems to fires and explosions.
Information is also included on legislation, standards and other initiatives, a summary of key
issues related to man-machine interfaces and a review of available fire and explosion models.
This Guidance establishes a new benchmark and will assist all sections of the industry in their
evaluation of the risks from hydrocarbons arising from the components of the offshore
infrastructure.
The Guidance does not have the force of a Standard and contains information on good
practice, which will always require clear justification in the context of specific hazards.
Alternative methods to those presented may be used so long as they are justified by a risk
assessment and provided their use leads to reducing risks to As Low As Reasonably
Practicable (ALARP).
Acknowledgements
It is appropriate to acknowledge the many contributors to this project. The Guidance was
created in two major phases with different teams involved in each phase.
Many thanks are due to our co-sponsors, the HSE for supporting this project since 2001. Many
technical specialists in both HSE and UK oil and gas member companies have contributed to,
provided information for and reviewed the Guidance as it has developed.
For the project management, technical contributions and editorial responsibilities in general,
thanks are due to fireandblast.com limited for their role in managing the project, collating and
editing contributions from others and filling-in some of the technical gaps in the guidance.
The first stage of the project covering the accumulated guidance on explosions was developed
by a consortium headed by MSL Engineering Limited with other members being Aker-
Kværner, Century Dynamics, Genesis Oil and Gas, Imperial College Consultants, Morgan
Safety Solutions and WS Atkins inc. (Houston). The advisory panel to the consortium and the
peer reviewers gave freely of their time and relevant background information to assist during
this phase, many thanks are due to them for helping to hone the presentation of some of the
more novel aspects of the guidance.
The second stage of the project covered the accumulated guidance on fires and was prepared
by acknowledged industry experts from MSL Engineering, Loughborough University, Health
and Safety Laboratory, Steel Construction Institute, Risk Management Decisions, Aker-
Kværner, Natabelle Technology, TBS Cubed, Shell Global Solutions and Mustang Associates.
Thanks are also due to many individuals who contributed informally via the workshops and
presentations undertaken during the development of this Guidance. Their contributions were
invaluable.
Contents
1 Introduction..........................................................................................................13
1.1 History ...........................................................................................................13
1.2 Objectives .....................................................................................................14
1.3 Fire and explosion events .............................................................................15
1.3.1 Identification.......................................................................................................... 15
1.3.2 Causes.................................................................................................................. 16
1.3.3 Consequence severity .......................................................................................... 17
1.4 Safety management systems (SMS) .............................................................18
1.4.1 Purpose of the SMS.............................................................................................. 18
1.4.2 SMS Content ........................................................................................................ 19
1.5 Hazard management systems.......................................................................26
1.5.1 General ................................................................................................................. 26
1.5.2 Policy .................................................................................................................... 27
Annex A References..........................................................................................398
A1 - References – Chapter 1..................................................................................398
A2 - References – Chapter 2..................................................................................400
A3 - References – Chapter 3..................................................................................402
A4- References – Chapter 4...................................................................................405
A5- References – Chapter 5...................................................................................406
A6- References – Chapter 6...................................................................................409
A7- References – Chapter 7...................................................................................413
A8- References – Chapter 8...................................................................................415
A9- References – Chapter 9...................................................................................417
A10- References – Chapter 10...............................................................................418
A11- References – Chapter 11...............................................................................419
Annex C Acronyms............................................................................................443
1 Introduction
1.1 History
Following the Piper Alpha disaster a large Joint Industry Project called ‘Blast and Fire
Engineering for Topsides Structures (Phase 1)’ was carried out between May 1990 and
July 1991. The main deliverable from this project was the Interim Guidance Notes (IGNs) [1.1]
and 26 background technical reports written by the participants and published by the Steel
Construction Institute (SCI) in November 1991. At about this time the Fire and Blast
Information Group (FABIG) was set up and has subsequently issued a number of Technical
notes on specific aspects of fire and explosion engineering [1.2, 1.3, 1.4, 1.5, 1.6, 1.7 and 1.8].
The Phase I JIP [1.9, 1.10 and 1.11] also included a review of open hydrocarbon pool fire
models. Three types of model (current at the time) were evaluated, semi-empirical proprietary
models, field models (e.g. CFD models) and integral models (falling between semi-empirical
and field models). Compartment fire modelling looked at two types of code, zone models and
field models. At that time, the zone models (typically used for modelling fires within buildings)
encountered severe limitations in the modelling of large offshore compartment fires.
Three further phases of the Blast and Fire Engineering Project JIP were conducted from 1994
to 2001, Phase 2 [1.12], Phase 3a and Phase 3b [1.13] consisting mostly of experiments to
define and determine explosion overpressure load characteristics and to provide a basis
against which load simulation software may be validated, however, some fire related
experiments were also undertaken.
The Phase 2 JIP also focussed on horizontal free jet fires of stabilised light crude oil and
mixtures of stabilised light crude oil with natural gas and the main findings are listed below.
• The free flame releases, of crude oil only, were not able to sustain a stable flame and
one of the mixed fuel releases was also unstable.
• All the flames were particularly luminous compared with purely gaseous jet flames and
generated large quantities of thick black smoke, mainly towards the tail of the flame.
• All the flames were highly radiative, with maximum time averaged surface emissive
powers (SEPs, heat radiated outwards per unit surface area of the flame) ranging
between 200 kWm-2 to 400 kWm-2.
• The incident total heat fluxes (radiative and convective) measured on the pipe target
were significantly higher for the mixed fuel tests than for the crude oil only tests, by a
factor of two in many cases. Typical values were in the range 50 kWm-2 to 400 kWm-2.
Phase 2 of the JIP included a fire model evaluation exercise. This considered three jet-fire
scenarios, but no pool-fire scenarios. However it did generate high quality data that were
considered suitable for future pool fire model evaluation.
The main source of detailed information on the characteristics of jet fires covered in the reports
on the programme of jet-fire research was co-funded by the European Community. This
programme studied single fuel natural gas and propane jet fires (Bennett et al, 1990) [1.14].
A further project funded by the CEC, looked at the hazardous consequences of Jet Fire
Interactions with Vessels (JIVE), this project covers the modelling of jet fires, large scale
natural gas/butane jet fires and taking vessels to failure in jet fires and some results of jet
flame impingement trials are reported in OTO 2000 051 [1.15].
During the same period, the HSE and others have funded approximately 300 individual
projects and a number of Joint Industry Projects (JIPs) at a cost of £31 million, which have
contributed significantly to the understanding of the key issues. The relative maturity of the
subject has enabled a better defined approach to be adopted in this Guidance document
relying more on ‘good practice’ which has been developed and implemented over the
intervening years.
1.2 Objectives
The primary objective of this document is to offer guidance on practices and methodologies
which can lead to a reduction in risk to life, the environment and the integrity of offshore
facilities exposed to fire and explosion hazards.
Risk is defined as the likelihood of a specified undesired event occurring within a specified
period or resulting from specified circumstances.
Preventative measures are the most effective means of minimising the probability of an event
and its associated risk. The concepts of Inherently Safer Design or ‘Inherent Safety’ are
central to the approach described in this document both for modifications of existing structures
and new designs.
This document consolidates the R&D effort from 1988 to the present day, integrates fire type
and scenario definition, fire loading and response development and provides a rational design
approach to be used as a basis for design of new facilities and the assessment of existing
installations.
This Guidance is intended to assist designers and duty holders during the design of, and in
making operational modifications to, offshore installations in order to optimise and prioritise
expenditure where it has most safety benefit.
An additional intent of this Guidance is to move the decision-making processes within the fire
and explosion design field as much as possible towards a ‘Type A’ process from ‘Type B or C’
as defined in UKOOA’s document on decision-making, the key figure of which is illustrated in
Figure 1.1 below [1.19].
The framework defines the weight given to various factors within the decision making process,
ranging from decisions dominated by purely technical matters to those where company and
societal values predominate.
Design decisions required for a number of installations will lie in Areas A or B of the chart
resulting in an approach which involves codes and Guidance based on experience and ‘best
practice’ as described in this document and supplemented by risk based arguments where
required.
This Guidance will look to build past experience of the development of fire and explosion
scenarios and the prediction of design load cases and their timelines as part of a developing
“Type A” approach.
1.3.1 Identification
Projects must identify major safety and environmental hazards as early as possible in the
project so that they can be understood, assessed and acted upon as necessary in a timely
manner.
• layout review
• safety studies
Formal reviews should be attended by all relevant disciplines, including operational personnel,
in order to obtain as broad an understanding as possible of potential hazards.
Hazards may also be identified by the individual in the course of his work. A key element in the
management of hazards is the establishment of an action tracking system. A log should be
kept of all actions arising from hazard identification studies, reports and project concerns so
that they can be formally held in a single data-base, tracked and eventually closed out, thus
ensuring that none is forgotten or ignored. This is called the Safety & Environmental Action
Monitoring System, or similar title, and is generally managed by the Safety Group within the
project.
Additionally, it may aid the management of hazards to compile a hazard register listing all
significant hazards, their cause, and how each is handled.
1.3.2 Causes
Causes of a release may be dropped objects, ship impact, intervention, fatigue, vibration,
extreme environmental conditions, imperfections, escalation from a fire, exceedance of design
conditions and human error. These causes are often referred to as initiating events.
Generic release scenarios based on historical evidence in the Gulf of Mexico [1.20] and the
UK sector of the North Sea [1.21] are listed below starting with the most credible:-
1. Pump Seal or Gasket Leak: Often represented as a 5 mm orifice or the annular space
between the flanges without a gasket or between the pump shaft and the case-less seal.
3. Medium Line or Partial Large Line: Often represented by a 50 mm orifice and evaluated as
a possible credible release scenarios especially when considering dropped objects.
4. Large Transfer Line & Vessel Nozzle Failure: Full pipe diameter. Rarely considered as
credible for design although frequently appears in loss databases. Evaluated usually for
off-facility or facility separation distance determination and emergency response planning
purposes.
• the operating and control philosophy, influencing manning levels and occupation
frequency the operating and control philosophy influencing extent of operator intervention
and the potential for human error and inventory loss.
Low consequence outcomes would be predicted where the overpressure level is predicted to
be relatively low and immediate and delayed consequences are also low. The equipment
count would probably be low, being limited to wellheads and manifold with no vessels (i.e. no
associated process pipework) resulting in low congestion and inventory. Confinement should
also be low, with no more than 2 solid boundaries including solid decks. Manning would be
consistent with a normally unattended installation with a low attendance frequency, less
frequent than 6-weekly, a 6-weekly visit by a maintenance/intervention crew results in
occupancy of a little over 1 %.
The SMS will demonstrate the means by which the organization’s safety policy is put into
effect. The structure of the SMS should comply generally with accepted standards from the
regulator and industry [1.22].
The safety management system SMS should specify the need for an HS&E Plan for all
projects where significant risk to personnel or the environment is possible. The HS&E Plan(s)
will define how health, safety and environmental issues will be handled throughout the life of
the project. More than one plan may be in place, covering different parts or phases of the
project. If this is the case an overall, bridging plan should be available to cover the interfaces
between the individual plans.
When hazards are identified with potential to give rise to risk to personnel or the environment,
in the first instance the aim should be to eliminate or minimise the hazard and the risks
associated with it. Thereafter the aims shall be (in order):
If risks cannot be eliminated and where risk to individuals falls below that which is
unacceptable but above the level of broad acceptability, then risks shall be reduced to As Low
As Reasonably Practicable (ALARP).
This Chapter provides the engineer with the means of managing the various factors which
contribute towards;
All of the above elements need to be underpinned by a commitment to safety from the
organization’s management at the highest level, with effective leadership to ensure that the
above elements are diligently carried out. The management needs to be aware of the safety
policy and aims and provide the necessary resources to ensure that these aims are fulfilled.
Organisation
Review Resources
Porcedures
Leadership &
Commitment
Implement Risk
Monitor identification
evaluation
management
Planning
Audit
The organization must define and document its HSE policy and objectives. These should;
Senior management should provide strong, visible leadership and commitment to HSE issues
and ensure that this commitment is translated into the provision of the necessary resources to
ensure that all the elements of the SMS as described above can be carried out effectively.
There should also be a driving force from management to achieve a continual improvement in
HSE performance. Project management should maintain a high profile for HSE issues
throughout the life of the project, with HSE issues featuring prominently at regular project
progress meetings and at meetings to all levels within the management hierarchy.
Effective leadership should also encourage involvement and participation in the HSE
management process at all levels. This should seek to promote each member of the design
team to look at the work he/she is doing and understand the effect it has, or may have, on the
overall HSE performance of the project and the end product. This should further encourage
each member of the design team to air any concerns they might have with regards to HSE
performance.
The issues noted above are also important when dealing with bought-in items and services,
the quality of work carried should match the standards expected from the company system.
The high standard of design and product may be compromised by the input of others.
If the supplier cannot give satisfactory information on these topics, they should be excluded
from the supplier approval process or be subjected to an audit to identify shortcomings and
preferably be coached to improve.
The Plan should reinforce the premise that HSE is a line management responsibility, that each
discipline and each individual is responsible for the safety and environmental impact aspects
of his work. The role of the Safety Group to police the work of others beyond the usual inter-
disciplinary review of outputs cannot be relied upon. Where hazards or potential benefits are
identified it is the individual’s responsibility to identify the scenario and ensure that it is
resolved.
The Plan should be approved by the appropriate representative of management and circulated
to all disciplines for them to cascade to individual worker level. All personnel should be aware
of the standards required with respect to safety and environmental issues and what their role
is in achieving this.
Resources in the context of competent personnel must be available during the following
project stages:
• concept selection stage, to have safety and environmental input to ensure that the
option chosen is the one with the lowest risk, as far as is reasonably practicable;
• FEED stage, to ensure that layout issues are handled to minimize explosion hazard
and risk;
• detailed design stage, to ensure that control and mitigation systems are
incorporated as necessary;
• throughout the design period to quantify as necessary the explosion overpressures
or fire loadings that may be encountered and the resultant risk.
Personnel undertaking the work should be suitably trained or experienced in the methods that
need to be used. With respect to explosions, suitable training is particularly important as new
research is continually developing fundamental information on the mechanism as well as
innovative means of control and mitigation.
Procedures
It is one function of the SMS, to ensure that activities are carried out in a correct and
consistent manner and at the correct stage.
It is a requirement that procedures and design guides will be available for engineers to follow
and consult at all stages of the project. They should state the methods by which the activity
should be carried out, by whom the work should be done and any Performance Standards or
criteria that should be met. Procedures for dealing with bought-in services should include the
assessment process for prospective suppliers and the acceptance criteria required to qualify
for the work.
Procedures should be available at key locations (for instance in the design office and with the
QA engineer) for consultation at any time. They should be regularly reviewed and updated as
necessary to include new systems or as a result of the findings from audits undertaken.
The concept selection and definition phases are traditionally the time in which the most
significant project decisions with respect to major accident hazards are taken. The majority of
these decisions have a significant influence on the hazards which must ultimately be
addressed by the engineering work and subsequently during the operational phase of the
project.
• Maximum safety leverage is available during the selection and definition phases.
• The cost effectiveness of safety effort expended during the selection and definition phases
is significantly better than during the later phases.
• The impact on project schedule of safety effort expended during the selection definition
phases is significantly less than during the later phases.
• Unsuccessful safety performance during the selection and definition phases may result in
failure to attain the maximum safety potential, or if it were to be attained it would be at the
expense of significant cost and schedule penalties.
Attainable
Safety
Performance
Successful Safety
Execute Input During Early Phases
Define
Select
The demonstration of ALARP is issue specific; it is recommended that the following general
philosophy be applied for addressing fire and explosion hazards on offshore facilities:
1. Establish and apply nominal explosion overpressures if available and fire loads as
appropriate to the potential fire types.
2. Utilize this Guidance to manage the fire and explosion hazards during the FEED and
detailed engineering phases.
3. For high and medium risk installations, develop an explosion simulation model and
continually update this model in line with design development.
4. For high and medium risk installations, develop a fire area assessment based on fire
types and platform vulnerabilities and continually update this model in line with design
development.
5. It should be noted that small bore pipework added late in the project may increase the
severity of the explosion overpressure. This may not be apparent until late in the
project.
Table 1.1 below summarizes the factors affecting fire and explosion risks by project phase
Project stage Design factors affecting fire and explosion hazards and risks
• Offshore processing content (amount of equipment and potential leak
and ignition sources)
• Offshore structure type
Concept selection and • Location of living quarters (may be carried over to FEED)
definition • Equipment layout
• Decks plated or grated
• Operation and manning philosophy (exposure of personnel to fire and
explosion risk)
• Philosophy for engineering, piping, etc.
• Deck sizing
• Nominal explosion loading
• Fire area sizing, firewall blast wall location
FEED
• Determination of constructability
• Element specific or low level performance standards set
• Safety Critical Element (SCE) categorisation – identification of high
criticality items
• Design for overpressures, dynamic pressures
• Finer points of layout
• Firewater and vent piping, location and schedule
Detailed design • Supports for safety critical elements determined
• Control systems designed
• Verification of constructability
• Assembly/writing of maintenance and inspection procedures
• Small bore piping runs located
• Changes to ensure constructability
Construction • Competence of construction
• Assembly of Decommissioning procedures and assurance of integrity
during decommissioning.
• Maintenance
• Inspection
Operation
• Change control
• Hot work procedures
• Implementation of decommissioning procedures
Decommissioning
• Implementation of disposal procedures
The management of fire and explosion hazards is a complex process and requires
contributions from a very wide range of people, plant and processes. These may be required
to prevent, detect control, protect or evacuate. It is not acceptable simply to manage each
aspect in isolation to default standards and to presume that this will give an effective hazard
management system. It is necessary to have a fully integrated process that ensures that all
hazards have the necessary components in place and that these components all work
together effectively.
The approach may be based upon the generic frameworks outlined in HSG 65 [1.22],
API RP 75 [1.24] or ISO 14001 [1.25]. These all use the standard 5 step hazard management
process.
In summary, the following steps should be taken within the hazard management system;
• Management responsibilities need to be accurately defined and clear boundaries for roles
and responsibilities set out.
• All fire hazards shall be identified, analysed and understood by everyone with a part to
play in their management.
• Every opportunity to minimise fire risks at source shall be identified, considered and
where practicable, implemented. This shall cover minimising the likelihood, severity and
the exposure of people and plant.
• A practical strategy to manage each of the hazards shall be identified, documented and
implemented.
• An appropriate combination of prevention, detection, control and mitigation measures
shall be put in place to implement the chosen strategies.
• A strategy should take account of sensitivity of the installation’s overall risk profile to fire
hazards and should weight the mitigation and control measures accordingly.
• All of these measures, including people, processes and plant shall be documented, have
clear ownership and shall have minimum performance standards
• All causes shall be identified, understood and sufficient effective prevention measures
shall be implemented.
• Where the effects of failure could require evacuation of overwhelm the installation, these
measures shall be specifically identified and shall be of high integrity.
1.5.2 Policy
Each company should have a coordinated set of policies which cover the principles listed
above and the means by which they are implemented and assured. Policies may be
considered at four levels of increasing detail and specific application:
Corporate policies: These should set the overall ethos of the company, its overall stance with
respect to HSE and its public expression of commitment to the protection of its personnel and
those with whom it interacts. It should set an overall standard of risk tolerability. This may be
an expression of individual risk covering all types of exposure including occupational and
major hazards risk. The organisation may also choose to set tolerable risk criteria for major
hazards which may result in multiple fatalities. Most organisations should also demonstrate a
commitment to continuous improvement. Corporate goals may also be set stating how the
business should be organised and run in pursuance of their risk criteria. It may also set
minimum standards relating to design and operations such as the requirements for the use of
codes and standards.
Regional and/or business policies: These should apply the overall corporate criteria to that
business or region and set minimum standards. This will relate to the development of risk
assessment processes and the criteria for acceptance in a wide range of activities from
discipline engineering applications such as structural assessments and instrument criticalities
to operations. The regional and/or business policies should set the framework for applicable
management systems, and set the minimum technical and operational standards which apply
across that region of business.
Other specific requirements: These would be the minimum standards for specific items of
plant, competence, or any systems needed to manage hazards effectively.
1.5.2.1 Planning
Planning covers five specific items and these apply both in design and in operation;
1. The identification of the hazards and the analysis to give the understanding outlined in
the hazard management principles;
3. The assessment of the risks from the hazards based on the chosen strategies and the
performance of the elements chosen to reduce risks to ALARP;
4. The assessment of the business infrastructure and resources needed to implement the
strategies both initially and thereafter to maintain them;
5. The documentation and communication of the hazard knowledge, the strategies and
the measures needed to implement them;
The planning process must be organised so that the understanding of hazards is in place
before key decisions are made rather than using it to retrospectively justify them. In design,
this requires the early development and resourcing of the risk assessment and management
process through the use of an HSE plan. It also needs commitment from the project managers
to ensure that this proactive culture flourishes and that everyone uses this information to
optimise the design. This includes the discipline engineers, particularly process and layout
who have the greatest opportunities to maximise the inherent safety. The specialist risk and
safety engineers should act in support of these disciplines in furtherance of a safer design
rather than as a discrete and independent group providing data for regulatory compliance.
Operations should be represented both to provide their knowledge of the causes and risks and
to agree the hazard strategies.
Typically the HSE plan will include each of the following activities for each of the project
stages:
Detail design:
• Design of the systems to meet the Performance Standards;
• Preparation of the operational procedures.
1.5.2.2 Implementation
Putting the hazard decisions into practice and maintaining the minimum standards throughout
the lifecycle requires the provision of a suitable and supportive business infrastructure. The
infrastructure applications should include but not be limited to design engineering, integrity
management, procurement, HSE, training, emergency response. The requirements arising
from the planning process should be embedded into each business process. This should
include the identification or cross referencing of elements critical to hazard causation and/or
management and the correct documentation of the applied hazard management process.
The operational procedures and controls developed at earlier stages of project development
should be developed in conjunction with the designated operating team. The procedures
should cover the prevention of accidents and management of incidents. The emergency
response plans should acknowledge the potential hazards and their escalation.
1.5.2.3 Measurement
Measurement should include the verification that the hazard identification, analysis and
management process has been thorough, is complete and of adequate quality. Thereafter,
there should be confirmation that it is working, that there is a widespread understanding of
risks and hazards, that the linkages between hazards and critical elements are in place and
that the resourcing and infrastructure are sufficient. At a more detailed level, there should be
confirmation that the design of the plant is appropriate and that the proposed standards of
performance for people, processes and plant are being met.
The review should examine trends from the measurement processes. It should be consider
how the overall risks are changing including the specific performance history of plant, changes
in personnel and their acquired competence. It should give structured proposals for investment
in future risk reduction.
• all fire and explosion hazards have been identified, analysed and are understood;
• overall risk from all major accidents including fires and explosion are assessed, and
are "as low as reasonably practicable" (ALARP);
• fire and explosion risks are defined as the risks from the initiating event and
subsequent escalation;
• an appropriate combination of prevention, detection, control and mitigation systems
are implemented and maintained throughout the lifecycle of the installation;
• the systems provided to protect personnel from the effects of fires and explosions
are suitable for these hazardous events and have Performance Standards
commensurate with the required risk reduction;
• the design, operation and maintenance of the systems will be undertaken by
competent staff who understand their responsibilities in the management of the
hazards and possible hazardous events;
• any changes to the installation which may effect the likelihood or consequences of
fires and explosions are identified, assessed and the systems revised to take the
changes into account as necessary.
• that one escape route to the Temporary Refuge (TR) remains functional at all
times;
• the TR and its supports will maintain their integrity in all design explosion events;
• that a means of evacuation to be available at all times;
• that all large off-site inventories are isolated in the event of a design explosion
event.
• the ability of personnel to escape from, and to shelter safely from the effects of an
explosion event and the ability to evacuate to a safe location where recovery can
take place is not compromised.
Effective, economic FEHM depends on the appropriate timing and use of resources This can
be achieved by following the principles for identification and assessment of the foreseeable
hazardous events, see Section 3.1, and for selection and specification of safety systems see
Section 9: This approach is structured around the life cycle concept described in Section 2.10.
• fire and explosion assessment should commence very early in the design and should be
used as one of the bases of hazard management throughout the installation lifecycle;
• the principles of inherent safety should be applied early in the design so as to eliminate or
reduce hazards so far as is reasonably practicable;
• resources should be assigned to systems taking account of the risks from the hazardous
events and the role of the system in reducing them;
Appropriate standards and accepted industry practice are tools to achieve and demonstrate
reasonably practicable risk reduction. These should be appropriate to the hazards and
hazardous events on the particular installation so that they contribute significantly to the
reduction of risk.
When concentrating on the primary risk contributors, care should be taken not to miss
reasonably practical ways of reducing the risk from apparently less serious events.
Risks closer to the unacceptable region merit a closer examination of potential risk
reduction measures
• High level Performance Standards can be applied to the organisation, the installation as
a whole or to the major systems on the installation (e.g. the Temporary Refuge or the
process system).
• Lower level Performance Standards may be used to describe the required performance
of individual systems or components (as necessary) which contribute to the high level
Performance Standards.
Performance standards at this level may relate to the principal systems, used to detect, control
and mitigate fires and explosions. However whatever performance standards are selected,
three key characteristics should apply.
1. The selected items should make a significant contribution to the overall acceptability of the
arrangements for managing fire and explosion hazards.
2. The parameters constituting the Performance Standard should be directly relevant to the
overall achievement of the system goal
The process of setting the more detailed low level Performance Standards therefore involves a
review of the required performances under the anticipated emergency conditions of the
systems, sub-systems or equipment that make up the fire and explosion arrangements. The
review should identify those items that make the most significant contribution to the overall
acceptability of the arrangements. It is necessary to identify those items where significant
performance deviation would jeopardise the arrangements to the extent that the strategic
objectives set for the installation would not be satisfied. It is also important when undertaking
this review to determine what effective barriers to the occurrence of a particular hazard are
provided. The number and integrity of these should take into account the magnitude of the
hazardous event and the likelihood of the initiating event in the absence of these barriers. The
assessment should indicate the most important factors contributing to the success of the
system.
One such hierarchy of Performance Standards that has been used in the industry is;
1. Risk-based Performance Standards (describing the high level goal in terms of a statement
of risk);
Performance Standards are particularly important and are a UK statutory requirement for
defining the performance of elements that contribute to the management of a specific hazard.
Criticality 1 Items whose failure would lead direct impairment of the TR or emergency
escape and rescue (EER) systems including the associated supporting structure.
Performance standard – These items must not fail during the DLB or SLB, ductile response
of the support structure is allowed during the DLB.
Criticality 2 Items whose failure could lead to major hydrocarbon release and escalation
affecting more than one module or compartment. (Indirect impact on the TR is possible
through subsequent fire).
Criticality 3 Items whose failure in an explosion may result in module wide escalation, with
potential for inventories outside the module contributing to a fire due to blowdown and or
pipework damage.
The features of an effective Safety Management System (SMS) are identified and the choice
and management of detection, control and mitigation systems is discussed. The main
characteristics of the fire hazard are also identified. The techniques of inherently safer design
described in Section 2.7 are fundamental to the most effective approach to eliminate, prevent
and mitigate the fire hazard particularly for new designs.
In order to focus effort where it is most needed, a risk screening method is described in
Section 2.8 which classifies installations and compartments according to the level of their fire
risk. The measures for frequency and consequence severity are based on process complexity
and the exposure potential for people on board. These measures are combined in a risk matrix
to give low, medium and high risk categories. The risk level is an indication of the level of
sophistication to be used in the fire assessment process.
Nominal loads for jet and pool fires have been available since the publication of the Interim
Guidance Notes (IGN) [2.1] in the form of heat fluxes for engulfed objects in open conditions.
A number of alternative values have since been published including nominal fire loads for
confined and ventilation controlled fires [2.2]. Updated guidance on the selection of fire loads
is given in Section 5.4 with recommendations on the limits of applicability.
• suitable accidental loads are developed (either risk based and/or prescriptive);
• plant and equipment minimises escalation, personnel within the TR do not continue to be
threatened by the incident, until such time as the hazard has dissipated to a safe level via
shutdown, blow down, or other means;
• personnel are able to escape to a safe location away from the hazard.
The identification of key SCEs and corresponding Performance Standards provide the
demonstration that such a philosophy has been met.
Performance objectives and measures allow the designer of fire systems more flexibility in
meeting requirements and can result in significant cost-savings compared with the prescriptive
approach. Conversely, for small projects, the cost of performance based design may not be
cost-effective.
In a scenario or performance based approach release scenarios are postulated and their
consequences and probabilities of occurrence determined. For existing installations, reliable
estimates of fire loads, extents and durations may be available from previous assessments.
The most severe fires from the point of view of initial rate of release may be less frequent and
less durable than fires of lesser severity and hence may present a smaller risk. Although the
initial extent of the engulfed region may be greater, the lower duration may result in lower
quantities of heat being delivered to those equipment items and structural members within the
affected region. However, it is important to account for apparently small fires that on initial
evaluation do not appear to have the potential for escalation. Dismissing such ‘small events’
can distort the Installation’s risk profile.
• severe, but unlikely cases which give short duration fires with the potential for the
maximum number of immediate fatalities
• small long duration scenarios which still have sufficient size to cause local escalation.
• intermediate scenarios which have the greatest potential for escalation or platform
impact whilst lasting long enough to realise this potential.
Design or Dimensioning fire scenarios are selected on the basis of the risk they present and
should be accommodated by the safety critical elements (SCEs) of the installation which will
include parts of the structure, piping and equipment.
It is suggested in this Guidance, that the number of SCEs which need to be considered in
detail is reduced by classification into criticality categories with respect to the fire hazard.
The direct consequences of fires are immediate fatalities or delayed fatalities by the blockage
of access ways by radiation or the development of a hot gas layer, smoke and fume
generation, structural weakening and possible collapse. Further escalation through
subsequent release of inventory may occur.
An acceptable level of risk can be identified within the ALARP framework, which identifies the
acceptable frequency of exceedance of the severity of the design or dimensioning scenarios.
Typically this frequency of exceedance will be of the order of 10-4 to 10-5 per year depending
on the risk to people on board, the impact on the SCEs and the overall individual risk including
that from other hazards.
Following NORSOK [2.3], ISO [2.4] uses a threshold probability of exceedance level (10-4 per
year) below which individual contributing scenarios need not be considered further if the
impact on personnel is low enough (i.e. numbers of personnel affected). Events with
probabilities above this level are considered to be ‘Dimensioning’, and require further analysis
to determine the size and extent of the resulting loading and subsequent effects.
This Guidance proposes a similar approach, albeit couched in different terms. An event will be
considered depending on whether the event impinges directly on the Temporary Refuge with
probability of exceedance > 10-5 per year. Events directly affecting other regions where a
barrier may be present to prevent impingement on the TR are considered if the probability of
exceedance is greater than 10-4 per year.
Senior Management: They need to know the overall level of risk for the facilities to decide if
the design is viable or if existing operations may continue.
Project or Facilities Management: They need to know the pattern of risk by facility and the
proportion of that risk which comes from different hazards such as fire. This will allow them to
decide how the facilities are to be designed and operated. It will also allow them to provide
sufficient resources.
Discipline Engineering and the Supervision of Operations: They need an overall understanding
of all the hazards for which they have responsibility. The understanding of the causes, severity
and consequences will allow them to decide how each of the hazards will be managed and the
measures needed to do so.
Designers, Operators and Technicians: They need to understand the hazard characteristics so
that they may design, operate and maintain critical elements to suit the needs of the hazards.
It is essential that the information gained from hazard and risk studies is distilled, documented
and communicated so that every level and person is kept informed. It must also be kept up to
date. It is a living picture which becomes progressively more detailed and accurate as the
design progresses. It also changes throughout the life of the facilities as different activities take
place and the fields mature.
For an explosion to occur a gas cloud with a concentration between the upper flammability
limit (UFL) and lower flammability limit (LFL) must be ignited and amongst other contributing
parameters, the overpressure caused by the explosion will depend upon:
5. The congestion or obstacles within the cloud (size, shape, number, location)
7. Ignition timing
Confinement is defined as a measure the proportion of the boundary of the explosion region
which prevents the fuel/air mixture from venting which is the escape of gas through openings
(vents) in the confining enclosure.
Congestion is a measure of the restriction of flow within the explosion region caused by the
obstacles within the region.
Gas explosions in more open environments can also lead to significant overpressures
depending on the rate of combustion and the mode of flame propagation in the cloud. All of the
above points from 1 to 5 can affect the explosion overpressures in this type of environment.
Two types of explosion can be identified depending on the flame propagation rate:
Most vapour cloud explosions offshore would fall into the category of deflagrations.
A typical vapour cloud explosion on an offshore installation would start as a slow laminar flame
ignited by a weak ignition source such as a spark. As the gas mixture burns, hot combustion
products are created that expand to approximately the surrounding pressure. As the
surrounding mixture flows past the obstacles within the gas cloud turbulence is created. This
turbulence increases the flame surface area and the combustion rate. This further increases
the velocity and turbulence in the flow field ahead of the flame leading to a strong positive
feedback mechanism for flame acceleration and high explosion overpressures.
Large components of the structure such as solid decks or walls experience loads due to the
pressure differences on opposite sides of the structure. Typically within an explosion there will
be a strong variation of pressure in space and time. There will typically be localised high
regions of overpressure with lower values of average pressure acting on large components.
The overpressure at a location within a gas explosion will typically rise to a peak value and
then fall to a sub atmospheric value before returning to zero overpressure.
The duration of the positive phase in an explosion can vary greatly with shorter durations often
associated with higher overpressure explosions. Typical durations range from 50 to
200 milliseconds with longer durations common in large open areas such as the decks of
Floating Production, Storage and Offloading vessels.
For smaller objects, such as piping, the overpressures applied to the front and reverse side of
such items will be of approximately the same magnitude at any moment in time and in this
case the overpressure difference will not be the only load component on the object. For this
type of object the dynamic pressure associated with the gas flow in the explosion will
dominate.
Secondary, external explosions may result as the unburnt fuel/air mixture comes into contact
with the external (oxygen rich) atmosphere. These can affect the venting of the compartment
and enhance the overpressure within.
A blast wave will be generated which will propagate away from the explosion region and may
impinge on adjacent structures.
Catastrophic: As the name suggests, these events would overwhelm an installation and it
would be impractical to counteract the effects such that the lives of those on board could be
saved. This type of event should be designed out or very high integrity preventative measures
provided such that the likelihood is minimised.
Evacuation/Extreme: This type of event would have a major impact upon a large part of the
installation such that the effects upon people, both physical and psychological, would be such
that evacuation would be necessary. It would also apply to those events where the potential
for escalation is widespread including structural, process, safety systems or the impairment of
muster and escape routes. Typically these events are those which would give prolonged
effects beyond the source module, in particular external flaming and dense smoke effects. In
some cases it may be possible to suppress the widespread effects of these fires reducing the
categorisation to the lower, controllable, level. If not, the effects must be fully understood and
premature catastrophic escalation delayed, and personnel protected from smoke and heat
until evacuation has been completed. By their nature these are inherently low frequency
events, requiring a significant sized release from a major inventory and/or its combination with
safety system failures such as ESD.
Controllable: These events have the potential for local fatalities and may also be capable of
escalation to a scale requiring evacuation. However, the moderate scale of the effects should
allow these events to be controlled such that further escalation is prevented and evacuation is
not essential to preserve life. Typically, the prolonged effects of these events will be limited to
one module or process area and will be of finite duration. They would be associated with
smaller releases from moderate inventories. In these cases effective control of the source
inventory and the prevention of escalation will be critical. It may be practical to extinguish
some of these events but in other cases, this may not be possible or may be dangerous in
which case, they should burn out under controlled conditions.
Minor: These events are of a very small scale. They may cause local injuries but would not
have either the scale or duration to cause critical escalation. They may lead to damage to
plant causing financial loss but not major loss of life. These events can be managed by limiting
the size of the event and allowing it to burn out. Protection would only be needed for asset
protection.
The causes of hydrocarbon releases are numerous and it is essential that a full causation is
carried out so that effective preventative measures can be put in place. These causes can
generally be broken down into three categories:
3. systemic failure; i.e. inherent weaknesses in the business processes and infrastructure
supporting design and operation.
Lack of maintenance, particularly over long periods may distort the understanding of the
underlying causes of failures. Effective maintenance regimes are essential to determining the
likelihood of plant failures.
The likelihood of an event is a function of the propensity of the causes; e.g. the corrosivity of
the fluids, the number of times containment is deliberately breached or the number of weak
points such as flanges or tappings. It is also a function of the understanding of those causes
and the effectiveness of measures which are put in place to manage them.
Statistical data form a good start point from which to list causes and to determine likelihood.
This should then be augmented with the knowledge of engineers, technicians and operators to
give a more accurate picture for each facility. HAZOP procedures will give a rigorous
identification of process causes but the overall examination should be sufficiently broad to
address external and human effects. This examination should be fully documented so that
there can be assurances that preventative measures are suitable and sufficient.
For statistical data, the most frequent sources of the hazard as given by the history of releases
experienced to date are documented as follows.
The HSE document OTO 2001 055 [2.5] states that for the UK sector of the North Sea:
Of the causes;
It is considered that 40 % of equipment related releases are attributable to poor design and
38 % to inadequate inspection and condition monitoring.
Sources of release data include WOAD [2.6], OREDA [2.7] release statistics published
annually by the HSE and UKOOA [2.8, 2.9, 2.10 and 2.11]. The Minerals Management Service
(MMS) of the US also publishes data on incidents on the Gulf of Mexico.
• The rate and duration of the release and the size of the consequent gas cloud
• The type of fuel and the proportion of gas or volatile vapours which is generated in the
short term
• The nature of the release; whether high or lower pressure. The turbulence caused by
high pressure gas releases will cause effective mixing with the air to give a well defined
flammable cloud. High pressure liquid releases will encourage fine droplet formation
and increase the vaporisation of any light ends.
• The flammability characteristics of the gases and vapours. Each different gas or vapour
has a specific flammability range, from a lower flammability limit; through stoichiometric
and rising to a higher limit above which ignition should not occur. Very large releases
may have a non flammable rich core but will be surrounded by a flammable region
which may engulf ignition sources as it spreads away from the point of release. Each
gas or vapour will also have a specific auto ignition temperature ranging from
200 - 550 °C. such that contact with hot surfaces such as an exhaust turbocharger
would cause ignition
• The dispersion characteristics; whether there are heavy vapours which will descend or
lighter gases which should rise.
• The confinement of the escaping vapours and gases by floors, ceilings or walls. These
may also cause flammable gases to be directed towards areas without flameproof
equipment
• The ventilation characteristics in the areas, whether forced or natural and the variation
of those characteristics with wind strength and direction
• The characteristics of the fluid and its release, where this might build up static
• The presence of sulphurous impurities in the fluids which might lead to the formation of
pyrophoric scale
• The number of fixed ignition sources and the standard of their maintenance, if
designed for use in flammable atmospheres, including the presence or not of Ex
equipment.
• The proximity of the release to areas which are classified as “safe” and therefore are
not fitted with flameproof equipment.
• The detection of gas ingress at the air intakes to enclosures such as accommodation
or equipment rooms and the closure of dampers.
• The hot work philosophy on the facility, the number of these activities and the
effectiveness of their control.
• The possibility of ignition being caused by the action of personnel carrying out
emergency response actions such as plant shutdown causing sparks at electrical
breakers.
Ignition probabilities have been widely studied and this work is summarised in recent work for
UKOOA studying ignition probabilities [2.12]. The probability of ignition should be determined
using that guidance together with an assessment of the characteristics listed above. As with
the likelihood of release, it is possible to influence the probability of ignition by design, good
maintenance and operational controls.
2.6.4 Likelihood
The likelihood of an explosion will depend upon the likelihood of occurrence of a gas cloud and
delayed ignition. The following parameters will influence the potential likelihood of an
explosion:
• hazardous inventory complexity, i.e. the number of flanges, valves, compressors and
other potential gas leak sources;
• the type of flanges, valves or pipework, some generic types of flange tend to have lower
leak frequencies associated with them, e.g. hub type flanges;
The likelihood considerations tend to align closely with the consequence factors in that the low
consequence installations will tend to be small and therefore less complex. Large installations
will have more potential leak and ignition sources and therefore a greater requirement for
intervention and maintenance.
Low event likelihood installations and compartments will have a low equipment count. The
frequency intervention of 6 weeks or more is also recommended as a criterion as this will be a
surrogate for equipment count and reliability as well as a measure of maintenance risk with
respect to explosion.
Medium event likelihood is suggested by an NUI with equipment count greater than for the
‘low’ case. Similarly, where the planned frequency of maintenance/intervention is greater than
a 6-weekly basis then this suggests a higher or less reliable class of equipment with medium
level of potential for explosion.
Key parameters would include the range of release rates and characteristics which can
originate from any part of the plant. Each parameter would be associated with a failure causing
a specific hole size. The release rate would then vary with time depending upon the source
conditions of fluid, pressure, inventory, location within the hydrocarbon system and the
functional characteristics (or the failure) of control systems such as ESD, depressurisation,
and drainage.
A detailed picture of the source terms from each inventory will allow the identification of the
cases requiring analysis of the fire characteristics. If hazards are being classified as described
above, it will give an initial indication which hazards fall into each category. It would show for
example the process events which simply do not have sufficient inventory to realistically cause
escalation, those which should be controllable and the events which require evacuation. For
individual hazardous inventories, it would show the approximate conditions of hole size and
control system operation which would determine whether it was controllable or require
evacuation.
Large continuous releases from the Christmas Trees are much less likely due to the multiple
valve isolation. They may occur during wire lining but only if there are multiple failures of the
barriers. A more realistic scenario is a release from the lubricator via leakage through the
valves and wireline BOP. In gas-lifted wells, it is possible that the gas within the annulus could
backflow into the wellbay with typical inventories and pressures of up to 10 tonnes and up to
130 bar. The potential for escalation to other wells should be examined but is unlikely if they
are fitted with effective downhole isolation or have a heavy-duty integrated Christmas Tree
valve assembly. Flowline releases are considered to be part of the process hazards as they
are downstream of the well isolation valves.
Production fluids manifolding and mixing: The manifolds collect the reservoir fluids from the
wells via the flowlines, mix the fluids and direct them to the appropriate separators. They
contain well fluids (see below) which may be a mixture of oil, condensate, gas, water and other
materials such as sand. The inventory will be based on the combined volumes of these pipes.
It will range from less than 500 kg in a mature, low pressure gas field up to 5 tonnes of oil for a
new field. In oil facilities running at low pressures or using gas lift, the fluid can be three phase
with a relatively low density. It may also have a high water cut giving small inventories which
may not have the potential for escalation if rapidly isolated. The process conditions,
aggressive nature of the fluids and the complexity of the piping give a relatively high probability
of a release, particularly large bore flowline failures which may be caused by corrosion or
erosion. Potential process backflows of gas and 2-phase fluids from the gas lift inventories into
topside blowdown systems also needs to be addressed when analysing topside hazards.
Water, gas and oil/condensate separation: This takes place in large vessels, generally over
2 – 3 stages. The liquids have a 3 – 10 minute residence time. Typically, these vessels have
total volumes up to 100 m3 and operate at pressures from 70 down to 3 barg. The flammable
liquid inventories can be up to 30 tonnes but this may be divided in half by weirs which can
reduce the amount which can realistically be released by half. There are relatively few release
points providing that there is effective isolation at the outlet. Typically these are tappings for
instruments and the possibility of corrosion in the body or welds of the separator vessel. These
liquid inventories have the potential to overwhelm a moderate sized platform with a large fire
lasting long enough to cause major escalation, particularly if the separators are located lower
down in the topsides. They may have less of an impact if located on an open deck such as an
F(P)SO as the smoke and flames can freely rise above the rest of the facility. The potential for
harm is governed by the release pressure; see below under liquid fires. If these vessels are
depressurised, the fires become much more controllable and the time to depressurise is
critical. If they can brought below this pressure before escalation can occur or evacuation is
required, this may reduce the classification of these hazards to the controllable level, at least
for moderate sized holes.
The free gas inventory will range from 200 kg for a very low pressure vessel to 5000 kg for a
very high pressure vessel with high molecular weight gas. Typically it will be in the
1000 - 2000 kg range. However this may be doubled by additional gas released from the
liquids as the vessel depressurises. This inventory has the potential to cause local escalation
but is unlikely to overwhelm a medium sized facility. Its potential for harm may be minimised
by depressurisation.
Stabilisation and final dewatering: Some oil production platforms have a final stage of
stabilisation or dewatering. These require large vessels which are filled with virtually stable oil
plus a small quantity of water in the bottom. They operate at 2 – 6 bar and can contain up to
200 tonnes of oil. These lower pressures would result in a pool fire which would only be a
Oil/condensate pressurisation for export: Export pump arrangements may use one or two
pumps in series. These pumps are usually duplicated with manifold arrangements. These
complex piping arrangements can give an isolated inventory of up to 15 tonnes for a field with
large throughput. The most likely releases are at the pumps themselves but the study of
available inventory should carefully examine how much could realistically be released, taking
into account the operating philosophy standby arrangements for off line pumps and the
provision of valves and check valves. The pump pressures will range from 40 – 120 bar
depending upon the pressures within the pipeline infrastructures. Transfer pumps to export
tankers will run at much lower pressures. These pressures will drop to the vapour pressure of
the oil on shutdown, giving a continuous rate of release until the available inventory is
exhausted.
The pump seals and the complex jointed piping lead to a high likelihood of a release. The
inherent design of the plant requires the pumps to be located close to the lowest level of the
platform, often beneath the separators. This will lead to a low level source with the potential for
low level external flaming, smoke affecting most of the topsides and escalation to the
inventories above. Shutdown of the pumps and careful management of the inventory which
can be released will help to reduce the impact but it may still require evacuation in some
cases.
Gas compression including gas liquids condensing and knockout. Gas from the various stages
of separation is progressively compressed and cooled allowing liquids such as ethane,
propane, butane and water to be condensed and returned to the liquids system. Typically
several compressors will be required with the final discharge pressures of 50 - 60 barg. It is
likely that the compressor sections and their associated condensers and knockout pots will be
sectionalised with ESD valves. This reduces the gas inventories to 1000 - 2000 kg. As with
separation, this has limited potential for local escalation and this can be minimised with
depressurisation. The major risk is that to personnel in the immediate area from flash fires or
from explosions if the area is congested. There is a moderately high possibility of a gas leak
arising from the compressors and associated vibration.
The liquids which are condensed and collected in the gas knockout pots may be either
liquefied gases or water. The gas-liquid inventories should be less than 2 tonnes and in many
cases, just a few hundred kg. Only the larger inventories will have the potential for escalation.
However, there is a major exposure to flash fires or explosions as these liquids are very
reactive, will have a high release rate and the vapours may not disperse easily. The likelihood
of release should be low as there are few release points in the liquid sections of these process
plants.
Gas drying: This will use either glycol units or molecular sieves and can operate at up to
60 bar. The largest inventory is likely to be a contactor with up to 3 tonnes of gas. Again, this
has a limited potential for local escalation and can be minimised using depressurisation.
High pressure export, gas lift and reinjection compression: A typical pressure for these
systems is 150 barg. However it can be as high as 400 barg for some reinjection
requirements. Again, the inventories will be moderate; typically 1 – 3 tonnes with the potential
for local escalation. However, the high pressures can give high release rates from moderate
hole sizes, increasing the risks from flash fires and explosions.
Oil and gas metering: Metering is generally carried out using inline flow meters. From a
hazard’s point of view, they are equivalent to piping with additional potential release sites at
Identification of the inventory of each process section should be carried out to determine the
conditions and inventory during operation and immediately after shutdown. The behaviour of
each section should be modelled using simple calculations to determine the gas and liquid
release characteristics from a range of hole sizes. The intent is to build up a picture of the
types of events that can occur in each part of the platform. These scenarios and associated
hole sizes should reflect the failures which have been identified during the causation analysis.
They should be sufficiently varied to cover the following; those large but unlikely cases which
give short duration fires with the potential for the maximum number of immediate fatalities;
those small long duration cases which still have sufficient size to cause local escalation; and
those intermediate cases which have the greatest potential for escalation or platform impact
whilst still lasting long enough to realise these effects – typically a 10 minute duration.
• Closer to sea level where they may be exposed to ship damage or chafing and
corrosion;
• Sub sea or at the sea bed where it may be subject to internal corrosion.
The location will affect the release characteristics and the ignition probability. Release rates
from these pipelines may initially be modelled using simple calculations, the Sintef and
Scandpower fire calculations for the process industry [2.13] or using more sophisticated
methods. They should be based upon the hole sizes which could realistically occur as
identified in the causation analysis. The modelling should cover cases with and without the
operation of subsea isolation valves or confirm where these are fitted or considered. They
should take into account time delays in the operation of ESD valves and their operability with a
high differential pressure following a major riser failure. Data such as valve closure times and
internal leak rates should be derived from platform specific datasets. Information from
incoming ESD valve trips, routine tests and maintenance will give a more accurate picture of
equipment performance than generic information from generally available databases. ESD
valves would not respond quickly enough to prevent the immediate fatalities rising from a
major gas riser failure unless there was delayed ignition. The characteristics of pipeline
releases from two phase fluids or liquids with dissolved gases should take into account the
variation in release characteristics caused by; gas and liquids separation, slug flow, the
elevation of the release point relative to the main inventory on the sea bed, and effervescence
as gas separates carrying with it liquids in aerosol form. In some cases such as subsea
releases, the fires may burn on the sea surface, see Section 5.2.4.
Liquid fires generally have a greater potential for harm than gas fires for the following reasons:
They have greater isolated process inventories arising from the higher densities of between
600 and 850 kg/m3. Typically these can be up to 20 – 30 tonnes in separators.
The heat fluxes from pool fires will be lower than gas jets but pressurised oil or gas liquids,
particularly with dissolved gas can give the same or greater radiative heat flux.
A moderate sized oil leak of 20 mm at 20 barg would have a flame volume of 4500 m3 and this
has the potential to completely engulf a medium sized process module and cause some
external flaming. A 20 tonne inventory would sustain this fire for 30 minutes assuming a
constant release rate.
This confinement with a roof and/or walls will also cause high radiative heat fluxes, even with
pool fires.
Liquids tend to be located at the lower levels of a platform which causes the fire source to
have a greater impact on the facility, engulfing the levels above and to the sides in flames and
smoke and also leading to the exposure of structures, people and plant above it.
Liquid releases can be difficult to detect if there is only a small gas content and this can lead to
a build-up of oil on the floor, possibly spreading to lower levels prior to ignition. This can
exacerbate the effects by increasing the total fuel quantity, the initial fire size and its spread
into more vulnerable locations.
The effect of increased water cut of the hydrocarbon from the reservoir on fire hazards should
be considered carefully to avoid over-conservatism in the fire risk analysis. For example, some
researchers consider that water cuts above 60% make the oil very difficult to ignite.
These potential effects can give liquids the potential to overwhelm a platform giving many
cases which could be classified as evacuation/extreme, even with moderate pressures and
hole sizes on a poorly laid out facility.
The fire characteristics will vary according to the release pressures and the fuel type. Most oil
is only partially stabilised; i.e. it will have some dissolved and liquefied gas within it. It will also
be pressurised; by the inherent state of the fluid (its own vapour pressure); by the pressurised
gases above the liquid as in separators; or through pumping. The pressure will determine the
release rate and the management of that pressure after the fire is detected is a key component
of managing these hazards. This may be achieved by isolating the pumps or by
depressurisation. The release rate is proportional to the square root of the pressure and will
reduce as these actions come into effect. Equations for calculating release rates are given in
the Handbook for Fire Calculations and risk assessment in the process industry, by Sintef and
Scandpower [2.13], reference should also be made to the Phase 2 Blast and Fire Engineering
for Topside Structures [2.14]. The pressure will also determine how the liquid will burn, for
example, as a spray or a pool. The heat fluxes will drop with the pressures and this allows
deluge systems to become more effective both in protecting exposed plant and in suppressing
the fire itself, this is discussed further in Section 10.3. Lighter liquids such as condensate will
have lower transition pressure. Gas liquids; ethane, propane and butane will be pressurised
and it is unlikely that their operating temperatures will ever be low enough to allow them to
burn as a pool. They are only likely to be found in moderate quantities of 1 – 2 tonnes within
the gas compression and drying facilities. An additional issue to be considered is the potential
escalating effect of flaming “rain out”; this can occur at ambient temperatures, especially with
butane (also propane) and especially for the scenario of jet flame impingement on an
obstruction, the next section discusses further detail of jet fires.
Gases will give rise to an intense jet flame with high localised convective and radiative heat
fluxes. The radiative content will increase both with the molecular weight and as the jet
encounters obstructions. They are generally not large enough or sustained by a sufficiently
large inventory to be significantly affected by confinement within a roofed module except
where they directly impact the ceilings or walls. This makes their potential for escalation highly
directional and this is likely only to affect a small number of critical items such as a single
structural member, part of a vessel or some piping. Only very large inventories would have the
potential for more widespread simultaneous failure. These large inventories require both high
pressures and large volumes within the process plant or an isolation failure to a primary
source such as a riser or well.
Gas jets have moderate release rates unless there are very large hole sizes and/or high
pressures. A 20 mm hole at 20 barg would give a methane jet of approximately 10 - 12 m and
a flame volume of 100 m3. With a source of 40 m3 in volume, typical of the gas content in a
separator, this would reduce to a jet of 7-8 m and a flame volume of 25 m3 within 10 minutes of
the ESD operating. If the separator was depressurised, this would decay even faster but this
may be offset by the disassociation of dissolved gas in the oil.
The presence of walls, ceilings, floors and obstructions will significantly affect the way in which
air can mix with the fuel. They will also affect the flame shape. These two factors will change
the heat fluxes, the efficiency of combustion and the density of smoke.
The air requirements for stoichiometric burning of hydrocarbon fires are between 15 and 17
times the mass burn rate of the fuel. In most cases, this is the release rate unless there is
containment of a pool fire to reduce the burn rate. Most modules have good ventilation and
venting to minimise gas build-up and explosion overpressures respectively. The air input rate
through a single opening in a wall is calculated using the formula Ma = ½A √H where Ma is the
air input rate in kgs-1, A is the area of the opening in m2 and H is the height of the opening in
m. With openings in the floors and ceilings or multiple openings in the walls of different
heights, this becomes a complex calculation. Typically the fuel burn rate that can be sustained
by a module with one open wall of 30 m by 8 m is 21 kg s-1. It is unlikely that severe ventilation
limitation will occur unless there is a very high release rate and this is sustained for several
minutes. If it does occur it is likely to involve a major liquid inventory rather than gas fires. If the
ventilation is severely limited, then the combustion characteristics within the modules will be
affected with reduction in heat flux, reduced liquid vaporisation rates, combustion instability,
very dense smoke with high concentrations of carbon monoxide. Unburnt vapours may also be
ignited as they leave the module giving the external flaming described below. It can take a few
minutes before the fire becomes ventilation controlled as the air inside is consumed.
It is more likely that a large fire will not be ventilation controlled but that its size will simply
exceed that of the module. Once the flame volume reaches 1/3 of the free volume in a module
(i.e. that volume up to the top of the highest opening and excluding the volume in between the
ceiling beams), then the flames will spread across the ceiling and begin to extend beyond the
module. In the initial stages of these fires, the flames build up across the ceilings with a hot
flame layer slowly descending across the whole module. This is the neutral plane at which air
entering the module mixes with the vapours. This can descend to 2/3 of the way down the
openings in the walls with significant flame velocities as they travel towards the openings.
These areas will have high radiative and moderately high convective heat fluxes. These will be
highest near to or above the source of the fire but will provide a relatively uniform heating of all
structures, piping and upper parts of vessels above the neutral plane. This is likely to lead to
External flaming will occur if either the fire is ventilation controlled or the fire size reaches that
described above. With large external flame volumes the width of the base of the flame can be
much wider than the opening. If it originates from the lower modules, it can engulf the whole
side of the platform with wind causing it to tilt, possibly towards the accommodation or TR.
This effect is graphically illustrated in the Piper Alpha Inquiry Report Part 2 [2.15], (see
plates14b through to 18a). This will have a major impact upon the whole installation and it is
likely to require evacuation if it is sustained for more than a few minutes. There is only limited
understanding of this external flaming and there are limited predictive tools to quantify it
accurately. Its characteristics may be similar to a large pool fire, with the flames subject to tilt
in high winds.
Fires on the sea will be affected by a number of factors; the fuel, release characteristics,
release rate, the sea and weather conditions. It requires a fairly large release and benign sea
and weather conditions before the fire has a major impact on the facility. This could lead to
structural or riser failure, smoke engulfment of the topsides or the impairment of evacuation.
All of the contributing factors must be examined to determine the risk of failures and benign
conditions occurring simultaneously. This may be very low in the North Sea but not in other
parts of the world.
Some development information was prepared in 1992 for the HSE and amongst the treatment
of other fire types; a review of pool fires on liquid was undertaken [2.16].
There is an almost infinite range of events which can occur on an offshore facility. A
representative selection of scenarios should be selected from each of the hazards which are
considered to have the potential for a major accident. An initial hazard identification and expert
judgement will identify those hydrocarbon sources with the greatest potential for harm and
those with a high probability. These should be subject to more intense scrutiny than lesser
risks and any modelling should be based on platform specific parameters not generic fire
scenarios with particular attention paid to the uncertainty surrounding two-phase releases.
The events chosen for analysis should reflect the installation’s design features as much as
possible and encompass the following cases
• Those with the greatest potential for escalation; i.e. the largest events with sufficient
duration to cause failure
• Those events which could realistically occur; i.e. those with clearly identified causes
giving failures of an identified maximum size; e.g. the largest tapping size or the
dimensions of typical corrosion failures
• The characteristics of the events whenever critical control systems such as ESD fail to
operate
The advantage of an inherently safer design or the ‘Inherent Safety’ design approach is that it
attempts to remove the potential for hazards to arise. It does not rely on control measures,
systems or human intervention to protect personnel.
All control systems have the potential for failure to operate as intended, generally expressed
as the probability of failure on demand. Critical loops are designed according to their criticality
in mitigating personal, environmental or commercial risk by setting a Safety Integrity Level
(SIL). In setting a SIL, it is acknowledged that there is failure potential although this is
designed to be inversely proportional to the importance of the loop in risk mitigation.
There is always the potential for the systems to be damaged in a hazardous event. Inherent
safety avoids this potential by aiming for prevention rather than protection and the preference
for passive protection over active systems.
It is particularly important to follow Inherently Safer Design principles where the consequences
of process release or system failure are high. Where it is possible to reduce the reliance on
engineered (active or passive) safety systems or operational procedures this should be done.
The Inherently safer design approach contrasts with the process design spiral in Figure 2.2.
The result of the application of the Inherently Safer Design approach is reduced complexity
and a reduced requirement for human intervention, resulting in a simpler more robust system.
More complexity,
More maintenance
more leak sources
intervention
More safety
systems
Reduced monitoring
requirement
Increased Attenuation,
robustness substitution
Figure 2.2 - The process design spiral and the inherently safer design cycle
This implies that the plant response to the fault should satisfy the following criteria in order:
3. Active engineered safeguards activated in response to the fault should make the plant
safe.
• Attenuation – using the hazardous materials or processes in a way that limits their
hazard potential, e.g. storage at lower temperature or pressure;
• Simplification – making the plant and process simpler to design, build and operate
hence less prone to equipment, control failure and human error.
The application of the above principles should result in fewer and smaller hazards, fewer
causes and consequences, reduced severity and more effective management of residual risk.
In order to implement the principles, contributions will be required from all levels of the project
team. Managers should show leadership in the focus on safety; discipline engineers will be
involved in concept choice, plant layout and engineering detail; safety specialists must make
the options visible and available to designers and document the process.
Table 2.1 summarizes the major ‘inherent safety’ and control features necessary to achieve
the goals stated above:
The above table details inherent safety and control features that either minimise the potential
for fire and/or explosions to occur, or if they occur, to minimise the consequences and
subsequent risk to personnel. These features should ideally be built into the early design of the
installation, rather than being included as mitigation measures at a later date.
Inherent safety practices must be maintained throughout the life of the installation continuing
through the operational phase by adherence to effective inspection and maintenance regimes
and by ensuring that management systems and related procedures are followed.
The benefits of the inherently safer design approach are that hazards and risks are tackled at
source. There is an opportunity for cost effective risk reduction (at an early project phase). The
approach will normally result in easier and more reliable plant and often results in reduced
through life costs.
There may be some conflict between the various features of inherent safety. For example,
increased compartmentalisation will reduce the size of a potential explosive gas cloud
however this will also decrease the potential for natural ventilation and increase confinement.
The balance between such features is discussed later in this Guidance.
EMERGENCY RESPONSE.
EXTERNAL systems
This indicates that the use of passive rather than active control and mitigation systems is
preferred and that reliance should not be placed on personnel to prevent, control or mitigate
hazards if avoidable. This process is illustrated in Figure 2.3 below.
Strategy
Prevent
? Control
Mitigate
Evacuate
System
Passive
choice?
Choice? Active
Operational
External
System
Role, Functionality, Criticality, Survivability
performance?
Performance?
Risk
No Is it good
enough?
Yes
Proceed with
Detailed Design
Table 2.2 below defines and expands upon some of the terms used above [2.18].
Type Description
Passive Systems that act upon the hazard simply by their presence.
They do not need to react to the hazard or need operator input at the time of occurrence
in order to be effective.
Modes of failure are long-term deterioration, physical damage or removal. Preferred
because they are inherently the most reliable, requiring only inspection and maintenance,
reducing the need for people to be in hazardous locations.
Typical examples are corrosion allowances, layout, welded connections, relief panels,
natural ventilation, separate accommodation platforms, fully rated
pipework/vessels/primary structure/barriers and subsea completions.
Active Systems that may require mechanical or electrical facility, or control signals in order to
work.
Susceptible to mechanical/electrical/software failures and downtime. Less reliable,
particularly where their failures may not be visible.
Inspection, testing and maintenance required, and thus susceptible to human error or
omission.
Can cause increased numbers of personnel and activity on the facility. Typical examples
are, depressurization systems, fire and gas detection and active fire and blast
suppression systems.
Operational Systems that depend primarily upon people to initiate the system or to carry out the whole
function.
Can be less reliable and requires sufficient procedures and trained people on the facility
to ensure their operation.
Effectiveness is wholly dependent upon the operator, who should agree to be dependent
on these measures. Typical examples are maintenance, inspection and condition
monitoring.
External Systems that depend on the correct reaction of people beyond the
company/asset/installation and its direct workforce.
Potential for error due to the longer communication lines and frequent changes of the
people involved.
May be dependent upon effective contracts and audit.
Examples are the competence of a supply boat master to avoid riser impact, and isolation
of a third party feeder pipelines.
Means of
Goal Phase Key processes
achievement
Minimise offshore Conceptual Concept analysis, risk ranking.
processing Selection of lowest risk option
unless cost is grossly
disproportional to risk gain.
Fewer hazards
giving rise to fire Simplify the process Conceptual Concept selection
and explosions employed
FEED Process review, HAZOP, HAZID
Less maintenance Conceptual Concept selection
burden
FEED Process review, HAZOP
Less piping joints FEED Piping philosophy to promote
welded connections
Less small bore FEED Piping philosophy, instrument
piping philosophy
Less maintenance Conceptual Concept selection, minimisation of
process
FEED HAZOP, corrosion policy (piping
specification), maintenance
philosophy (replacement vs.
maintenance)
Less intrusive FEED Instrumentation philosophy stating
instrumentation preference for non-intrusive
instrumentation
Less corrosion FEED / Detailed Corrosion philosophy, choice of
Design materials/piping specification
Fewer causes of
Less vibration Detailed Design Process design, piping supports,
fires and
resilient mountings for mechanical
explosions
plant.
Fewer ignition Conceptual Minimisation of process complexity
sources
FEED/Detailed Area classification (hazardous
Design area) designation.
Safety Philosophy - no naked
flames
Insulation specification (hot
surfaces)
All Replacement of light fittings with
flood lights [2.19]
Operation Operation/Maintenance
philosophies. Elimination or
minimisation of hot work at live
plant. No welding/gas cutting at live
plant
Means of
Goal Phase Key processes
achievement
Less congestion FEED / Detailed Layout – minimise piping and small
Design diameter items. Layout of small
bore items
Less confinement FEED Layout – grated decks, fewer
walls/partitions
Lower process FEED Design Basis/Process Philosophy.
pressures Seek to minimise process
operating pressures
Smaller inventories Conceptual / FEED Choice of separation options,
Reduced severity location of isolation and other
of fires and barrier valves
explosions
Smaller potential FEED Layout (may conflict with
explosion zones confinement)
Shorter flame path FEED Layout – avoid long narrow
length modules
More ventilation FEED Orientation Study, Ventilation
(explosions) or less Study. Reduce confinement,
ventilation (fires) installation orientation. Aim to
achieve greater than ‘adequate’
level (> 12 air changes per hour
(ach))
Unmanned Conceptual Concept selection - minimisation of
installation offshore processing
Lower manning Conceptual Concept selection - minimisation of
levels offshore processing, minimise
Normally Unattended Installation
(NUI) visit frequency, remote
operation, minimise maintenance
Lower exposure of Conceptual / FEED Concept selection - minimise
Fewer personnel to the manning levels, minimise
consequences explosion hazard maintenance, maximise separation
resulting from and escalating of control and quarters areas from
fires and events process areas
explosions
No missile Detailed Design Layout & fixing details - fix small
generation items to robust equipment away
from high blast wind areas.
Operation Housekeeping - removal of lose
items from module, no storage of
equipment
Escalation Conceptual/FEED Segregation of explosion risks and
major fire escalation
Means of
Goal Phase Key processes
achievement
Prevention rather All HAZID/HAZOP - identify hazards
than protection then use hazard management
hierarchy – elimination of hazard
being first goal
Passive systems All Aim for inherent safety rather than
rather than active use control systems which have
failure modes
More effective No reliance on FEED/Detailed Control/Process/ESD Philosophies
management of personnel to prevent, Design - use control systems to make
residual fire and control or mitigate decisions in structured manner
explosion risk hazards according to ESD hierarchy.
Minimise number of All Minimise process complexity and
safety critical manning levels so that quantity of
systems safety critical elements are reduced
in number
No exposure of All Minimise the process, maximise
safety critical separation of control and quarters
systems to hazards areas from process areas
At the concept choice stage the selection of a safer concept should be paramount. At the
preliminary engineering phase layout should be designed with the intention of reducing the
severity and consequences of major hazards. At the detailed engineering stage systems
should be designed to reduce the likelihood and severity of the hazard.
If the method is not applied from the start then it may not be possible, cost effective or
effective in risk reduction terms to modify the plant to conform to the ideals of inherently safer
design. Intervention may give rise to an additional hazard which must be assessed and should
not compromise the gains to be achieved by the modifications.
It may not be reasonably practicable to apply retrospectively to existing plant, what may be
demanded by reducing risks to ALARP for a new plant and what may have become good
practice for every new plant.
The overall individual risk and the TR impairment frequency (TRIF) from all hazards must still
be less than 10-3 per year. If risks are in this intolerable region then risk reduction measures
must be implemented, irrespective of cost.
There may be some conflict between the various approaches employed to improve inherent
safety. For example, increased compartmentalisation will generally reduce the size of a
potential ignitable gas cloud and the number of potential ignition sources, however this may
decrease the potential for natural ventilation, increase confinement and give rise to obstructed
or ventilation limited fires. The balance between such features needs to be considered.
Where the risk associated with an outcome is low, any inaccuracies in determining that risk will
also be low in absolute terms. The effort expended should be proportional to the risk. It is
important therefore to have a means of early estimation of the risk level of an installation to
determine the appropriate approach to be used in installation fire assessment.
The approach to fire assessment needs to be decided early in the design process when
absolute values for release frequency and detailed consequence analysis are not available.
Risk is the product of consequence and frequency of occurrence. This risk can be calculated
as a numerical value expressed as individual risk (IR) or in terms of a value for the installation
such as Potential Loss of Life (PLL). Where quantitative values are not available a qualitative
measure of risk can be estimated to a degree of accuracy sufficient to make a decision on the
assessment approach to be adopted.
Likelihood is a more appropriate term in this context where a qualitative assessment is being
performed, the terms probability and frequency imply that numerical values are available.
At a later stage in a design project a 5 x 5 risk matrix may be appropriate for risk acceptance.
However at an early project phase the increased number of boundaries between consequence
and likelihood classes may be difficult to identify and assign.
A simple approach which is frequently adopted for qualitative risk assessment uses a 3 x 3
matrix of potential consequence versus likelihood of a fire event is described in this section.
For existing installations, the individual risk (IR) per annum from fire and explosion events will
have been used in the demonstration of ALARP in the existing Safety Case for the installation.
The total IR will be a good indicator of the appropriate level of sophistication of analysis and
whether the installation is in the low, medium or high risk category. Proposed modifications to
the facility may result in changes to these IR values.
A low potential of loss of life (PLL) for the installation may not be a good indicator for normally
unmanned installations and ageing platforms with extended life, because of low occupancy.
However, assuming the risks to any group of individuals is acceptable, the effort and cost
involved in assessing risks and incorporating risk reduction measures should largely be
justified on the basis of the potential for reducing the overall PLL.
It should be borne in mind that the methods considered adequate for hazard mitigation during
preparation of a previous Safety Case may no longer be adequate or correct, as a
consequence of improved understanding of technical integrity behaviour and loading, or new
research.
Details of the existing Safety Critical Elements should be available enabling their classification
into categories 1, 2 or 3. The high level performance standards for the facility should be
defined or confirmed at this stage. The general approach should be to bring the SCEs up to
the same level of integrity taking into account the criticality or consequences of failure and the
difficulty in achieving the level of performance desired.
The number or proportion of existing SCEs vulnerable to explosion loads is also an indicator of
the risk category for the installation. The risk associated with TR impairment under direct and
indirect explosion loads combined with impairment of means of escape is Key.
A simple approach which is frequently adopted for qualitative risk analysis uses a 3 x 3 matrix
of potential consequence versus frequency or likelihood of an accident or event, and such a
matrix is illustrated below (see Table 2.4).
The overall categories of 3 published documents are shown; the documents are issued by
UKOOA, API and ISO [2.20, 2.21 and 2.21], the notation differs between the three documents
and has been adjusted for comparison purposes.
Other practitioners make use of a 5 X 5 matrix; the choice of preferred level of refinement
should be dependent on the Duty Holder’s corporate background and their experience with the
use of qualitative risk assessment. A 5 X 5 matrix will obviously offer a greater degree of
refinement, the choice of refinement should be governed by the motive for the analysis, for
example, a ranking exercise for a number of competing feasibility options could easily make
use of a 3 X 3 matrix, whereas, making a decision on a protection option would benefit from
the use of a 5 X 5 matrix.
The higher the risk (likelihood x consequence) in an installation or compartment the greater
should be the rigour that is employed to understand and reduce that risk, this may entail
choosing more comprehensive methods and analysis tools. The solutions and protective
measures for the installation with greater risk should be able to bear greater scrutiny, from
both the Duty Holder and the regulator’s point of view.
H M L H M L L1 L2 L3
H H H M H H M H H M
Likelihood/
probability
M H M L H M L H M L
L M L L M L L M L L
There is a large degree of similarity between the three documents, the differences in notation
and the differing treatment of the outcomes (risk) are summarised in Table 2.5 below.
It is appropriate to note that uncertainties and/or sensitivities should be considered part of the
level of rigour of analysis chosen (based on the risk ranking). The uncertainties and
sensitivities should also dictate the approach to the ensuing analyses. For example, a
precautionary approach may be adopted where data are limited, the design is novel or
manning levels are higher, (more than say 50, one TEMPSC load).
Issue 1 May 2007 Page 64 of 493
FIRE AND EXPLOSION GUIDANCE
2.8.3 Risk screening acceptance criteria
2.8.3.1 General
The objective of a fire and blast hazard management process is to reduce risks associated
with potential hazards to a level that is ALARP, that is, to a level that is tolerable. Tolerability
can be related to specific quantitative targets as is the case in some legislative regimes, it can
be related in part to cost (risks being reduced to a level that do not incur disproportionate
costs) and an array of other criteria defined by legislation and/or corporate goals as part of
internal safety management systems.
One simple approach to defining risk [2.23] and hence identifying whether risk is tolerable is
the use of risk matrices. These come in a wide variety of forms but provide a simple and
effective means for design teams to assess the likelihood (probability of and event) and the
severity (consequence).
Generic definitions for likelihood and consequence can be easily established. This enables the
risks to be semi-quantitatively defined (positioned) and offers a mechanism for mitigating
measures to be evaluated (i.e. is likelihood or outcome reduced, by how much and what is the
residual risk level).
The method reviewed here utilises logarithmic frequency and severity ratings which are added
together to give a risk rating. These are added rather than multiplied because they are
logarithmic representations of the actual frequency and severity.
A simple example of the use of risk acceptance matrices is presented here. Risk may be set at
three levels by the matrix:
C - risk is tolerable.
Frequency
Frequent Occasional Infrequent Unlikely Rare
Severe A A A B B
Critical A A B B C
Severity
Substantial A B B C C
Marginal B B C C C
Negligible B C C C C
Frequency
Category Annual probability of occurrence per year
Score Rating
-1
Frequent > 10 More than once every 10 yrs 0 5
The frequency ‘score’ is effectively the logarithm of the annual probability of occurrence. The
frequency rating is a normalized representation of the frequency ‘score’ for use in semi-
quantitative hazard assessment.
SEVERITY RATING (SR) or Consequence: Each release scenario, taking into account
existing controls, the variability from ignition time and position under a range of environmental
conditions may be ranked using a coarse system based on severity of the cause. The
assessment must consider the risk profile from all causes to satisfy the legislative
requirements in particular relating to TR impairment.
Severity
Category Severity (safety, environment, asset)
Score Rating
A suitable low sophistication means of defining the explosion hazard is the use of valid
nominal overpressures derived from previous assessments of similar structures. They may be
used as the ductility level blast overpressures (DLB).
Another acceptable means of overpressure derivation for low risk installations is comparison
with a specific past cases. Such comparisons should be supported by evidence that a
structured assessment has been undertaken to identify areas of difference and that the
original means of calculation were sound.
Extrapolation of data for the relevant parameters is not generally recommended but may be
valid if a sound basis exists. The comparison process would incorporate consideration of the
following factors:
Where no nominal overpressure has been defined for the installation and there are no suitable
past cases for comparison, then the level of analysis appropriate for high risk installations
should be used for explosion hazard assessment.
Medium risk methods are described in this Guidance which substitute for some of the tasks
defined in the Higher risk methodology. The philosophy recommended in this Guidance is that
for medium risk installations the choice of methodology for any particular task must be justified
where it deviates from the higher risk methodology.
• Determination and assessment of the structure and SCEs against the SLB and DLB
design explosion loads including blast wind dynamic pressures.
• Time dependent and possibly non-linear dynamic modelling of the installation and
systems response.
• Explicit consideration of escalation and interaction between fire and explosion scenarios
including the collapse of tall structures and the external explosion.
Annex G gives by way of checklists the issues which should be considered for low medium
and high risk installations. These checklists are taken from reference [2.25] the Genesis
‘Explosion assessment guidelines’.
Issue 1 May 2007 Page 68 of 493
FIRE AND EXPLOSION GUIDANCE
Table 2.9 over the following pages, indicates a range of methods sorted by task but which are
appropriate to Low, Medium or High risk installations.
To assess and manage the risks arising from a specific operation especially with respect to a
specific hazard category it is necessary to recognise the requirements of the HSEMS on the
risk management process (e.g. in determining acceptable levels of risk) and to implement the
processes that contribute to the risk management.
In identifying candidate risk reduction measures, consideration should be given to the full
range of measures involving inherently safer design, prevention, detection, control and
mitigation.
The risk reduction measures considered may range from items of equipment and physical
systems through to operational procedures, managerial structures and planning.
It is worth emphasising that the UK regulator will expect to see the following demonstrations
for risks lying below the maximum tolerable, but above the broadly acceptable level:
• That the nature and level of the risks are properly assessed and the results used to
determine control measures;
• That residual risks are not unduly high and have been kept ALARP;
• That the risks are periodically reviewed to ensure that they still meet the ALARP
criteria.
Duty holders should not assume that if risks are below the maximum tolerable level, they are
also ALARP. This should be demonstrated through the application of relevant good practice
and sound engineering judgement; and the consideration of further measures that can be
adopted to reduce risks to ALARP. The degree of rigour of the ALARP demonstration should
also be proportionate to the level of risk associated with that hazard category on that
installation.
Type of
Description of measure
measure
Leak prevention
Type of
Description of measure
measure
Active fire protection
Some main feedback loops are shown but other stages also require feedback.
The lifecycle is made up of the general stages of concept selection, detail design, construction
and commissioning, operation, modifications and decommissioning. These are described in
more detail in the next section indicating approximate timing and sequencing of particular
activities.
FEHM is a continuous process rather than a series of discrete steps. There will be overlaps
and iterations between the various stages of the design, commissioning and operation phases
with earlier decisions reviewed and revised as necessary.
Each numbered step of the assessment process for fires and explosions as outlined in Section
4 is linked with the relevant stage of the lifecycle. These steps are shown in Figure 2.4 shaded
in boxes 1, 5, 6, 7, 8 and 11 with the associated activity alongside. The need to revise the
assessment and repeat elements of the lifecycle is identified in boxes 19 and 20. At each step
of the lifecycle where critical decisions are taken, particularly box 11, these should be
reviewed to ensure that all reasonably practicable risk reduction options have been
considered, that the high level performance standards have been achieved and risks are
ALARP.
The lifecycle approach can be applied at any stage of the installation life. With an operating
field or a partially completed design, many or all of the systems will already be specified or in
place and the relevant lifecycle activities will have been completed. In these cases, the steps
of the assessment shown in boxes 5 to 8 and 11 should be carried out as a discrete activity so
that a full picture of the fire and explosion hazardous events can be developed, before the
need for any changes can be determined.
Concept selection
S et t he high level
2
perf orm ance standard
Com mi ssining
13 P l an f ut ure verification 12 14
param eters saf et y systems
V eri f y t hat sys t em s are effective and E nsure personnel are trained and
16 rel i abl e duri ng commissioning and 17 com pet ent t o i m pl ement / operate
t hroughout t he i nstallation life
M odif icat ion
3. feasibility studies;
4. concept design;
5. front-end engineering;
6. detail design;
9. operation;
Whenever an installation is modified or changes take place, the hazard management process
should be repeated to a level of detail commensurate with the change.
For the purposes of this guidance the stages from 3 onwards are more important and are
discussed in more detail in the following section.
Identify fire and explosion hazards different Apply inherent safe design
1
concepts principles
During the review of the alternative development concepts, an identification and coarse
quantification of the risks from the hazardous events should be carried out. This information
should be used as part of the overall consideration for concept selection and also to optimise
the layout and guide the selection of hydrocarbon processing methods for each concept.
This is the statement of the standards of the installation as a whole for the safety of personnel.
At this stage, Performance Standards may also be defined for major systems such as
Temporary Refuge (TR) impairment frequencies, environmental standards and targets for
reducing damage to the platform. These would be relevant if the reduction of fire and
explosion risks contributes to meeting these targets.
Select the concept taking into account risks from all possible hazards including fires
3
and explosions
The selection process should include consideration of the risks of major accidents of the
different concepts and the particular contribution from fires and explosions.
Attention should be paid to the primary risk contributors and the practicality and cost of
preventing, controlling or mitigating tern.
Define the design and operational regime - codes, standards and safety
4
management systems
This is the definition of which codes and standards will be used to design the structure, plant
and equipment These include the primary prevention measures which ensure the technical
integrity of the plant The appointment of the designer and operator/owner management
systems including structure and responsibilities should also be defined.
Confirm all fire and explosion hazards Optimise the design to improve the
5
are identified inherent safety
This is the start of the formal assessment of the fire and explosion hazardous events. It may
use the output from the conceptual selection studies as a start point. For a new design, the
identification of possible hazardous events should be used to review the layout and process
design so as to eliminate or reduce all hazards to meet the high level performance standards,
concentrating particularly on those hazards which make the predominant contribution to the
overall risks. On an existing installation, it may be possible to identity ways of reducing the
risks through changes in operational practices.
The assessment requires that initiating events are identified. This allows the causes to be
identified and a check of the design codes and standards and SMS and operating parameters
to ensure that they are suitable to address the causes and adequate to deal with their severity.
Where they are found to have shortfalls, the codes and standards may be changed or
enhanced. Procedural systems or operating parameters may be changed and, if necessary,
new specific prevention measures may be added. This may lead to a further review of
previous lifecycle steps, follow feedback loop to Step 4 as shown in Figure 2.4.
Determine fire and Select / optimise control systems to limit the escalation
7
explosion loadings of hazardous events
The characterisation of the hazardous events identifies the size, intensity and duration of
representative hazardous events and the contribution of control measures. This enables the
most severe events to be identified and their control measures to be enhanced or augmented
to reduce their severity. At this point those events to be used as the basis of design for
mitigation systems are chosen.
The plant and equipment which could fail when exposed to fire and explosion in the
characterised events should be identified. An assessment of the likelihood and consequence
of these failures determines the need for protection and, in the case of existing installations, its
provision and adequacy.
Define the role and functionality, reliability, availability and survivability parameters
9
for engineered systems
This applies to hardware (engineered) systems and is the definition of the overall purpose of
the systems and the essential parameters to be met by the system so that it fulfils its role. The
reliability and availability may need some iteration with the escalation and risk assessment in
Step 11. For existing installations this may be a formalisation of the original design standards
and objectives.
10 Define the role, manning and competence requirements for procedural systems
This defines the role and the essential parameters required to be met by procedural systems.
It requires confirmation that the manning and competence levels are or will be available to the
extent necessary.
Develop fire and explosion Verify that all hazardous events are
11 escalation analysis and risk addressed, systems are suitable and the
assessment high level performance is achieved
This is the overall review of the fire and explosion risks and their acceptability. It formalises the
escalation analysis which will have been developing as part of the assessment process. On
new designs it is carried out prior to proceeding to detail design to ensure that the proposed
systems are suitable for the hazardous event and will be sufficient to reduce, as far as is
reasonably practicable, the risks from each hazardous event. On existing installations it is the
determination of the adequacy and contribution of the safety systems provided. The
cumulative risks from all major accident hazardous events should be within the high level
performance standard and ALARP. This information is essential to determining if remedial
measures or improvements are needed to the existing or proposed system provision. These
results may lead to a review of other lifecycle steps - follow feedback look to Steps 4, 7 or 9 as
applicable, as shown in Figure 2.4.
The design contractor and suppliers should co-operate in designing the systems and
components to meet the functional parameters and the availability and reliability requirements
and ensure that any interactions and also limitations are addressed.
The verification process provides assurance that the design was appropriate and has been
properly executed and identifies the schemes by which systems can be fully inspected and
tested at appropriate intervals during their life. There is no point in specifying a performance
standard which cannot be verified.
This includes the provision of specific procedures to complement the generic procedures and
practices associated with the SMS. On an existing installation, the existence and quality of
these procedures should be assessed.
This is to ensure that the systems can be properly operated and maintained and that they
achieve the functional parameters. On an existing installation, it is necessary to ensure that
these facilities are in place. The tasks may include:
• provision of access;
Verify that systems are effective and reliable during commissioning and throughout
16
the installation life
This is function testing which should be carried out prior to installation (at supplier’s works),
during commissioning, prior to-start-up, and at predetermined intervals during the system life.
The function testing during commissioning will normally cover the full range of expected
operational demands, to provide a base line for trouble shooting throughout the remainder of
the lifecycle.
Ensure personnel are trained and competent to implement, operate, maintain and
17
test systems
This applies both to personnel training and competence for procedural systems and for the
operation, maintenance and testing of engineered systems. It may be necessary to prepare
training courses and schedules and to have sufficient personnel trained prior to start-up. This
applies not only to regular installation personnel but also to individuals who may visit the
installation to operate, maintain or test the plant. On an existing installation it may be
appropriate to review the training and competence of existing personnel.
This requires the continued maintenance and operation of the plant so that the engineered and
procedural systems continue to meet their original intent as developed during the design and
initial assessment process.
During the life of the installation, changes may be considered or arise naturally through, for
example changes in the produced fluids from the reservoir. Alternatively a safety system may
deteriorate so that it is unlikely to continue to achieve its intended functional performance,
reliability and availability. All changes should be assessed to determine the effects on the high
level performance standards and, where necessary, improvements should be considered to
the systems provision.
This is the update of the assessment required by a relevant significant change identified in
Step 19. It may also lead to a review of the other lifecycle steps affected by the change
including the hardware, procedures and documentation and to a revision of the Safety Case.
Follow feedback loop to Steps 4, 7 or 9 as applicable, as shown in Figure 2.4.
The design process should have considered likely decommissioning hazards and identified the
relevant procedures or systems. These should be formally reviewed prior to decommissioning
of either part or all the plant to ensure that all hazards are identified and adequately
addressed. Where the existing systems or procedures are deficient, these should be
addressed by following the relevant steps in the lifecycle.
The safe decommissioning of the plant and eventual abandonment of the installation may be
dependent on special hardware or particular procedures. These should be in place and
sufficient competent persons should be available to operate and implement them.
The assessment process should be used as a design and operational tool to understand the
hazards and hazardous events and to identify when prevention, control and mitigation
measures can be applied to reduce the risks. The flowchart Figure 2.4 showed where and
when the assessment should provide information into the lifecycle and management process.
The timing and detail of the assessment will depend on the stage in the lifecycle, the level of
information available at that time, and the frequency and severity of the hazardous events.
Those events which result in the major risks to life will deserve the greatest attention,
particularly in terms of analysing initiating frequency and consequence.
The hazard identification process should address all foreseeable fires and explosions and, in
particular, those involving releases of hydrocarbons. This process should be fully documented
including all of the foreseeable causes of initial release as these should be addressed when
identifying the need for specific prevention measures.
To structure the process, the installation may be divided into discrete areas in which hazards
are identified by considering the process or utilities systems, plant, fixtures, combustible
inventory, etc. within each. Potential external initiators of fires and explosions such as a
helicopter crash are also important and should be considered. The information required to
carry out the initial hazard identification may include the following (as available):
• Process oil/gas/condensate;
• Process additives (e.g. methanol and tri-ethylene glycol);
• Fuels (diesel, aviation fuel, etc.) and lubricants;
• Bottled gas (e.g. propane, acetylene);
• Industrial explosives and detonators;
• Combustible material (e.g. wood, furnishings, paper, plastics);
• Laboratory and process chemicals.
• In identifying hazards the parameters which define the type of hazardous event should be
identified and documented. These may include:
• System pressure;
• Isolated and non-isolated inventory;
• Temperature;
• Density;
• Composition of material;
• Likely release points and their size;
• Flash point;
• Ignition sources;
• Combustible load;
• Oxidising agents.
The fire or explosion events identified will vary depending on the hazardous material involved
and the conditions relevant to the particular system or inventory being considered. Typical
events are:
With a new design, the escalation analysis is also important in the selection of the design
accident events, together with the perception of the extent and severity of the escalation. As
the analysis proceeds, a picture of the range of initiating scenarios and escalating events
throughout the platform will emerge. From this overview, it should be possible to select the
design events based on the practicality of preventing larger initial events and stopping the
escalation of smaller events to those of an extreme magnitude. In particular, a designer would
need to consider the following when identifying a design event:
• the options for reducing the frequency of an incident so that the resulting risk is ALARP;
• identify mechanisms whereby an initial event may escalate to impinge on key systems
or facilities, e.g. the TR and/or evacuation and escape facilities;
• identify where control or mitigating measures could be used to prevent, delay or reduce
escalation or protect life;
• identify the combination of measures needed to deal with each major hazardous event
and to provide an input to the development of associated performance standards;
• evaluate the effects on the installation safety systems at each stage of escalation and
how this may affect subsequent escalation;
• evaluate the probability and hence the frequency of each escalation path which affects
the key facilities or systems such as the TR and Escape, Evacuation and Rescue
(EER) facilities and the time duration from the initial event.
This may be carried out as an event tree analysis. This can show the sequence of failures
which need to occur to result in a particular level of consequence and give designers and
Operator/Owner the opportunity to add, to or enhance the safety systems to break the
sequence of events.
This involves identifying those critical components or systems which, if they fail, have
significant consequences regarding:
• threat to life;
• environmental damage;
• loss of assets (plant/production).
• the location and description of the initial event especially its size, severity, duration and
frequency;
• the means by which the initial event may escalate and, at each escalation stage, the
corresponding probability and time to escalation;
• the effects of the events on the installation including the safety systems at each stage
of escalation and how this affects subsequent event progression;
• the contribution of safety systems to reducing the consequences and the probability of
their successful operation;
• the effects on the key facilities or systems such as the TR and EER facilities in terms of
impairment, time to impairment and impairment frequency;
• the fatality levels associated with each scenario.
In assessing the contribution of safety systems, the characteristics of each stage of the event
should be considered if it is possible that systems may fail to operate successfully or could be
damaged. Such systems may include:
• emergency shutdown;
• blowdown;
• active/passive fire protection;
• detection systems;
• communications (internal and external);
• essential control and instrumentation;
• essential power supplies;
• drainage;
• overpressure protection;
• active/passive explosion protection.
It may also be necessary to consider the actions and decisions of key personnel, in particular
the OIM, in responding to an escalating situation. The decision to move personnel to different
parts of the installation, to abandon the installation, to fight the fire, etc. and the time at which
these decisions are made can have major implications.
Issue 1 May 2007 Page 84 of 493
FIRE AND EXPLOSION GUIDANCE
The need to take particular decisions should be reflected in the preparation of the Emergency
Response Plan and in the provision of communication and evacuation systems.
The ability to take decisions may be affected by smoke, heat and the scale of the incident.
This should be taken into account, particularly if the TR and control centre are affected.
Likelihood is a more appropriate term in this context where a qualitative assessment is being
performed, the terms probability and frequency imply that numerical values are available.
WHAT is released?
The answers to these questions combine to determine the type of fire that may result, the
likely size of the fire and its potential impact on people and the installation. Considering each
in turn:
WHY: The answer to this question will establish the size of the leak and influence the
likelihood of ignition. For example, has the leak occurred due to a leaking flange joint or as a
result of a preceding explosion event? A range of sizes should be considered from small leaks
at flanges and fittings up to major failures of vessels and risers which result in very high
release rates. The leak rate may also change with time and may have a limited duration.
Failure frequencies for different sizes of event should be taken into account; generally small
leaks will be the most common. Release failures should be based on platform specific
information where possible, and Duty Holders are encouraged to collect, analyse and use
failure rate data based on their own maintenance systems and practices.
The reason why a failure is being considered may also influence the likelihood of ignition, for
example, if a vessel failure is being considered as a result of a preceding explosion or fire
attack then ignition is almost certain, whereas a small leak of high pressure gas generated as
a result of a leaking flange may not interact with a potential ignition source. Ignition
probabilities also depend on fuel type, for example, a spillage of diesel onto a cold surface is
not readily ignited.
Issue 1 May 2007 Page 85 of 493
FIRE AND EXPLOSION GUIDANCE
WHAT: The nature of substance being released will also influence the type of fire that results.
A non-volatile liquid spillage may result in a pool fire whereas a high pressure gas release may
produce a jet fire. Apart from process fluids, other flammable substances are likely to be
stored and used on an installation for use in service roles. Potential fluids to be considered
are:
In addition, some of the gas and oil streams may include hydrogen sulphide, which may
require special consideration because of its potential to produce toxic products or be toxic if
unignited.
WHERE: Where the leak occurs will also influence the type of fire that results. In particular, is
the fire likely to be in an open or confined area and what is the potential for the fire to impact
onto pipework or vessels that may also contain flammable material, or indeed other critical
targets (e.g. other safety critical elements, control systems etc.)? The latter question is
important with regard to the potential for incident escalation. Some fires may occur at a
location away from the source of the leak, for example, liquid spills which may spread to other
areas or even spill onto the sea. The location of the fire will also influence its likely
consequences; hence fire scenarios at a range of key locations should be addressed in the
QRA. In particular, fires close to where people work which could affect escape routes, Safety
Critical Equipment, the Temporary Refuge or key structural components.
Having selected and defined a release event giving rise to a fire, this fire and its effects may
well change and develop with time depending on the prevailing circumstances. The following
factors may affect fire behaviour and/or the consequences:
• ESD: Assuming the ESD operates the volume of the isolatable volumes will affect the
duration of the larger leak scenarios and result in a transient fire size, reducing with
time.
• Blow-down: Similar to ESD operation, this could result in a transient release rate.
Additionally, blow-down may reduce the consequences of the fire scenario by
depressurising a vessel or pipework onto which a fire is impacting, thereby preventing
escalation.
• Confinement: Fires in confined areas with limited ventilation may change over time, for
example, become progressively more severe as ‘external flaming’ occurs, when the fire
moves through the ventilation openings.
• PFP: The use of passive fire protection may not affect the nature of the fire but will
affect the response of objects subjected to fire attack and delay or prevent incident
escalation.
• Deluge: Depending on the fire type, active water deluge systems (area and dedicated)
may affect both the nature of fire and the thermal loading to engulfed objects and in
most cases will be beneficial to escaping personnel.
Issue 1 May 2007 Page 86 of 493
FIRE AND EXPLOSION GUIDANCE
3.2.3 Ignition
The likelihood of ignition is clearly an important factor to consider for any QRA and will also be
dependent on the answers to the WHY, WHAT, WHERE questions above. Some fuels are
more easily ignited than others and the manner of spillage may affect its flammability (for
example oil spills onto the sea are often not readily ignitable and additionally are likely to be
distant from common ignition sources on an offshore installation.
Ignition sources such as electrical fault, electrical arcs (for example across switch contacts),
sparks, high temperature surfaces, flames and electrostatic discharge should be considered
and the proximity of such sources will vary at different locations on an installation (see
Section 3.2.6.8 for a discussion of ignition sources)
By considering combinations of these answers the fire type can be determined. Three
examples are as follows:
• Gas Jet Fire – originating from a pressurised gas release on the installation.
• Two-Phase Jet Fire – originating from a pressurised release of a flashing liquid or a
gas/liquid mixture on the installation.
• Pool Fire on the Installation – originating from a liquid spillage. May be static or running
depending on the drainage paths or bunding around the source.
• Pool Fires on the Sea – originating from a spillage on the installation falling onto the
sea, or failure of a sub-sea liquid pipeline.
• Gas Fires on the Sea – originating from failure of a sub-sea gas pipeline.
• BLEVE – originating as a result of catastrophic failure of a pressurised vessel containing
a volatile liquid.
It should be noted that the behaviour of these fires may change with time as noted in
Section 3.2.1, for example, due to the effect of ESD, confinement or deluge. The nature of
these fires and their behaviour when interacting with confinement and/or deluge is considered
in further detail in Section 5.2.
The fire and smoke loadings, issues concerning heat transfer and other details of the fire types
are discussed in Sections 5.3, 5.4and 5.5.
The principals of Fire Hazard Management promote a four-part strategy for dealing with the
fire hazard, when that hazard cannot be eliminated by inherent safety approaches (see
Section 2.7). In order of priority, the remaining steps of the strategy seek to:
3. Control fires
There are opportunities throughout the design of any installation to minimise the fire hazard
using the four strategies above. Every engineering discipline involved in the design process
should be aware of the interaction between their specific discipline input and the fire hazard
management for the installation. It is the responsibility of the safety engineer in conjunction
with the project manager to engage all the engineers in discussion of fire hazards from an
early stage so that no cost-effective opportunities for improvement are missed.
This section outlines the options available for preventing or minimising the fire event at source.
Sections 3.2.7 and 3.2.8 cover the various options for detection, control and mitigation of fire
events once they have already occurred.
Given that the principal role of oil and gas installations is to produce large quantities of
hydrocarbons, complete removal of the fuel source not an option. However there are
opportunities for the designers to minimise the potential for large releases of fuel. These are
described in the following sections.
The biggest inventories are in the reservoir, the pipelines attached to the installations and the
process vessels. Engineers need to be briefed to consider minimisation of release potential in
addition to consideration of production maximisation and cost. They should aim to:
• Provide suitably located topsides and subsea isolation valves on all import and export
pipelines. Any non-provision of subsea isolation must be thoroughly justified.
Justifications must consider all lifecycle phases (especially for NUIs);
• Size pipelines, vessels and other process equipment to minimise inventory loss in a
leak situation as well as meet process requirements;
• Provide adequate automatic isolation throughout the process system, backed up where
necessary with accessible manual isolation valves;
Good layout is essential to the overall safety of the installation. Where separation of people
from hazardous areas is not possible, provide protection by segregation behind firewalls and
attention to escape/egress routes. Key points are:
• Keep living quarters and evacuation facilities away from the process;
• Provide diverse egress routes from modules and access platforms/decks back to the
TR or provide a suitable protected muster point (PMP);
• Ensure that the hazardous drain arrangements are capable of handling releases from the
single largest vessel or source based on the range of reasonably foreseeable events;
• Locate risers and riser valves where other fires or fire escalation cannot affect them;
• Review the locations and orientations of flanged joints to minimise the location of targets
(SCEs or other flammable inventories) within the range of small and escalating jet fires;
• Small platforms such as Southern North Sea gas platforms cannot provide separation by
distance therefore immediate safe egress/escape provision plus sheltered evacuation
points are crucial for safety of personnel.
• Minimise the number of potential leak points in the design, particularly flanges and
instrumentation connections. However enough valves need to be left to provide for safe
isolation for intrusive maintenance. Use of newer design of equipment such as high
integrity flanges, valves with integral block and bleed and inherently safer wellheads
should be considered.
• Design for future sand erosion and corrosion by providing for ease of detection,
monitoring and replacement.
• Where facilities and access for routine test and maintenance are not provided on the
understanding that such work will only be done during shutdowns, this should be
highlighted on drawings and in manuals.
• Determine the required supply of inerting medium, e.g. the degree of inflow and outflow
required for all operating conditions, for example offloading requirements or inerting an
area with opening/closing doors (such as filling a Temporary Refuge with lower oxygen
content media, see next bullet point).
o Nitrogen;
o Over-rich (i.e. above Upper Flammable Limit) fuel gas;
o Cleaned combustion gas;
o Low oxygen content media (such as Inergen, a proprietary product with
insufficient oxygen to support combustion but adequate oxygen content to
maintain life);
o Carbon dioxide.
• Consider the preferred delivery option, whether the media can be generated on the
installation (e.g. Nitrogen Generator) or whether it is desirable to be brought on board.
• Review the media for their own hazardous effects in the context of the potential
applications. Avoid all but the lower oxygen content media in areas where personnel
without breathing apparatus may be, ensuring that the lower oxygen content media are
suitable for occupied areas. Identify any time limits on occupancy or minimum health
and fitness criteria with the media supplier.
• Confirm that the layout does not contribute to or exacerbate migration of the media to
sensitive areas, for example carbon dioxide being heavier than air will flow down hill,
therefore, recessed areas for valve or equipment access could capture the CO2,
especially where personnel could access as part of recovery work after the emergency.
• Where only a manual blowdown capability has been used – the designer and Duty
Holder must justify the choice of system with respect to the identified major accident
hazards, the design and operating philosophy must be clearly recorded for the
intended user and all operational and maintenance details must be documented or
referred to in the emergency response instructions for the installation.
• Blowdown must be to a safe location with respect to personnel, bearing in mind the
likelihood of spurious blowdown events as well as real emergency events, and
designed such that the heat radiation for maximum foreseeable flaring (or ignited
venting) rate does not pose a hazard to escape and evacuation.
• All electrical equipment in hazardous areas shall be certified. This is to cater for
‘fugitive’ leaks in accordance with hazardous area design codes.
• The dispersion distances for such leaks, from which the hazardous zones are
calculated, do not cater for major accident releases.
• A gas cloud from a medium or large leak can, and will, drift outside hazardous area
limits. Therefore caution must be exercised in locating unclassified equipment such as
generator sets, temporary pump skids, heating equipment etc in ‘safe’ open locations
around the installation.
• The ignition-prevention philosophy for the platform should explain how the ignition risk
is minimised.
• Plant should be suitably earthed and all operators trained in awareness of offshore
static spark risks (a recurring cause of fires).
Early detection of loss of containment events is crucial. Detection should always trigger
limitation of the leak by rapid automatic isolation it should simultaneously alert personnel to the
danger. Since it is difficult to automatically detect liquid oil leaks (although oil mist detectors
can detect higher pressure liquid leaks), historically reliance has been placed on detection of
the associated gas.
Most installations have hundreds of sensitive detectors in place. In order to prevent spurious
shutdowns and un-necessary platform alerts, most installations have a two-tier alert system.
Typically, under this system, a single low-gas-level alarm alerts staff in the control room to a
potential problem, which is immediately investigated but no shutdown or general alarm is
initiated. One single low level gas detection is more likely to be a false alarm than a real gas
release. If a second alarm in the same area then occurs or if a high-gas-level alarm goes off,
then this is indicative of a real release rather than a false alarm. The fire and gas system
voting interprets 2 or more low-level or 1 or more high-level alarms as ‘confirmed’ gas
releases. This automatically initiates platform alarms and shutdowns.
Confirmed gas detection should always initiate immediate, appropriate executive action in the
form of shutdowns and, where applicable, blowdown. Most platforms have between 2 and 5
levels of shutdown, depending on the extent of the detected release. A system which requires
operations personnel to walk into a gas-release scenario in order to investigate before
initiating shut down of the process system is potentially dangerous and no longer acceptable.
Personnel should never be asked to enter a gas-cloud for the purposes of investigation or
manual action – they may be rendered unconscious by the un-ignited gas or be engulfed in
flame if the cloud suddenly ignites. Where one person is missing, more people are exposed
Issue 1 May 2007 Page 92 of 493
FIRE AND EXPLOSION GUIDANCE
through search and rescues attempts and the evacuation process becomes delayed. The
detection system should instead be designed to give remote indication of the development
and/or migration of the release thus allowing personnel to stay well away from danger. Once
the fire and gas panel shows the situation is sufficiently under control then cautious, upwind
approach from a position of safety can be attempted.
There are many different types of gas detector available. All have their strengths and
weaknesses which are explored in the table below. All installations, modern and old, use a
combination of different methods in order to cover the range of duties necessary.
The approach to the detection of flammable gas has moved away from trying to detect all
leaks and now concentrates mostly on the following three distinct criteria:-
1. The detection of gas clouds of a specific size and LEL (i.e. 5 metres, 50% LEL
cloud)
2. The detection of gas leaks also of a specific size (i.e. 0.1kg s-1 to 2.5 kg s-1)
3. The detection of gas at the HVAC intakes to areas containing potential sources of
ignition (TR, turbine enclosures, etc.)
The basis for the specific cloud size and gas leak size are established by specialist
analysis/modelling of the areas. The systems are generally not concerned with the detection of
fugitive gas leaks, except in some special cases.
Performance Standards are used to set the initial design conditions to be met by the various
detectors (see Section 2.3).
Have historically been used for Location in an air intake duct is an arduous
detection of gas in air supply duty for this type of detector Executive
ducts to enclosed areas action occurs on 2oo3 voting. Access for
containing unclassified frequent maintenance and testing is
electrical equipment or other essential. I/R point detector with duct probe
potential sources of ignition or I/R open path detector are now available,
but not recommended now IR, and better, for this service.
beam detectors available.
Infrared detectors
An infrared gas detector consists of an infrared source and an infrared detector. When
flammable gas passes between the source and detector, the gas absorbs infrared radiation
and lower radiation intensity is registered at the detector. Specific gases are detected by
measuring the amount of absorbed infrared radiation at specific wavelengths; the difference is
related to the concentration of gas present.
Infrared detectors will not “poison” and can operate in inert atmospheres. They can be used in
confined spaces where oxygen depletion might have otherwise limited the effectiveness of a
pellistor detector. Infrared detectors are fail-safe, a detector that is obscured or has failed
registers zero infrared radiation and the alarm signal is activated. IR detectors are available in
either a fixed-point format, in which the gas diffuses into the detector or in an open-path format
where the source and detector are separated (thus a line of sight detector).
Pellistor detectors
A pellistor detector consists of a matched pair of elements, one of which is an active catalytic
detector and the other an inactive compensating element. Flammable gas contacting the
catalytic surface of the detecting element is oxidised causing a rise in temperature of the
active element, this rising temperature increases the resistance of the active element. There is
no such change in the compensating element and the output signal of the detector is based on
the imbalance between the two resistances.
Pellistor sensors can give accurate readings under adverse environmental conditions as
changes in ambient temperature, humidity or pressure will impact both elements. Pellistors
can be poisoned or inhibited by silicones, sulphides, chlorine, lead and halogenated
hydrocarbons. The detectors require regular cleaning and calibration, (with an impact on
maintenance costs). Pellistor sensors also require the presence of oxygen in order to operate.
Methods of Fire
Strengths Weaknesses
Detection
Smoke Detection:
Ionisation Smoke Widespread use in enclosed areas Not effective in open modules, as the
detectors detect the such as accommodation ceiling voids, smoke is usually dispersed before
visible and invisible electrical equipment and control rooms. reaching detector.
products of The detectors can be wired in series Not advised for use in areas where
combustion as they with up to 20 detectors on one loop. some smoke is expected in normal
come into contact These detectors have a high resistance operation e.g. above cookers.
with the detector. to contamination and corrosion. They
Care is needed with disposal since
are available in a wide range of
they contain a minute radioactive
versions to suit different needs.
source
Optical Smoke Widespread use in enclosed areas Not advised for use in areas where
detectors detect only such as accommodation modules. The some smoke is expected in normal
visible smoke and detectors can be wired in series with up operation e.g. above cookers.
rely on the ‘light to 20 detectors on one loop. These
scatter’ principle detectors have a high resistance to
contamination and corrosion and are
available in a wide range of versions to
suit different needs.
VESDA (Very Early
Smoke Detection
Alarm) or HSSD
(High Sensitivity
Smoke Detection)
These pull air Alert personnel to the incipient These are being widely used to
samples from areas development of a fire situation e.g. replace Halon systems removed from
susceptible to behind instrument panels, especially in control rooms, MCC or switch-rooms.
electrical fires to a unmanned control rooms or in cable They can be alarm only, or wired to
small analyser and routes. These detectors are particularly the F&G control panel for executive
check for smoke or suitable in areas with high air flow actions and/or shutdowns. These
pre-combustion ventilation. systems are relatively high unit cost
vapours. The very early warning allows and there are additional maintenance
personnel to enter the room to requirements for checking and
investigate and/or isolate power keeping air-sampling tubes clear.
supplies without undue exposure to
risk.
The reliability of the fire and gas detection system needs to be designed in at the outset of
design and then maintained at a high level of reliability and availability throughout the
platform’s operational phase. Best practice for new designs relies on good levels of
redundancy in the electronic system architecture (usually dual or triple redundancy) and will
include the following characteristics:
• Electrical fault monitoring to detect any electrical discontinuity faults which have occurred
in the system. Fault alarms should not be cleared until the fault is investigated and
removed;
As part of the current application of IEC 61508 [3.1] or IEC 61511 [3.2] (the latter being the
requirements and assessments of safety instrumented systems in the process industries
sector), the reliability and failure modes of instrumented safety systems must be considered
along with hazard probabilities and demand rates. Guidance on assessment techniques and
avoidance of failure modes can be found in this document.
Fires that have not been prevented should be detected and then controlled to reduce the size,
duration, and escalation potential of the fire. The following control methods are commonly in
use offshore. All platforms are different, but many of these control methods will be relevant to
most installations. Note that extinguishants and manual firefighting are considered below as
control methods. Deluge systems and passive fire protection methods are classed as
mitigation methods because they generally protect against the impact of an existing fire rather
than working to control the fire itself. The mitigation methods are addressed in Section 3.2.8.
Some typical fire related operational and design considerations are provided for each control
method in Table 3.3 below.
Dedicated firewalls are often used to physically separate fire areas. The basis of the
separation and the specification of the firewall are dependent upon both the fire types and
severities identified in the “fire hazard” area and the vulnerabilities of the equipment, systems
or personnel in the area being protected.
There are several grades of pre-defined firewalls and a fire risk analysis will generally choose
an acceptable defined standard rather than develop a bespoke standard (unlike designing a
blast wall for explosion hazards). Some of the general terms for firewall specifications are
described below. Firewalls’ continued performance is highly dependent upon the preceding
and succeeding events, not least how their integrity is maintained following an explosion
event. These and other interaction issues with explosion hazard management are discussed in
more detail in the section on Interactions between fire and explosion hazard management.
A division formed by a bulkhead, ceiling or lining that is constructed and erected entirely from
non-combustible materials and prevents the passage of flame after exposure to a standard fire
test for 30 minutes. It is insulated so that if either face is exposed to the first 30 minute period
of a standard fire test, the average temperature on the unexposed face will not increase at any
time during the first 15 minutes (of that test) by more than 139 °C above that initial
temperature. The temperature at any point on the unexposed face, including any joint, will not
increase by more than 225 °C above the initial temperature after exposure for 15 minutes.
A division similarly constructed as A-0 and is additionally constructed to prevent the passage
of smoke and flame after exposure to a “hydrocarbon fire test” for 120 minutes. It is insulated
with non-combustible material so that, if either face is exposed to a hydrocarbon fire test, after
120 minutes the average temperature on the unexposed face will not increase by more than
139 °C above the initial temperature and also that the temperature at any point on the
unexposed face, including any joint, will not increase by more than 180 °C above the initial
temperature.
The "standard fire test" is a test conducted in accordance with Regulation 3.2 of Chapter II-2 of
International Maritime Organization International Conference on Safety of Life at Sea [3.4].
Issue 1 May 2007 Page 103 of 493
FIRE AND EXPLOSION GUIDANCE
3.2.8.7 The “hydrocarbon fire test”
The "hydrocarbon fire test" is a test in which a specimen division which resembles as closely
as possible the intended construction and includes (where appropriate) at least one joint and
has an exposed surface of not less than 4.65 m2 and a height or length not less than 2.44 m,
and is exposed in a test furnace to temperatures corresponding approximately to a time-
temperature relationship defined by a smooth curve drawn through the exposed test
temperatures (indicated below), measured above the initial furnace temperature.
Exposed test
Time interval temperature
Temperature
(N minutes
point (increases in
after start of test)
°Celsius)
1 3 880
2 5 945
3 10 1032
4 15 1071
5 30 1098
6 60 1100
7 120 1100
Where a firewall of any class is pierced for the passage of electric cables, pipes, trunks or
structural elements or for other purposes, the “penetration” must be arranged so that fire
resistance standard of the division is not impaired. Similarly, any openings such as doors or
other access hatches must match the integrity of the division when closed and in the case of
doors be self-closing.
Passive methods are preferred where specific protection of critical process or structural items
is needed in order to prevent escalation. Widespread application to process and structural
items is not generally feasible due to weight, inspection and maintenance/replacement issues.
Modern design philosophy is to identify specific areas or items of concern (usually structure or
piping which on failure would escalate the initial event) and target these items for PFP
application. PFP is preferred over deluge in such situations since it is immediately available
and has no moving parts to fail and prevent operation.
If properly applied/installed it is highly reliable in service. However it has also been the cause
of problems in the past so current best practice concerning the design and application of such
systems, is discussed below.
Passive fire protection (PFP) comes in many forms, but the object is always to provide some
sort of heat insulating barrier between the fire and the item to be protected. PFP can be
designed for use on vessels, pipework, structural members, boundary walls or individual items
of safety critical equipment. The objective is to prevent the protected item heating up and
either losing strength, losing function, distorting or producing noxious fumes.
Previously the design emphasis was on application of codes and rules. For example,
accommodation block were given A60 walls regardless of the fire risk to the accommodation.
The system is usually designed by the PFP supplier’s engineers to the scenario-based
specification of the relevant discipline engineer (process, structural, mechanical or instrument
as appropriate for the item being protected) and the safety engineer.
For any of the systems outlined below it is up to the designer to demonstrate initial suitability of
the PFP system to the IVB and HSE, and the duty holder to maintain the protection throughout
the lifecycle. For some of the common systems initial suitability is easy to demonstrate since
the manufacturer will have a standard fire test certificate (such as A60, B15, or H120) for the
proposed system. However for some of the newer products, or existing products in severe or
novel applications such classification is not easy to obtain and the demonstration of suitability
will have to be via specially devised fire tests or research. Some considerations around
standard fire tests are discussed in Sections 7.2.1 and 7.3.2 of this Guidance.
The following types of PFP are in current use and their uses and drawbacks are discussed in
the paragraphs below and further in Section 4.4.2.
These are heavy mineral-based based coatings which can be applied to walls, structure or
pipework in a wide variety of ways from spraying or trowelling to bolting-on of pre-formed
sections. They have been used extensively offshore since the 1970s. There are many different
types available. The thickness of the coating principally determines the time it takes to transfer
the heat through the coating and the mechanical strength of the compound or sometimes an
extra outer shell, determines whether the coating will withstand the physical impact of the fire,
for example erosion from jet fire impingement or pressure waves from explosions.
Since the properties of cementitious or vermiculite coatings are well researched and many
applications have been extensively tested, classification of the protection is relatively easy to
obtain. Some systems have been tested and found capable of withstanding the impact of high
pressure jet fires.
In the 1980s and early 1990s the biggest problem with use of these coatings was that the
offshore installation process was carried out poorly. Many poorly applied coatings fell off after
a few years. Deluge water found its way beneath coatings and the fixing pins or protected
items (particularly where they were warm) corroded rapidly. Some coatings just disintegrated
with time. Products have improved significantly since the early 1990s and recent experience
has demonstrated that provided these systems are installed in full compliance with the
manufacturers’ instructions, there are few problems. However it is difficult to exercise control
over application in the offshore environment, especially in exposed areas and below main
deck levels. Therefore, wherever possible for new designs, coatings should be installed
onshore under controlled conditions before float out.
Removable PFP, in the form of enclosures or blanket wraps can be removed to allow
corrosion checks and inspection/maintenance of protected equipment. However, removable
systems are not practical in many places, being generally heavy, costly and requiring space.
Intumescent paints and coatings work by expanding to many times their original thickness on
exposure to high heat or flame to produce a fire resisting, thermally insulating coating or ‘char’.
Like the mineral-based coatings discussed above they are available in a variety of forms to
suit a wide variety of applications from protection of deck undersides to sealing of piping or
cable transits.
The possibility of corrosion under PFP coatings is a major concern for designers. For new
builds it is possible to plan for future inspection through the coating, out as explained below.
Retrofitted systems remain problematic. Although intumescent coatings can now be applied in
fairly thin layers, use in underdeck or other exposed areas and particularly in the splash zone
usually requires a thin neoprene layer under the coating and another on top to prevent
external corrosion and protect the coating. Any such thick or composite coating makes
subsequent NDT inspection results extremely difficult to interpret. It would be possible to plan
for such NDT inspection if the designer specified at the outset that sample pieces of steel were
taken and kept, coated and uncoated, for calibration purposes. This would allow results to be
interpreted with more confidence. For retrofitted systems, without these calibration aids,
effective NDT through PFP coating systems is not practically achievable at present. Research
continues but no viable methods exist at present.
Wet-applied intumescent coatings often shrink slightly as they dry out, and they usually give
off toxic gases when they intumesce. The effects on adherence to substrate plus the migration
of toxic gases to affect personnel need taking into account during design.
As for the cementitious PFP, proper preparation of surfaces to be coated with intumescent
PFP is essential for long-term performance. Intumescent systems can be specified to provide
fire protection for anything from minutes to hour, and many systems have been through fully
documented testing. Both cementitious and intumescent coating systems are continually
changing and developing so details are best obtained directly from the manufacturer.
Further discussion of common types of PFP application, such as PFP in firewalls, enclosures,
flexible wrap systems etc is provided in Section 10.3.2.2 on passive fire protection systems.
Since much of the PFP in existence on offshore installations at the current time is suffering
from ageing, 2 separate projects have been initiated. HSE and HSL are continuing a
programme started by Shell which will report on the effects of 10 years of weathering (and
ageing) on the fire resistance of PFP. A joint industry research project is underway by MMI to
determine which types of damage to PFP are most critical and what are the most effective
repair methods. At the time of issue of this Guidance, both projects were still set to publish.
In addition, ageing, weathering or other damage to PFP can cause a loss of water-tightness
and thus lead to water penetration and potential corrosion. This in turn creates difficulties for
the maintenance teams to inspect and monitor potential corrosion points under PFP.
Deluge works mitigates the effects of fires principally by providing cooling both to the fire and
to equipment exposed to radiant heat from the fire. In addition it can wash away liquid fuel fires
to drain systems or overboard. Protection of all the equipment in a module by application of
PFP is rarely practical, so the alternative is to deluge a whole module or section of structure
with large quantities of water.
• Cool the general area by evaporation of the smaller water droplets (see also various sub-
sections within Section 5.2 where the effects of deluge on different fire types are
described);
• Provide a running film of water onto equipment in the area in order to cool it;
• Provide a screen of water droplets as a barrier to radiant heat, thus reducing the heat
load on structures and equipment;
• Retard the movement of the flame front through a module and consequently reduce
explosion overpressures to some degree.
For general area cooling the key factors are application rate and water droplet size. If the
water droplets are too small, they evaporate rapidly in a severe fire or can be blown away if
the area is exposed. If the droplets are too large there is less evaporation from fewer droplets
and the cooling is inefficient for the amount of water used. The droplets however are less
affected by wind, will reach the floor, cool and wash liquid spills away and can provide a
running film of water over equipment to keep it cool. Larger droplets however require bigger
pumps, more power, and more AFFF so the cost of the system has to be balanced against its
effectiveness. The deluge rate depends on both the fire scenario and the escalation potential,
but the general rules are:
• General deluge only protects equipment exposed to flame or/and radiant heat from pool
fires or radiant heat from jet fires providing there is a sufficient deluge rate to provide a
film of running water over the equipment. Where a jet-flame actually engulfs equipment,
however, much of the film is likely to be displaced by the jet flame and the cooling effect
lost. Directed water deluge using high velocity nozzles may be used as trials have
indicated an increased effectiveness against jet fires; Section 5.2.2.2 discuss deluge
protection options in the context of jet fires.
• Areas shielded from deluge but exposed to the fire will receive some limited protection
from the heat attenuation of the deluge droplets falling between the location of the fire
and the location of the equipment. Objects subject to thermal radiation from fires (but not
direct fire impact) receive benefit from attenuation of the water sprays active between the
location of the fire and the object.
• Suppression of combustion and cooling of the high heat layer in the roof of a burning
module (where the module is partially enclosed) is known to be achievable by spraying of
very fine droplets at roof beam height. At the present time there is no method for
calculating the protection provided by this mechanism,
Further details on appropriate flow rates and other design issue for deluge systems are
provided in Section 10.3.2.4.
These are usually potable water filled systems and provided in areas where the fire-risk is non-
process related and therefore less severe, for example inside accommodation modules. They
are activated by frangible bulbs, which release water directly from the sprinkler piping as soon
as the bulb is broken by the heat of the fire in the area. Design is straightforward by
comparison with deluge systems and is usually in accordance with the applicable NFPA
standards.
Water-mist systems are now commonly being used in turbine, generator or pump enclosures
to replace Halon protection systems which are no longer permitted for use. The fine mist is
injected intermittently from pressurised water reservoirs/ cylinders, in roughly 15 second
bursts. The mist provides cooling and suppresses the combustion, which will be also be
controlled by lack of air into the enclosure (provided there is no explosion on ignition). In
enclosed spaces, protection systems need to take account of manning regimes and hence
should include warning systems to evacuate personnel as the mist systems are being armed.
Enclosure type fires tend to be non installation-threatening (but always need due consideration
within the fire and explosion review process for the installation) The protection is usually
automatic and provides immediate control, however there are a limited number of mist-
injection cycles available from the water reservoir and instruction/training for follow-up action
by the platform personnel e.g. fire team action and/or evacuation needs to be covered in
platform emergency response plans.
Gaseous systems have been a common replacement to Halon systems, but it should be noted
that Halon systems actually disrupted the combustion process; not all replacement media have
the same effect.
The fire extinguishing media can themselves present hazards, most notably CO2 which is a
powerful asphyxiant which causes hyper-ventilation exacerbating the hazard.
Inergen © has specifically been design to provide a “safer” fire-fighting medium within which
personnel can survive, providing only just oxygen to sustain breathing (with some difficulty) but
not enough to sustain a fire.
The Performance standards for SCEs should contain precise information relating to the
functionality, availability, reliability and survivability of the system in question
It is rare for platforms to have only one type of device within such systems. The ‘Fire and Gas
Detection’ or the ‘Active Fire Protection’ SCEs for example will have many different aspects,
parts or subsystems. While the ‘goal’ of the overall system will be the same, the Performance
Standards for each part of the SCE will probably be different and needs to be specified
separately within the documentation.
Some examples of different functionalities within the same SCE Performance Standard are
shown in Table 3.4 below:
Typical
derivation/
SCE Sub-item Functionality
supporting
documents
Gas detection 1. Gas detection at Detect low-level gas at 10 % (alarm) Fire and Gas
system inlets to enclosed areas and high-level at 25 % (ESD 1, close Detection
Goal: containing non-certified dampers, S/D fan). 3 IR Point detectors Philosophy
electrical equipment in each duct on 2oo3 voting
Detect loss of
containment 2. Gas detection in Detect 50 % LEL gas cloud of radius Fire and Gas
events. open hazardous areas 5m or more using paired IR beam Cause and Effect
detection in process modules. Drawings
Confirmed beam-pair detection initiates
ESD 2. Installation Safety
Case
3. Acoustic leak Detect gas leaks of 0.1 kg s-1 and In-house Vendor
detection above in process modules. Executive Design Code for
action only on coincident gas detection Acoustic
(by beam detectors) in same area. Detection
Active Fire 1.Water deluge with 12 l min-1 m-2 general area coverage in Firewater design
Protection AFFF in Process LP separator and oil metering modules philosophy
Modules including with at least 3 % AFFF to cool Installation Fire
communicating equipment in vicinity of oil pool fires and and Explosion
mezzanine and deck prevent consequent leakage from other Analysis and
levels inventories. Activated on confirmed Assessment
Flame detection (2ooN) voting. In-house vendor
2. Water mist Water mist injection to generator rooms design code for
application in to provide suppression and cooling. Water Mist
Generator Rooms A Activated on confirmed smoke or heat Systems
and B detection in generator room.
Passive Fire 1.H120 firewalls Firewall at gridline 2, process area Safety Case
Protection boundary, providing protection to TR Passive Fire
and TEMPSC embarkation areas Protection
2. J15 passive fire Fire protection of gas space of First strategy
protection on First Stage Separator to protect against jet Document.
Stage Separator fire impingement from gas export Installation Fire
system and potential BLEVE. and Explosion
Analysis and
Assessment
Note that a jet fire rating has been
proposed in the latest draft version of Vendor design
the ISO (22899-1) on the jet fire test. Code for PFP
suitable for Jet
This is specified as: Fire impingement
Type of application / Critical
temperature rise ( °C) / Type of fire /
Period of resistance (minutes).
It is important that the person responsible for devising the Performance Standard also
documents the assumptions made regarding availability, so that the design intent is correctly
understood and upheld throughout the life cycle of the installation by the operations and
maintenance personnel.
Some example maintenance arrangements for safety critical equipment are given below.
• F&G detection system – During period of unavailability of fire and gas detection in an
area due to essential maintenance, local manual surveillance for fire/gas events would
be provided at all times.
It is also important to understand that reliability figures theoretically derived from calculations
involving manufacturer’s data on ‘mean time to failure’ may be over optimistic. It is strongly
advised that platform specific information is used in evaluating equipment and plant reliability.
The manufacturer’s data may have been gained under laboratory conditions and produces
times-to-failure information that may not be reproducible in the real offshore environment or
otherwise represents an amalgam of accumulated data from a range of applications and
maintenance regimes. For example, theoretical calculations for a pellistor gas detection head,
using the manufacturer’s data may imply that an adequate reliability is achieved by a 6
monthly test and inspection frequency. In reality, if the detector is then placed in an air inlet
duct, exposed to salt, spray, temperature and pressure cycling and vibration, the time to failure
in actual service may be significantly shorter. Where un-revealed faults in safety equipment
could occur, test/ maintenance history must be monitored. If every time the gas detector is
tested it fails to operate there must be immediate feedback to the responsible engineer, that
the high reliability indicated in the Performance Standard is not being achieved. The test
frequency should then be adjusted (for example to a 3 monthly interval) until it can be
demonstrated that an appropriate level of reliability is restored.
Issue 1 May 2007 Page 111 of 493
FIRE AND EXPLOSION GUIDANCE
Voting arrangements for heat, smoke, flame or gas detectors also have a direct bearing on the
proposed frequency of maintenance interventions. For example, a detection voting system that
requires 1 detection element to be activated out of a total 2 (known as 1 out of 2 and indicated
as 1oo2), has only one other item by way of redundancy plus a spurious indication from either
item will cause unit or platform shutdown. It should be remembered that reliability
requirements encompass unnecessary activation as well as failure to activate. The “built-in”
redundancy is unavailable during maintenance of any one item. Industry good practice has
converged on 2 out of 3 voting systems (2oo3) which offer a “good” compromise of high
reliability of having 3 items available and still leaving a working arrangement in the event of a
single item failure plus the demand rate for spurious indications is lower as a confirmed signal
is always required. During maintenance this arrangement becomes a 2oo2 system. The voting
arrangements should always be stated in the Performance Standards. Where reliance is
placed on just one or two detectors to take executive action a review of the failure modes and
the consequences of failure should always be undertaken and the consequences of
maintenance changes need to be evaluated to ensure there are no knock-on effects to the
platforms overall risk profile.
3.3.5 Survivability
The Performance Standard must state the survivability requirements for each SCE and each
of its component parts where there are different requirements to those for the overall system.
This makes it clear to all concerned exactly how long the item will need to continue to function
in a major emergency in order to fulfil its safety role. For example one or more of the
communications systems and the place of temporary refuge (TR) will be required to function
as long as there are any personnel left on the installation. This may be anything from 10
minutes on a small NUI to 2 hours on a large installation. Individual fire or gas detectors
however may only need to survive for long enough to detect the release or fire and initiate the
necessary alarms, shut-downs and blowdowns. This may be only a few seconds. Valve
actuation systems may need around a minute. Whatever the specified survivability, the
information provided in the Performance Standard must be clear and unambiguous to the
reader. Experience from major disasters both on and offshore indicates that failure to examine,
understand and then communicate the survivability requirements of the provided safety
systems to the right personnel has been a major contributor to the disaster.
The written schemes must be thorough; any essential information omitted from these
documents is in danger of being left out of either the maintenance scheme or the written
schemes of the independent Competent Person, leading to gaps in the platform safety
management system. Such gaps may only come to light in the aftermath of a major incident.
The written scheme is required to be “live” through the platform’s lifetime and may be re-
affirmed at any time.
If the conservatism of simplified methods of analysis can be guaranteed, then these could be
used at an early project phase or as a first step in a sequence of analyses of increasing
sophistication.
For High or Medium risk installations, a ‘Structural Assessment’ should be performed for a
representative range of fire scenarios. The process and Safety disciplines will generally define
these Scenarios.
‘Failure’ in the context of fires means failure to satisfy the performance standards for the
installation. High-level performance standards for the installation and safety critical
components are defined in terms of allowable peak temperature, strain or time to collapse
depending on the method of analysis used.
The required initial level of analysis depends on the Risk level assigned to the installation or
the risk level associated with a representative set of fire scenarios.
The risk category of the installation does not preclude the use of more sophisticated methods
of assessment which may result in reductions in conservatism and hence cost, if they are
considered more appropriate.
Analysis Response
Risk level Load calculation bases
method calculation
Low Screening Allowable temperature (yield strength Design basis checks.
analysis reduction to 60 %
Medium or Strength level Calculate peak temperature member by Strength level analysis,
High analysis member, from nominal fire loads and fire Redundancy analysis
extent.
A structural ‘Redundancy Analysis’ of a topside structure will indicate which members can be
removed without collapse of the structure. In addition those members not supporting the TR,
muster areas, escape routes or safety critical equipment must survive during and after the fire
event for sufficient time to allow personnel on board to escape, allowing for the possible need
to assist injured colleagues. The results of a fire response analysis will then indicate which
structural members and SCEs must be protected to achieve the fire performance standards for
the installation.
• Simple fire response analyses are usually performed based on the following
assumptions [3.5].
• Unprotected structural members and panels have no variation of temperature through
thickness or along their length. In practice the critical sections of the member are
considered from the point of view of resistance.
• Fire protected structural members and panels have a constant steel temperature, the
thermal insulation has a linear variation of temperature through thickness.
• Each member may be considered to have reached a steady-state variations of
temperature are due entirely to changes in boundary conditions and incident heat
fluxes.
• Conduction between members need not be considered (except when considering coat-
back requirements).
• Thermal stresses due to restraint may generally be neglected as supports also soften
during fire loading.
The methods of analysis identified above are discussed in the following sections.
Design basis checks consist of checking the basis of the existing design for the installation and
determining if the methods used for the design are currently acceptable in the context of fire
events.
For a Screening Analysis, the Zone method may be used. The Zone method assigns a
maximum allowable temperature that a steel member can sustain. This method does not take
into account the stresses present in the member before the fire. The maximum allowable
temperature may be read from Table 3.6.
These temperature values correspond to a yield strength reduction to 0.6 of the ambient
temperature values. The fact that a fire is an accidental load will mean that the allowable
stress is the full yield stress value as opposed to about 60 % of the yield stress allowed for in
the conventional design load cases. The yield stress corresponding to 0.6 of the ambient yield
stress will then give an allowable stress the same as that for the structure before the fire.
Higher strain levels than 0.2 % may give a proportionately higher decrease in Young’s
Modulus giving an unmatched reduction in yield strength with the reduction in Young’s
modulus exceeding the reduction in yield strength. The Zone method may then not be
applicable [3.6].
A blanket critical temperature for all members may be postulated as in the Zone method. This
critical temperature is chosen typically to be 400 °C as this requires no modification to the
normal code checks if strains are limited to 0.2 % in an elastic Design Level analysis. This
approach may result in unnecessary protection and may be unconservative locally to areas of
high strain.
It will not usually be necessary to protect every vulnerable member unless the scenario
performance standards demand that the installation is required to re-start after a few days.
The above method will indicate the protection of non-essential members from the point of view
survival of the installation.
The temperature calculation for each member is performed and measures are taken to restrict
the temperatures to values below the critical temperature usually by the application of PFP
(Passive Fire Protection).
It will also be necessary to check that radiation levels on escape ways remain at acceptable
levels (i.e. below 2.5 Kw m-2), to allow for personnel on board to escape.
In investigating the effect of a fire the ‘live’ loads such as contained liquids and storage may be
taken as 75 % of their maximum values as is the case for the consideration of Earthquakes.
Alternatively, live loads may be taken as the values used in the fatigue analysis performed for
the installation if these have been properly derived.
Table 3.6 - Maximum allowable steel temperature as a function of Utilisation Ratio [3.5]
Member UR at 20 °C
Maximum member temperature Yield strength reduction factor to give UR = 1
at max. temperature
°C °F
400 752 0.60 1.00
450 842 0.53 0.88
500 932 0.47 0.78
550 1022 0.37 0.62
600 1112 0.27 0.45
If the primary structure on the installation have been designed for all credible fire scenarios to
then the primary structure will be acceptable from a fire resistance point of view.
Higher strain levels than 0.2% may give a proportionately higher decrease in Young’s Modulus
giving an unmatched reduction in yield strength and Young’s modulus. Strength level checks
may then give utilization ratios above unity. A Ductility level or ‘elastic-plastic’ method of
analysis may be required.
Table 3.7 gives the maximum allowable steel temperature as a function of strain. The peak
temperature of each member needs to be determined for the fire event to check if the
structural response remains elastic.
A scenario based Strength level analysis is performed in the following general stages:
3. If required, the probability of occurrence of the release can be estimated from published
failure statistics and the numbers of past failures which are available for most types of
vessels, flanges and process equipment generally [3.7, 3.8, 3.9, 3.10, 3.11 and 3.12].
4. Calculation of the burning rate for the fire geometry enables the extent and duration of
the fire to be determined.
5. The heat output from the fire in terms of radiation and the convection of hot air and
gases may then be determined (see also Sections 5.3, 5.4 and 5.5).
6. The heat incident on structural members and panels may then be used to calculate the
temperature/time history of the member.
7. For load bearing members, the temperature determines the appropriate values for the
yield stress and Young’s modulus of the material of the member to be used in the
structural analysis performed.
8. For panels and firewalls, which are usually non load bearing, the important parameters
are the temperature of the cold face and the time to reach certain limiting temperatures
which determine the walls’ rating.
9. It will also be necessary to check that radiation levels on escape ways remain at
acceptable levels where immediate injury will not caused (i.e. below 2.5 kW m-2).
10. A utilization ratio of up to 1.7 will be acceptable for members loaded in bending if a
small amount of plastic deformation is acceptable. A different utilization ratio will be
appropriate for detection of buckling. Shear stresses should be kept within the yield
stress for the material at that temperature. Alternatively the yield stress may be
enhanced by a factor of 1.5 to take account of the fact that fire is an accidental load.
11. Modified code checks may be made on the structural members and if load re-
distribution is neglected then the material effects and isolated plasticity may also be
taken into account in the analysis.
12. The occurrence of plastic hinging may be taken into account by factoring the
acceptable utilization ratio by the ratio of the plastic ‘Zx’ to elastic section modulus ‘Sx’.
This factor is generally greater than 1.12 and will be in the range 1.1 to 1.5. The
member must be able to sustain the formation of a plastic hinge before buckling, i.e. be
in tension or be a ‘plastic’ section.
A structural redundancy analysis will determine which members are essential for the above.
Protection of these members with PFP will complete the assessment on the basis of a
redundancy analysis.
The determination of the critical structural members may be performed using an elastic
structural frame model as follows:
3. Modify the static loading to represent the probable load at the time of the fire 75% of
the loads associated with process contents and storage may be used as suggested for
Earthquake analysis [3.6];
4. Remove safety factors in the code check, enhance the yield stress by a 1.5 factor, or
allow a correspondingly higher utilization;
5. Identify those members with the highest utilization ratios - particularly relating to
stability using the frame model;
1. The levels of heat radiation and convection from the selected fire scenarios are calculated.
2. The time history of the increase of temperature of the structural components is derived.
3. Conduction of heat from neighbouring structural components will also occur but may
generally be ignored in the primary framing analysis.
6. In investigating the effect of a fire the ‘live’ loads such as contained liquids and storage
may be taken as 75 % of their maximum values as is the case for the consideration of
Earthquakes. Alternatively, live loads may be taken as the values used in the fatigue
analysis performed for the installation if these have been properly derived.
8. The scenario based strength level analysis method will not detect failures at intermediate
or later times caused by thermal restraint from cold members. This is, in any case, an
unlikely event in the context of offshore topside structures. Imperfections or deflections for
example due to a previous explosion will not be taken into account. It will be necessary to
use a ductility level analysis to take these effects into account.
9. In view of the fact that a single scenario is only one among many, the spatial variation of
thermal loading is not generally meaningful. It is unlikely that this level of analysis will be
necessary unless a single extreme event such as a riser failure or blow-out which puts the
whole installation at risk is being considered.
10. It will also be necessary to check that radiation levels on escape ways remain at
acceptable levels (i.e. below 2.5 kW m-2).
B Maintains stability and integrity for 30 minutes when exposed to a cellulosic fire. The
temperature rise of the cold face is limited to 140 °C for the period in minutes specified
in the rating. i.e. A30 has a 30 minute time period during which temperature rise is
below 140 °C.
A Maintains stability and integrity for a period of 60 minutes when exposed to a cellulosic
fire. The temperature rise of the cold face is limited to 140 °C for the period specified in
the rating.
H Maintains stability and integrity for a period of 120 minutes when exposed to a
hydrocarbon fire. The temperature rise of the cold face is limited to 140 °C for the
period specified in the rating.
Here retaining ‘stability and integrity’ means that the passage of smoke and flame is
prevented and that the load bearing components of the barrier do not reach a
temperature in excess of 400 °C.
Insulation failure is also deemed to occur when the average temperature rise on the
unexposed face of a separating element exceeds 140 ºC or the maximum temperature
rise exceeds 180 ºC, whichever occurs first. These limits are to prevent combustion of
any material which may be close to the unexposed face. Their origins are unknown
and, in many cases, the limits may be excessively conservative.
Control implies the detection of the initiating events and actions initiated after the detection to
reduce the hazard or exposure to it. For the explosion hazard, systems will have a role in:
Where choices exist, preference should be given to passive rather than active systems of
control and mitigation.
Measures that can be used to fulfil the control and mitigation roles are given in Table 3.8
below.
Instrumented control systems rely the following generic loop to effect the control mechanism;
Safety Critical Elements (SCEs) are those items or systems that prevent or reduce the impact
of major accident events. They are identified as part of the detailed design of an installation as
required by the ‘Safety Case Regulations’ [3.14].
A typical listing of SCEs would include the items given in Table 3.9:
The above SCEs should remain functional during and after a fire or explosion event, and other
items should not fail so as to create a hazard, e.g. catastrophically collapse. The performance
of each SCE is defined in element specific performance standards against which its
performance is assessed. The element specific performance standard defines the item’s
Functionality, Reliability or Availability, Survivability and some measure of interaction with
other safety systems.
• overpressure;
• dynamic pressure;
• displacement effects;
• strong vibration;
• exposure to missiles.
The equipment specific performance standards or low level performance standards define the
requirements in terms of functionality, availability and survivability.
The Performance Standard is a means of condensing the Design Specification and Operating
Procedures into a requirement related to a particular system in a particular mode of operation
in the face of an identified hazard. The justification for the requirement and the degree to
which it is achieved is contained within the Written Scheme of Verification or Examination.
• The maximum credible peak overpressure, but very low frequency of occurrence;
• The practicable limiting overpressure for design purposes, giving ALARP risk levels;
• Overpressures giving elastic response levels in components, for early design and
robustness checks.
With systems such as gas detection, the ability to withstand a major explosion may not be
warranted, so long as the presence of the gas build up is identified. The element specific
performance standards thus need to be realistic and fit-for-purpose, taken on a element by
element basis. The performance standards need to take into account initial design and
manufacturing cost, practicability of construction, maintenance, accessibility for inspection,
reliability, robustness and redundancy.
To this end OTO 1999 046 and 1999 047 [3.15, 3.16], detailed the use of a criticality rating
system similar to the one given below:
Criticality 1 Equipment and pipes designed to withstand the same explosion severity as the
main structure.
Criticality 2 Equipment and pipes designed for a less severe but non-the-less substantial
explosion event.
The difference between Criticality 1 and 2 items would be associated with the consequence of
fire escalation and escape from the facility. It was recognised in the paper that the assessment
of Criticality 1 items would be very much constrained by project schedules and costs under
current design project philosophies. The key question though must be whether current design
practice delivers equipment and their supports which, if designed primarily for in-service
loading, provide safe and fit-for-purpose details when subjected to extreme explosion events.
Based on the limited amount of strengthening or modification to existing equipment required
for operators to delivery satisfactory Safety Cases upon their most recent submission, it must
be presumed that past designs are reasonably robust and a significant increase in design
effort would not therefore be warranted or necessary.
Criticality 1 Items whose failure would lead direct impairment of the TR or emergency
escape and rescue (EER) systems including the associated supporting
structure.
Performance Standard – These items must not fail during the DLB or SLB,
ductile response of the support structure is allowed during the DLB.
Criticality 2 Items whose failure could lead to major hydrocarbon release and escalation
affecting more than one module or compartment.
The Strength Level Blast (SLB) and the Ductility Level Blast (DLB) are defined in the Glossary,
Annex B and Sections 8.6.3 and 8.6.4.
Flammable cloud size is determined by the leak dimension and the pressure of the inventory.
The mass rate at which gas is released from a hole is directly proportional to pressure.
Reduced inventory pressure will reduce explosive cloud dimensions and the severity of the
explosion event.
A reduction in pressure will also result in a lower inventory mass within the system which will
give the potential for more rapid blowdown and reduced escalation consequence
3.5.6.2 Ventilation
Artificial ventilation is defined as that ventilation which is not supplied from the action of the
environmental wind alone. Artificial ventilation may be either induced or forced. Induced
ventilation means that the air is drawn into the space by fans located on the ‘extract’ side of
the room, the room is then under negative pressure compared with areas around it. Forced
ventilation means that air is forced into the room by fans in the intake ducting resulting in the
ventilated space being at positive pressure relative to adjacent areas.
Assuming that some loss of inventory from a hazardous process will occur at some time,
ventilation is critical in ensuring that a significant flammable gas cloud does not form or that
the cloud is reduced in size, particularly for small leaks which are the most frequent.
Industry guidance [3.17] defines ‘adequate ventilation’ as ventilation achieving at least 12 air
changes per hour for at least 95 % of the time, with no dead spots. The term ‘adequate
ventilation’ is not meant to imply an optimum level of leak dilution; it should be regarded as
minimum target. Increased ventilation rates will ensure dilution of larger hazardous leaks and
reduce the potential for explosions to occur or reduce its severity.
In the case of natural ventilation adequate ventilation needs to be confirmed. For small
wellhead platforms and NUIs this can generally be demonstrated qualitatively since
confinement is low. For more complex installations the only way of demonstrating adequate
ventilation will be either by CFD modelling of the ventilation regime, or wind tunnel testing.
Where there is inadequate ventilation the options are to re-orientate the installation to make
more use of prevailing winds, to remove confinement, to relocate equipment to provide a freer
air flow through the module and to add some fan assistance at dead spots.
A special case which typifies the various considerations that arise in the ventilation of a
hazardous area, is that of turbine enclosure ventilation. The means of managing this risk is
detailed in the HSE guidance [3.18]. This relies on fast dilution of the leak at source to prevent
significant flammable clouds forming.
If a module is open on all four sides, orientation of the installation is relatively unimportant. If,
as is often the case, one side forms a solid partition then orientation will affect the ventilation
air change rate within the module. The installation is often aligned such that the TR is directly
upwind of the process areas. This minimises potential for smoke logging or toxic gas ingress
into the TR.
Apart from smoke logging and natural ventilation, operational factors also enter into the
orientation assessment as supply vessels and helicopter approaches tend to be towards the
flow of current or wind respectively.
The preliminary QRA is likely to give an indication as to the relative risks of fire, toxic gas or
explosion. It is probable that explosion risk (including escalation from an explosion event) will
be well below that from process fires and that operational constraints of supply vessels, at
least on the larger installations, will tend to set the orientation, with natural ventilation being a
secondary consideration.
FPSOs are unique in that they orientate themselves according to the relative forces of the
current, wave and wind, called weather-vaning. Frequently the vessel will be positioned with
the wind blowing lengthways from bow to stern. This is not the preferred arrangement from an
explosion point of view as a gas cloud will extend along the deck within congested areas
rather than being blow out to the sides.
Highest overpressures in congested modules tend to arise when the ignition point is at the
furthest point from a main vent. There is potential for ignition to occur at practically any point
within the module (e.g. from hot work activities), however removing other ignition sources
away from such extremities will, to some extent, lower the potential for high explosion
overpressures to occur.
• Minimise confinement
• Minimise congestion
• Minimise flame front path length
• Reduce potential gas cloud size
• Reduce unfavourable ignition source locations
Generally, layouts that result in maximum potential for venting and minimise the potential for
turbulent flow generation, particularly in the early stages of flame travel, will reduce the final
overpressure.
For a congestion dominated explosion event the strength of explosion is dependent on the
flame path length from a main vent or from a target. For this explosion type, the largest
overpressures for a given configuration tend to arise when the ignition point is furthest from a
main vent. Keeping the dimensions of an explosion zone small will limit the potential for
overpressure generation. This also means that for a given deck area the minimum potential
overpressure occurs for a square plan area, as opposed to a long narrow plan. To achieve this
for a large complex process suggests that there will need to be a number of partitions to limit
the size of each zone. This will however tend to increase confinement and reduce the effect of
natural ventilation. A balance needs to be sought in reaching an optimum solution.
Congestion is not necessarily related to blockage ratio, more the type of blockage. The volume
blockage ratio is defined as the ratio of the volume occupied by the obstacles to the total
volume.
A large, correctly aligned, vessel may have little effect on overpressure but a number of small
bore pipes of similar volume will have a significant effect since the turbulence generated will
be greater. Since smaller items tend to give rise to the greater level of turbulence critical for
overpressure generation a suitable measure of overpressure generation potential may be the
mean diameter of equipment. This does not however take into account the amount of
equipment present. The Volume blockage ratio is a suitable measure of this. To judge the
degree of congestion in a given arrangement the volume blockage divided by mean diameter
may give a measure of congestion. These measures currently require further investigation.
Issue 1 May 2007 Page 127 of 493
FIRE AND EXPLOSION GUIDANCE
The effect on overpressure of the above recommendations can be variable and in some cases
conflicting. It is necessary to optimise the overpressure management techniques by reference
to a calculation model to confirm the downward trend. Phenomenological models may suffice
for this purpose. The intention is to identify trends in overpressure, not absolute values, it is
not then the accuracy of the model in predicting overpressure values that is required, rather its
ability to identify trends; its speed and ease of use.
The area around vents should be kept as clear as possible. Any blockage of these will result,
not only in increase in overpressure, but also in the velocity of the gases being vented.
Installations tend to have escape routes around the periphery of modules so that minimisation
of explosion consequences at vents will have less impact on escaping personnel and prevent
damage that may affect escape routes. Additionally, pipework located near vent areas will be
subjected to drag forces proportional to the square of the exit velocity. It is therefore preferable
to locate pipework away from vent areas so that they do not block the vent path but also
because the forces exerted on them may be difficult to accommodate.
Careful layout at an early stage in a design project by orientating major vessels parallel to the
expected gas flow during an explosion and avoiding the blockage of vents can reduce the
peak overpressures by a considerable amount.
Figure 3.1 shows comparisons of good and bad layout options from the point of view of
explosion overpressure.
The following observations may also be noted for the mitigation of the effects of explosions.
• When gas is allowed to expand freely the resulting overpressure is much lower than
when the gas is confined
• For the same blockage ratio several small obstacles create a higher overpressure than a
smaller number of big obstacles.
• Sharp cornered objects generate higher peak pressures than rounded obstacles.
Blast relief panels, which open quickly during an explosion in order to reduce peak
overpressures, must be carefully designed. It is unlikely that loosening of cladding panels will
have the desired effect.
These requirements will probably result in panels of a mass per unit area of less than
0.5 kgm-2 depending on the method of attachment.
Panels may be retained (e.g. hinged) if there is significant risk posed by them becoming
missiles, otherwise they can be free of restraint.
Overview
Most SCEs should be designed to operate after the explosion event (e.g. escape routes, the
TR and evacuation systems). The intention should be that these items survive an explosion
event and maintain their functionality to prevent escalation. The specific explosion effects
which an item may need to withstand are;
• static overpressure
• dynamic overpressure
• displacement effects
Heat effects tend to be transitory and the thermal inertia of most items should ensure that
thermal effects of the explosion event are negligible.
Flare/vent and firewater piping can be especially susceptible to blast forces since they are
generally of low pressure design and therefore light-weight. Damage to flare/vent lines can
result in large quantities of gas entering the module, especially as the installation will probably
be being blown down at the time. This would lead to jet fires and possibly secondary
explosions. Damage to firewater lines would result in the loss of fire control measures within
the explosion zone. Means of protecting these lines will include and or all of the following:
• not running these lines near vent areas where blast wind forces will be high
• increasing the schedule of the lines to increase inherent robustness
• increasing pipework supports
• running these lines in the shelter of structural elements
Subsequent to this will be the rebound effects as the structure then oscillates. These
phenomena may occur in a wave as the overpressure moves through the module in a
congestion dominated explosion. These displacements will have significant impacts on any
items fixed to structural elements that are moving differentially to each other, for example,
pipes that run from floor to ceiling, or run from a floor mounted vessel to the ceiling. Relative
displacements can be considerable, 10’s of centimetres, so that forces potentially acting upon
items spanning structural elements can be large.
As with all potential hazards the aim should be to avoid the situation occurring, that is, by
avoiding arrangements where items are attached to floor and ceiling. This may not however be
reasonably practicable. If this is so, sufficient resilience should be included in the design to
accommodate the differential movement. This may be achieved using resilient mounts or by
the building in of flexibility to the piping runs.
Good design practice however should be employed to mitigate the consequences of this
severe vibration, this involves;
• the location of vibration sensitive safety critical elements distant from potential
explosion zones, especially not attaching them to common boundaries;
• the use of shock or resilient mountings to absorb vibration effects;
• additional restraints to items that may topple and cause damage or lose function, e.g.
cabinets, bookcases;
• slack in cables where displacement of control or electrical equipment is possible.
Missile prevention
Secondary missiles are those picked up by the blast wind produced during an explosion. The
blast winds can reach sonic speeds, therefore there is potential to move objects of a significant
size. Maximum blast wind speeds are found around the edges of the module where explosion
gases are venting. In most modules this is where escape routes are located so these are the
areas where personnel are in most danger from impact from missiles, and being knocked over.
The philosophy for minimising the potential for missile generation is to ensure general tidiness,
especially in the hydrocarbon processing areas and areas adjacent to the TR. Small items
such as fire extinguishers and items of safety equipment should be kept in cabinets firmly fixed
to the structure preferably against a partition or structural member where blast wind will have
little effect. There should be no loose items in the module, i.e. items that are not fixed to the
structure or substantial equipment items. Maintenance equipment such as scaffold poles and
tools should not be stored in process areas and should be removed when no longer required.
3.5.6.10 Deluge
The Phase 3a Advantica tests at Spadeadam [3.24] confirmed that deluge can significantly
reduce high explosion overpressures. The benefits of deluge have now been incorporated into
the major CFD and some phenomenological simulation software. Fears that the deluge would
provide an ignition source through electrostatic effects have proved unfounded [3.25] although
there is a residual doubt about the ignition potential due to charge accumulation on isolated
conductors e.g. scaffolding. The initiation of deluge and water curtains on a quiescent gas
cloud may induce turbulence in the cloud, limit ventilation and mix an inhomogeneous cloud.
These effects could give rise to higher overpressures.
The mechanism by which this mitigation occurs is by inhibition of the combustion process and
by cooling of the products of combustion as the deluge water is converted to vapour.
Deluge from standard medium velocity (MV) or high velocity (HV) nozzles has been found to
be suitable for reducing overpressure in congestion generated explosions. Congestion
generated explosions are characterised by a fast moving flame front. This acts on the droplet
to break it up and give a greater overall surface area so that it more efficiently achieves the
quenching effect on the combustion mechanism. The usual general area coverage rate of
10 l min-1 m-2 [3.26], even with 15 % added for hydraulic imbalance, falls outside the rate
investigated in the JIP tests [3.24]. If explosion mitigation is considered critical a deluge
flowrate of at least 13-15 l min-1 m-2 is recommended for general area coverage. This will have
a significant effect on lowering peak overpressures. Greater flows up to about 20 l min-1 m-2
will have a marginally increased benefit.
For large open deck areas, such as F(P)SOs, the process area is generally divided into fire
zones in order to limit the size of the firewater pumps. On large open decks firewalls are not
generally practicable so the deck is divided into fire zones where fire events may be expected
to be confined; these may be discrete process blocks or pre-assembled units. Firewater
pumps are sized to deluge the zone in which fire detection takes place, and immediately
adjacent zones.
Large gas clouds can, however, cover a number of such fire zones. This means that there is
insufficient water supply to cover the whole flammable cloud. For these applications and where
equipment specific deluge only is installed, water curtains may be used to arrest the flame
velocity and prevent runaway flame acceleration. A double curtain of MV nozzles supplying
water at a rate of about 15 l min-1 m-2 for the area covered by the curtain and spaced at 10 m
intervals should be effective in arresting runaway flame acceleration and prevent excessive
overpressures. Other devices such as fan sprays have also been tested and may give
coverage more suited for curtain use.
Deluge would then be applied to the fire zone where initial gas detection takes place with
water curtains supplied simultaneously from a separate deluge valve.
Some CFD overpressure modelling programs can accommodate the effect of water curtains
so an optimisation of frequency and coverage of curtains within the practicalities of firewater
demand can be undertaken.
A major problem in determining risk levels for an installation with explosion mitigation by
deluge is determining the level of risk reduction that can be assumed. This is due to at least
two factors;
• the delay between leak initiation and deluge being applied to the module;
• the reliability of the deluge system, from detector device through to deluge nozzle.
For the majority of low explosion over-pressure events there is no benefit particularly if the
coverage is incomplete
These factors can be however estimated from knowledge of the equipment and systems within
the module.
The benefits of explosion mitigation by general area may deluge may only be considered only
if a time dependent ignition probability is used and the deluge can be applied within the
reliability constraints of the system.
• inert gas
• barriers
• soft barriers
• micromist
Inert gas
Inert gas can be used to dilute the flammable mixture by flooding the volume within which the
gas has been detected, with for example CO2, N2. The explosive gas can then be taken below
its lower explosive limit. This is most appropriate for enclosed volumes where the environment
can be controlled. Care should be taken in providing such systems as they can pose a
significant asphyxiation risk to personnel and they should be discounted if the overall risk of
using them is greater than the explosion/fire risk saved. This might particularly be the case for
generally manned areas.
Inergen © (CO2 + N2 + Ar) is an alternative inerting material but it has a volume 30 times that of
Halon systems for which it is a possible replacement.
Barriers
Barriers can be used for four purposes;
1. protecting areas behind the barrier from the overpressure effects generated in the
explosion zone;
2. limiting the size of the explosion zone and thus the largest dimension over which the
flame can propagate;
3. limiting cloud spread to ignition sources;
4. limiting the number of people directly exposed.
Blast walls have long been used to protect adjacent areas from the effects of overpressure.
These walls are designed to absorb blast energy by displacement. There may be a partition
wall (e.g. B15 partition) on the non-hazardous side which will move sympathetically with the
blast wall, the air gap between the two acting as a spring. If the wall forms the boundary to a
control area housing safety critical equipment the effects of this movement needs to be taken
into account. That is, shock sensitive equipment should not be located along this wall unless it
can be demonstrated that the effects will be negligible.
By limiting the size of an explosive gas cloud the overpressure can be reduced. As long as
confinement is controlled decreasing the size of a module by inserting barriers can result in a
reduction in maximum flame path length and therefore a reduction in the overpressure
generated. It is important that these barriers maintain their integrity and do not give rise to their
own hazards by displacement and impacting on safety critical plant or by becoming missiles.
Mitigation measures aim to protect personnel or equipment from the explosion event.
Protection from the direct effects of blast can be achieved by the barrier method, that is, the
intervention of a blast wall between the explosion zone and the area to be protected.
Progress is being made in the manufacture of the Micro-mist device [3.27] which has been
tested as part of a recent joint industry project and consists of a cylinder of superheated water
which is released quickly as a fine mist in response to pressure, flame sensors during an
explosion. This device suppresses the explosion and has been shown to be successful in
significantly reducing overpressures. Accidental activation of these devices is not a hazard to
people.
The early “ship-shaped” vessels, developed in the 1980s, took advantage of a severe
downturn in the tanker market and were converted from relatively new tankers. More recently,
the tendency has been to use new, purpose-built, ship-shaped hulls, particularly for FPSOs
associated with long lived projects. Conversions of tankers, both old and new, continue to take
place. There are many different types of design, weather-vaning with internal or external
turrets or spread moored that maintain a fixed orientation.
The FPSO and the FSO present many of the same hazards to personnel and the environment,
although the added complexity of production facilities on the FPSO increases associated risk.
The guidance in this section relies heavily on the published guidance of UKOOA, [3.28] and
the draft guidance being prepared by OGP [3.29]. This Guidance will adopt the OGP
nomenclature and when considering an issue applicable to both types of floating installation
will use the term F(P)SO.
A number of features impact fire related hazards on floating installations; for example, the
geometry of the layout, compartmentalisation, operations, fire scenarios, response
characteristics of marine construction to fires and the vulnerability of marine systems
associated with the motion, station keeping and stability. The effects of fire on these features
are discussed further in the following sections.
• As the process and utilities modules are normally located above the vessels deck (and
the cargo storage), the process and utilities deck areas will be large, usually of one or two
levels. Segregation to avoid escalation of a fire can be achieved by separation of
modules occasionally further separated by fire barriers, (this may or may not help
explosion overpressures but will impair the dispersion of released hydrocarbons).
• The fire risk analysis undertaken on F(P)SOs will consider the nature of the hydrocarbon
fuel source as well. Due to the nature of the storage on F(P)SOs, the fields they are
generally use for tend to be crude that can be stabilised fairly readily. F(P)SOs may be
required to hold stored product in their cargo tanks for typically 3 to 7 days dependent
upon their geographic location. The F(P)SO solution is therefore less favoured for more
volatile reservoirs.
• The (potentially) long process and utilities decks and their orientation with respect to wind
conditions will be affected by the weather-vaning of the F(P)SO. The top decks should be
designed to follow a hazard gradient from the most hazardous area with respect to fires
(and explosions) to the least hazardous. This will generally be from the turret outwards.
Due to the weather-vaning effects (either due to wind or current and their effects on the
superstructure height and hull draft) the fires can escalate downwind and at the very
least, toxic products of combustion will be distributed downwind. The layout should
consider these additional hazards and the design should accommodate them to maintain
levels of safety. (Some designs have used DP to adjust the F(P)SO orientation in the
event of a release or a fire hazard although the DP then becomes a Safety Critical
Element and subject to the development of Performance Standards and integrity
assessments required in the UKCS.)
• On an F(P)SO, escape routes and piping runs may be very long and tortuous and
personnel may need to pass the origin of the incident to reach the Temporary Refuge.
Consideration in the design of escape over long distances during incidents and incident
escalation should be a key issue.
• Fire water mains will also be extensive and distant from the fire pumps in the process
area. Correct fire-pump sizing and firewater-main hydraulic analyses will be required to
ensure adequate pressure at deluge points, hoses and monitors.
• Buoyancy, stability and station-keeping must be maintained at all times, and the systems
associated with these duties must be protected from fire hazards.
F(P)SOs also require specific consideration of major fire hazard and release scenarios unique
to their design and operation.
• Oil storage tanks – May present hazards in the form of either large scale storage of
stabilised crude or with empty storage tanks containing potentially explosive mixtures.
• A gap will allow “green water” to flow over the main deck without placing an excessive
load on the process modules supports by creating restrictions and eddy current effects.
• A gap allows a clear and uninterrupted space for long piping runs (both process piping
and storage tank vent and balancing lines)
• A gap allows personnel access across the vessel, both for normal operational and
maintenance access as well as facilitating emergency response.
• Swivel connections, a source of releases – The turret contains a large number of swivel
joints in order to function, these are often at the highest process pressure and pass the
reservoir fluids prior to any cleaning or conditioning and are therefore subject to the
F(P)SOs most onerous process duty.
• Offloading and pool fires on the sea – Offloading to shuttle tankers is a regular event and
poses a significant risk both on the F(P)SO and the shuttle tanker. The risks comprise the
breakage or leakage of the transfer hoses and the potentially flammable mixing of
hydrocarbon and air in the storage holds of F(P)SO and shuttle tanker. During the
offloading operation, the shuttle tanker and F(P)SO are in relative proximity and the risks
on either vessel are compounded by increased potential for escalation to another vessel.
The storage and transfer of hydrocarbons on F(P)SOs present particular hazards to personnel
and the environment and some of these have been listed above. This sections describes
further measures that can be applied to the management of fire hazards in the F(P)SO
topsides.
There is a need to continuously vent hydrocarbon vapours during loading, it is important that
the venting system be designed to accommodate the maximum volume of volatile organic
compounds (VOCs) vented from storage. Allowance must be made the higher temperatures
the vents will experience when venting during maximum production rates and as well as
providing design allowances for possible process upsets. In some areas, local regulations or
guidelines limit the amount of VOCs that may be released to the atmosphere. It is always good
practice to adopt loading procedures that will minimise VOC emissions.
The atmosphere in the F(P)SO tanks is to be maintained in a ‘non explosive’ condition. The
normal method is to supply low oxygen content combustion products to the tanks from boiler
uptakes or from an independent oil or dual fuel generator.
Cargo tank purging must be carried out before introducing air to the tank to ensure that the
atmosphere will at no time enter the flammability region. The guidelines given in Chapter 10.0
of ISGOTT [3.30] should be strictly adhered to during this operation.
It is recommended that the inert gas system comply in all respects with the requirements of
SOLAS and the relevant IMO guidance notes. Prudent operators may also consider
maintaining 100 % redundancy for this critical component.
After purging, the tank must be gas freed in order to remove the residual inert gas from the
tank and replace it with a normal atmosphere containing 21 % Oxygen.
The issue of VOC return lines and their use during offloading represents a key safety issue.
The operation of VOC reclamation represents a highly hazardous situation where flammable
mixtures of hydrocarbons are returned to the F(P)SO. An added complication is that the
offloading and reclamation systems may often be combined as a dual hose system and for
F(P)SOs with stern accommodation, the offloading and reclamation point may be located close
to the accommodation and TEMPSC.
Due to the longer term storage (compared with most other offshore installations), water and
other contaminants in the crude can accelerate corrosion of the F(P)SO storage structure and
systems resulting in premature failure and, potentially, escape of hydrocarbons. Design
allowances should not be based on ideal crude conditions but should consider a realistic
appreciation of operational practices.
The layout of surface and sub-sea facilities must be carefully considered early in the design to
account for the following shipping related hazards (that may give rise to loss of integrity and
fire):
• Safe access by offtake tankers, avoiding interference with other moorings, flowlines
and risers as well as other field operations.
The field layout must also consider the need for offtake tankers to approach the F(P)SO, moor,
load their cargo, unmoor and proceed to open waters, always in safety. The parameters for
achieving this, which will include manoeuvring areas and weather limits on operations for the
tankers, may be derived by means of a risk assessment study as described in OCIMF
Offshore Loading Safety Guidelines: With special reference to harsh weather zones [3.31].
Additional reference material for Offshore Loading may be found in UKOOA’s guidelines for
tandem off-loading from FPSOs/ FSUs to shuttle tankers [3.32].
Thrusters may also be useful in fire or platform abandonment scenarios where the vessel can
be rotated to clear fire or smoke from around production areas and living quarters and to
provide a lee side for survival craft launch. When designed for a safety function, it should be
noted that thrusters will be considered to be Safety Critical Elements.
Due to the vessels being in very close proximity, the risk of a fire or explosion on one vessel
affecting the other is greatest during offloading.
Most MOUs in the North Sea are of two types, Semi-submersibles and Jack-ups. Semi-
submersibles have more in common with floating structures while jack-ups have more in
common with fixed structures. This specialist subset is termed Mobile Offshore Drilling Units,
or MODUs.
Though they are fundamentally different from each other, they do have one thing in common.
They are vessels subject to the Conventions and Codes of the International Maritime
Organisation, or IMO, and thus emanate from a long-standing marine tradition.
• Hazardous areas.
The ABS published Classification Guidance contains a whole chapter on Fire Safety Features,
including:
• Fire pumps;
• Fire main;
• Fire detection/alarms;
• General alarm;
• Fireman’s outfits;
• Other PPE;
• Helifuel;
• Paint lockers.
Any reader will quickly note there is a distinctly marine “feel” to the rules. This is appropriate
as hydrocarbons are seldom present on MODUs as much of their time is spent in transit
between locations, thus the threat of types of fires that occur on ships is given attention. In the
main, Conventions and Codes of the IMO are meant to apply to vessels on international
voyages, not when the vessel is undertaking its industrial function. Though these rules are
prescriptive, the great number of ships in the world’s fleet lends of validity through experience.
Marine tradition refers to conventional ships on long distance voyages who must cope with
mishaps such as shipboard fires and explosions with faint prospects for immediate rescue.
This tradition has within it the experience of thousands of ships but scant experience of live
hydrocarbons. Perhaps it is best characterised as highly worthy knowledge in its own right but
not directly coincident with the newer oilfield traditions.
Obtaining and remaining in class is very important for a MODU. Otherwise, it would not be
able to obtain hull insurance. Minimising losses is important for underwriters so MODUs are
able to benefit from loss reduction strategies of the world’s fleet of ships, and the considerable
reservoir of experiences thus represented.
MODUs are also subject to flag-state rules for operation under the conventions (roughly
equivalent to regulations) and codes (roughly equivalent to guidance) of the IMO. The flag-
states are responsible for enforcing the conventions and codes of the IMO through their
national legislation. The most significant IMO instruments are the international conventions for:
3.7.3.2 SOLAS
Part D – Electrical Installations: Precautions against shock, fire, and other hazards of
electrical origin
• fire pumps;
• fire mains;
• hydrants/hoses;
• foam systems;
• water systems;
• ventilation;
In addition, details for passenger ships, cargo ships, and tankers are given and will be of
interest.
There are two versions of the MODU Code. The 1989 Code [3.38] is meant to be applied to
units constructed after 1 May 1991. The 1979 version of the Code applies to earlier units. The
1989 Code addresses fire/explosion safety in the following chapters: -
4.7 – Arrangements for oil fuel, lubricating oil, and other flammable oils
5.5 Precautions against shock, fire, and other hazards of electrical origin
Chapter 6 – Machinery and electrical installations in hazardous areas for all types of units
6.1 to 6.7 – Zoning of hazardous areas and the types of machinery in these areas
MODUs operating in the North Sea area are generally prepared to drill a range of wells of
different types in order to meet the needs of the client oil companies. Though there are fire
risks from flammable materials on MODUs, about half the risks with the greatest
consequences are presented by the hydrocarbon accumulation the MODU has been hired to
exploit. The Formal Risk Assessment required in a UK or North Sea Safety Case overlays all
the provisions from fire and explosion protection that Classification, the flag-State rules, and
MODU Code. However, there are two main differences.
1. The rules emanating from the IMO are prescriptive. The risk reduction model is the
marine industry acting on the experiences of the world’s shipping fleet.
2. The model of model of application is for ships on international voyages, not vessels
undertaking industrial processes.
Generally, oil companies hire MODUs to pursue drilling campaigns. The campaigns can be
short (one well of less than 30 days duration) or as long (3 years or longer on rare occasions).
In the UK, it will be necessary to for the MODU to have an accepted safety case before drilling
can begin. The main hazards a MODU faces are listed below:
• Helicopter crash;
• Fire;
• Explosion;
• Blowout;
• Toxic release;
• Dropped object;
• Mooring failure;
• Ship collision;
• Loss of stability;
• Towing incident.
The most serious of these incidents requires a PFEER Assessment [3.39] in order to be sure
the personnel can escape to a place of safety. The hazard assessments generally undertaken
for MODUs start from the hazard list described in Table 3.10. It is worthwhile pointing out that
the MODU Owner will generally engage the crew in a compartment-by-compartment analysis
for fire and explosion risk. This utilises the greatest knowledge asset on the rig, namely the
crew, who are exposed to the risk. Following from this approach, the qualitative method is
preferred. The quantitative assessments (QRA) that take place are generally done to meet
statutory requirements for integrity of the Temporary Refuge. The QRA calculations are most
often carried out by consultants outside the MODU Owner’s organisation. The crew are
generally not in the habit of assimilating this level of detail of information.
Half of the events in Table 3.10 above that cause serious concerns on a MODU involve fire
and explosion. This is a very significant proportion. Thus, the question occurs as to how the
fire and explosion expert(s) might apply themselves to reducing the risks faced by MODUs.
The information given below is meant to stimulate further consideration. Particular
circumstances and personnel roles will have large roles to play.
From the hazard events itemised above in Table 3.10, it can be seen that of 16 event
categories, 8 consider fire (and explosion) events. Event categories in item numbers 1, 2, 3, 5
and 6 are caused by well upsets and three of the remaining hazard categories consider non-
well events such as;
1. Accommodation fire
2. Machinery space fire/explosion
Which is common to all installations and is considered by the design guidance in CAP 437.
The inspection of helidecks is covered by BHAB inspection of the installation.
Many oil companies use 3rd party inspectors to perform pre-hire checks on the rigs they intend
to contract. The items listed below cover many equipment categories that the surveyors
generally cover which will have an impact on fire and explosion hazards.
• Electrical safety;
• Breathing apparatus;
• Electric safety;
• Safety.
Classification societies will carry out surveys of vessels to ensure that they continue to comply
with class requirements; these will be carried out against the rules issued by the class
societies referred to throughout this section. The survey reports generally stay on the unit and
at the field office.
The well programme lays out the plan for drilling the well, including predictions for formations
to be encountered, along with the types of fluid in the formations (oil, water, or gas). Part of the
programme will deal with site assessment, covering the prospects for encountering shallow
gas. The programme should offer information regarding whether H2S is likely to be
encountered. The type mud system to be used will be detailed for each hole section. If well
testing is foreseen, the details of the flow rates likely to ensue will be given along with the
duration of the test and the sampling foreseen. Well testing is given separate treatment below.
For the MODU Owner, the benefit of a statutory Well Examination is that the programme is
fixed in good time for the MODU operator to interpret the results and implement remedial
measures. The Well Examination process also ensures there is a process for ensuring
changes are subject to risk analysis.
The well programme covers 5 of the 8 contingencies involving fire and explosion.
Though the Well Programme covers the objectives of well testing, it may not provide copious
detail on the well testing equipment. On many rigs, well testing equipment is not permanently
installed. It is brought to the rig when well testing is foreseen. On rigs where the installation is
permanent, maintenance of such equipment is not generally within the core skill and
experience of the drill crew.
Few drilling specialists have extensive experience testing wells. The Safety Case can only
generally cover the well testing equipment and cannot be very specific as there are many
different manufacturers, different layouts for this equipment, and different crews generally man
the well test equipment. Therefore the constructive overview of a fire and explosion specialist
should be included in these circumstances.
The following is written from the perspective of an oil company contracting for the services of a
MODU. Generally, the oil company will likely have staff or have access to internal or 3rd party
specialists specialising in fire and explosion; MODU Owners generally do not. In this situation,
it seems natural for the oil company specialist to at least have an overview. It is probably sub-
optimal to ask the MODU Owner to do everything; on the other hand, it is probably sub-optimal
to make numerous in-depth enquiries of the MODU Owner when many aspects are covered by
Classification or Flag-State rules. A co-operative, balanced, and constructive overview into all
aspects of fire and explosion aspects is recommended.
Any enquires should respect the culture and strength of the MODU Owner. Chief amongst
these is that the MODU Owner’s greatest asset is the crew. Some of their number will have
participated in or have knowledge of the rig’s treatment of fire and explosion. Rig crew use the
“hands on” approach. Thus, their expertise can best be assimilated by use of qualitative
information as this is the type of information with which they are most familiar.
The nature of shipping rules has been that they are the accumulation of experience, derived
from incidents, near-misses and other “lessons learned”. The information contained within
these prescriptive rules is therefore statistically valid and represents a distillation of experience
from the world’s shipping fleet.
Item Overview
MODU Be aware of the Classification Society. Look up and become familiar with
Classification their rules. The MODU Owner will have records of the ongoing surveys.
Flag-State Be aware of who the flag-State is. Look up and become familiar with their
rules. The MODU Owner will have records of the ongoing surveys.
MODU Code Be aware if the unit has a certificate and whether it is 1989 or 1979. Be
familiar with what it contains.
Safety Case Be aware of the analyses in the safety case for fire and explosion,
especially those with PFEER Assessments. They represent the risks with
the most severe consequences.
Pre-hire survey Have a look at the fire and explosion aspects of the pre-hire survey,
provided, of course, such a survey was performed.
Well Programme Have a look at the well programme from the point of view of the MODU
Owner. Judge whether you would be happy with the information in the
programme in terms of preventing fire and explosions? If not, it would be
a service to both oil company and MODU Owner to point out where better
information would be beneficial.
SMS Audits The MODU Owner’s own audits can provide information on the standard
of maintenance. It would be a good thing to be aware of the audit
findings. Further delving could be undertaken if an overview gave cause
for concern.
Verification of The same comments apply here as above for SMS audits.
Safety-critical
Elements
Well testing Probably the area where the fire and explosion expert might make best
input. Well testing can be infrequent and thus less familiar. An overview
of the equipment, procedures, and risk analyses may well prove
beneficial in terms of risk reduction.
The assessment of existing structures differs from the assessment of a structure during design
in three important respects.
1. There is relatively little scope for the reduction of the frequency of a release and
scope for mitigation of the severity of an explosion may be limited.
Information should be available from the Safety Case, the original CAD and structural
computer models of the facility. The Individual Risk (IR) per annum TRIF and PLL will have
been used in the demonstration of ALARP in the existing Safety Case for the installation.
Use may be made of experience gained from the operation of the un-modified installation and
from similar installations. The computer data files and design reports should be checked to
confirm that they are a faithful representation of the present state of the facility.
Should modifications be necessary to improve the safety performance of the facility, then the
work to be undertaken should not in itself pose such hazards and risk to personnel that this
compromises the gains to be achieved by such modifications. All modification work should be
accompanied by hazard identification, assessment and other controls as determined by the
Safety Management system as well as method statements for their implementation.
All temporary structures and equipment utilised during the modification work should be
removed as soon as the work is complete.
The HSE reference [3.41] clauses 51 and 52, states “It should be borne in mind that reducing
the risks from an existing plant ALARP may still result in a level of residual risk which is higher
than that which would be achieved by reducing risks to ALARP in a similar, new plant. Factors
which could lead to this difference include the practicality of retrofitting a measure on an
existing plant, the extra cost of retrofitting measures compared to designing them on the new
plant, the risks involved in installation of the retrofitted measure (which must be weighed
against the benefits it provides after installation) and the projected lifetime of the existing plant.
All this may mean, for example, that it is not reasonably practicable to apply retrospectively to
existing plant, what may be demanded by reducing risks (to) ALARP for a new plant (and what
may have become good practice for every new plant).”
The overall individual risk and the TR impairment frequency (TRIF) from all hazards must still
be less than 10-3 per year. If risks are in this intolerable region then risk reduction measures
must be implemented, irrespective of cost.
Review of explosion risk for existing installations, poses a number of difficulties. These
problems generally relate to the difficulty in retrofitting structure and equipment in modules that
are operational and congested, with the usual constraints in working in a cramped offshore
environment. There may also be a problem accessing design data which should include
modifications that have taken place since the facility was installed. The implementation of
effective change procedures is essential in these circumstances.
Before investigating the ability of the systems on the installation to withstand the blast effects,
the facility should be reviewed with regard to the level of inherent safety that exists and what
additional control mechanisms there may be for overpressure reduction. The existing wells
may be operating at a lower reservoir pressure than originally designed for, however
subsequent tie-ins may have offset this possible benefit.
• increased venting
• additional and/or improved gas detection (acoustic gas detection)
• introduction of flame detection
• lowering the level at which gas detection initiates executive actions
• voting for executive action on a single detector
• initiation of deluge on gas detection
• the removal of redundant equipment
• the relocation of equipment blocking vent paths
• vibration reduction
• enhanced robustness of small bore connections
• utilisation of past operational experience
• improved inspection/maintenance regimes
Some of these actions may not necessarily result in a reduction of calculated Individual Risk or
loss of life (as shown in the QRA) but this should not be a reason for failing to undertake
modifications if actual reduction in explosion risk can be foreseen.
Ideally, there should be no disproportionate contribution from any one hazard to the risk
associated with the installation. For example fire and explosion hazards should contribute to
the total risk at levels comparable with those for a similar installation. This is referred to as the
‘balanced risk contribution principle’.
The general philosophy should be to bring all SCEs up to a similar level of integrity for all
accidental events. These systems include but may not be limited to:
• the TR;
• escape routes to the TR;
• evacuation systems;
• systems that could threaten the integrity of the above systems, e.g. ESDVs isolating
off-site inventories.
In effect the list may include all the identified safety critical elements but, with respect to the
ability to muster, assess and evacuate, some Safety Critical Elements may be in Criticality
Levels 1, 2 or 3 as described in Section 3.5.5.
A review will need to be undertaken of the ability of safety critical systems to withstand
overpressure/drag effects. Whilst increased knowledge of the explosion phenomenon has
resulted in a general increase in the overpressure loadings that are calculated for a given
configuration, it is frequently the case that the integrity of systems is greater than originally
assumed. The experience of the JIP full scale tests [3.42, 3.43 and 3.24] tended to confirm this
in that damage incurred was significantly less than might have been expected for the high
overpressures experienced.
(Note: the requirements of the SCR [3.14] imply that some form of overpressure calculation
will be necessary in order to quantify the risks involved in mustering within the TR. The need to
determine potential for TR damage would then seem to be necessary).
The aim should be to bring the design up to the same level of integrity for all major SCEs with
the presumption that more effort should be made where the level of risk from explosions is
high. Existing installations will have QRA data from which explosion risk can be determined.
Where this is high for explosion events the premise should be that greater cost is justified in
providing mitigation and protection than where the risk posed is relatively low.
A means of determining the cut off point for additional mitigation would be to determine the
costs involved with design enhancement to achieve integrity for successively increased
overpressure values. Where a significant ‘cliff edge’ occurs this may indicate that design
beyond the base of the cliff edge is not reasonably practicable and that design to this level is
ALARP.
The accepted level above which the overall risk is considered intolerable relates to an
individual risk of greater than 10-3 per year or a TR impairment probability of greater than 10-3
per year. The overall individual risk from all hazards must be less than this value. If risks are in
the intolerable region then risk reduction measures must be implemented, irrespective of cost.
Hence the risk from other hazards may indirectly affect the acceptability of risk from explosions
and these may need to be considered in setting the target risk levels for the explosion hazard.
Where the original design took account of explosion overpressure, but latest knowledge
indicates that this needs to be reviewed, then recalculation and re-assessment will be
appropriate. The calculation of overpressure should however be reasonably straightforward if
the original CAD model is available and has been updated to include changes made since the
design stage.
Nowadays, plant modifications are closely scrutinised by a range of discipline engineers and
onshore support staff for any detrimental effect on safety. Accumulated minor operating and
maintenance changes (known as ‘creeping change’) however can go unremarked, unless
vigilance is maintained.
• PFP left off vessels or other equipment for longer and longer periods to allow access
for NDT/inspection;
• Areas of the platform always ‘keyed out’ of the automatic fire and gas system;
If minor deviations go unnoticed, over time it becomes custom and practice to operate outside
the original design scope, and/or without all protective measures functioning. Problems then
become apparent only during an emergency situation.
Many of these minor changes would be identified by the independent competent person during
the course of his examinations of safety critical equipment and systems, but some changes
can still be missed.
Most oil companies include operations personnel in their project teams. Often the intended
OIMs plus key offshore supervisors are part of the project team specifically to become fully
conversant with and supply operations input to the design process. Over a period of 10 years
or so however, personnel change and key information, whether held personally, in hard-copy
or in electronic format is likely to be lost if no active steps are taken to refresh the ‘corporate
memory’ at regular intervals. In addition, over a prolonged period new research improves the
understanding of the fire and explosion threats and the ability of the protective measures to
counter the threat effectively. The implications of this updated knowledge must be taken into
account and where necessary procedures updated including those related to emergency
response.
It is possible on some installations, where parts of the process have been simplified or
decommissioned or where drilling activity is finished, to review a platform’s fire hazard
management arrangements and remove fire protection equipment that is, by then, surplus to
requirement. This can reduce the maintenance burden. Any such modifications have to be
formally justified and recorded through the Operator’s Plant Modification Request procedures,
and documented in the Safety Case and associated PFEER/DCR documentation.
Despite the associated cost of maintenance and inspection, the performance standards laid
down for of all the safety critical systems, subsystems and individual items must either:
• Revised (with appropriate justification) to reflect the changing fire risk. The associated
written schemes would be updated to reflect the changed performance standard in
discussion with the appropriate Independent Competent Person(s).
Many installations in the North Sea have reached the end of their originally specified life but
their continued operation is still worthwhile. Other installations have been modified to act as
production hubs, taking product from other subsea wells or tie-ins and processing it, often with
new or partially modified topsides plant, for export to pipeline or tanker.
Asset life extension raises several issues in relation to fire hazard management, these are
discussed in the following sections.
New process plant needs to be provided with adequate fire and gas detection systems. The
existing systems may be adequate to cover the new equipment or may need extending, but
the same considerations as for a new design will still apply. The existing system may be
virtually obsolete and not feasible to extend so replacement of the whole system may be
required.
The effect of the new plant on the ESD and blowdown systems must be evaluated in the light
of the additional fire scenarios. It should not be assumed that tie-in to the existing platform
blowdown system will be adequate, even though original demands on the system may have
reduced. If the installation is old, the original blowdown system may have been under-
designed by comparison with existing best practice especially where severe fire scenarios are
involved.
All new fire scenarios must be reviewed for effect on existing deluge systems. A fire in the new
plant may set off several other systems, especially on an open installation. The project may
have to supply new fire pumps to cover the new plant as the existing pumps are unlikely to
have spare capacity. The condition of existing pumps for extended future service must be
assured.
More use of passive protection may be possible, but providing facilities/access for integrity
assurance for aging piping/structure/equipment must be considered.
Existing deluge systems are often difficult to extend. The mechanical condition of the system
needs to be assured for extended service. There may now be a new fire scenario with
implications for important parts of the structure (e.g. the TR or TEMPSC areas or their
supports) which are currently unprotected. (See Sections 3.2.8.9 and 10.3.2.2 for further
discussions on the limits to PFP application, including some issues affecting retrofitting PFP to
structures in situ). All escalation potential should be considered and the decisions relating to
selection of protection recorded.
New fire scenarios must be evaluated for impact on evacuation, escape and rescue.
New support structure provided for the new plant may be vulnerable to fire impingement from
existing fire scenarios, and may require protection.
As platforms age, emergency equipment and facilities degrade. Although some items can be
easily replaced once they fall below an acceptable standard, other items such as sea ladders,
spider deck walkways, gratings on rarely-used escape routes to sea can fall into disrepair and
are expensive to replace. Routes to sea are important in severe fire scenarios and must be
kept up to standard as long as the fire hazard remains. Where new business is introduced
over an old installation, new escape routes, as well as refurbishment of existing routes (where
the original fire hazard still exists) may be needed.
Fire hazards would be identified in the HAZID at FEED stage of the process modification
design, and subsequently assessed as for any new design project.
The impact of the new facilities on the existing fire and gas detection and protection systems
needs to be documented and recommendations tracked to implementation.
Much fire measurement data, definitions and internationally accepted standard tests have
been developed from building fires and the damage caused. Many of these have been
adapted for use on the appropriate sections of petrochemical plants and their shortcomings in
wider applications should be understood. The following sections deal with some standard
aspects of conventional onshore fires but practitioners should refer to standards produced for
onshore and civil use for these “non-hydrocarbon” areas.
Accommodation and other areas of the installation such as control rooms, some workshops
(i.e. those without specific storage requirements for hazardous materials), leisure areas and
galleys are all based on normal architectural practices. The internal materials are the same as
onshore facilities and the design practices tend also to be the same with minor variation. The
key difference with these areas is how they relate to process and other operating areas and
extreme care should be taken to make sure that even the most apparently benign systems do
not interface with a hydrocarbon system in an unforeseen manner.
Key aspects where interfaces can occur are listed below and these should be assessed when
considering the process fire hazards:
• HVAC;
• Drainage;
• Storage areas/enclosures;
• Access (both for personnel using the facilities and working there and goods coming
into or out of the area).
In a compartment or building fire, the source of ignition will normally be at a discrete location
and the initial fire growth will be slow. The temperature in compartment will increase and a hot
layer of gas will build up below the ceiling. A point is reached when re-radiation from this gas
layer causes the unburnt furniture etc to ignite. Within a short space of time the entire contents
of the compartment will be burning in a process called flashover.
The severity and duration of a building fire depend on the amount of fuel and the ventilation
conditions. Fires may be fuel controlled or ventilation controlled, generally, ventilation
controlled fires are more severe.
The main difference between a building fire and a pool or jet fire is the nature of the fuel.
Although buildings contain hydrocarbons in the form of plastics they also generally contain a
large amount of cellulosic material in the form of paper, and wooden furniture. It is common,
although not strictly correct, to refer to building fires as cellulosic.
A parametric fire [3.44] is an idealised form of a “natural fire” in a building compartment. They
provide a simple means to take into account the most important physical phenomena which
may influence the development of a fire. They take into account the fire load, the ventilation
conditions and the thermal properties of the compartment linings. The natural fire is assumed
to have a slow build-up with a pre-flashover period of ignition and smouldering, following
flashover, the heat build-up is rapid and proceeds for some period dependent on the available
fuel. There is then a post-flashover period where cooling takes place. The “standard fire” curve
starts from an equivalent point at flashover and begins the heating phase directly. For the
“standard fire” the heating rate continues (albeit at a slower rate) and does not reach a
“cooling period”.
The modelling of the temperature curve of the parametric fire also follows a similar logic of
heating starting directly from a notional equivalent of the flashover point, i.e. without any
preceding phase. The heating rate is then faster than for the standard fire but reaches a point
where cooling commences. The cooling rate assumed for parametric fires is linear compared
to the accelerating cooling of the natural fire.
The parametric fire was developed to model mainly cellulosic building fires. It gives reasonable
correlations against tests for modern office fires. It may often be more severe than the
Standard cellulosic fire.
Building regulations throughout the world almost invariably require elements of construction to
have fire resistance based on the standard fire [3.45]. This is an idealised fire defined by a
time-temperature relationship and is the basis for fire resistance tests.
3.8.6.5 Temperatures
The Standard cellulosic fire has, when compared with most other “design” fires, a low initial
rate of temperature increase. However, the temperature rises logarithmically with no limit. It
reaches 945 ºC in 60 minutes and 1153 ºC in 240 minutes. The temperature reached depends
on the conditions in the compartment and in a typical office fire, the combustion products
temperature will reach about 1300 ºC. The fire temperature will normally peak at about 45 to
60 minutes and decline steadily afterwards. Compartment temperatures will reduce to 200 ºC
after 120 minutes.
4.1 General
The methods and systems for the management of explosion and fire hazards will have a
degree of commonality. Some of these will be complementary, whereas others will serve a
single function only. In addition, conflicts may exist between the successful management of
explosion hazards and the successful management of fire hazards; thus, a holistic approach
must be taken in the management of both types of hazard.
Successful hazard management involves identifying the best compromise between all these
considerations, in compliance with any statutory obligations placed on the operator of the
installation.
• Fitness for purpose of all flammable material containing equipment and associated
pipework.
• The maintenance of the design fitness for purpose throughout the life of the installation.
This requires that an adequate inspection and maintenance regime is in place
throughout the life of the installation. In addition, care must be taken to ensure that the
original design intent is not debased by subsequent modification or lost via poor record
keeping or industry take-overs and/or mergers.
• Adequate control of ‘hot work’ on live installations by the use of air-purged habitats.
Alternatively, only carry out ‘hot work’ during an installation shutdown. (Noting that hot
work should be avoided wherever possible, some installations have a ‘no hot work’
policy and insist on bolting (or other methods) and carry out hot work only during a
shutdown.)
• The correct hazardous area zoning for electrical equipment and the correct selection
and maintenance of such equipment.
• The early detection of any leakage together with the necessary control actions to
isolate all non-essential items of equipment which could potentially be sources of
ignition.
It should be noted that ignition probability per se, does not represent a true measure of risk.
What are most significant are the time-delay between a leak occurring and the ignition of the
leak, and also the time delay (if any) between the detection of the leak and the ignition of the
leak. These are a function of the rate of ignition rather than of the ignition probability. The
minimisation of ignition probability illustrates one of the many compromises that have to be
arrived at in the management of explosion and fire hazards, whilst accepting that ignition
probability must be minimised, in doing so it must also be recognised that the potential for a
‘long-delayed’ ignition increases. Under these conditions a severe explosion event may result.
It follows that leak-detection and associated alarms, are the only means of providing adequate
warning to personnel. Fire-detection is of no value in this context. However, fire-detection is
still of importance when fire hazards are considered.
It may be that very rapid response fire-detection systems, such as those that utilise flame-
detection, could detect an explosion before they are damaged by the explosion blast or drag
effects. In addition, rapid response fire detection may also be of benefit with respect to the
initiation of explosion mitigation systems (such as deluge on gas detection). As stated above,
this would be of no significance when explosion hazards are considered. However, it may be
important for the management of fire-hazards to detect any fire that may follow an explosion.
This may provide an argument for the use of rapid-response fire-detection systems, where the
frequency of occurrence of explosions is deemed to be significant. It may also provide an
argument under the same circumstances for the automatic actuation of any active fire control
and mitigation systems upon the detection of a leak.
Type 1) detectors may be point detectors e.g. pellistors, or beam detectors. In each case,
there is a requirement to assess the minimum flammable cloud size that should be detected.
There is little guidance available to assist in this. One approach may be to consider both the
thermal effects and the blast effects on a flammable cloud. The thermal effects may be
assessed by treating the combustion of the flammable cloud as a fireball. The minimum cloud
size, intended to be detected, may then be based on an acceptable probability of persons in
the area surviving these thermal and blast effects. A range of figures for the probability of
survival of detection systems following an initial blast load would be between 0.5 and 0.9. The
lower end of the range has been used often in QRAs submitted to the Health & Safety
Executive but a survival probability of 0.9 if other protective steps have been considered.
Type 2) detectors appear to have an advantage over type 1) detectors in as much as they
detect a leak directly. However, it is important that the sensitivity of such detectors is
adequate; the advantage of leak detection is its sensitivity; there are definite benefits to detect
leaks at as low rates as possible, this can be used to alert the operator even if a shut-down is
not initiated at this stage of the incident. In addition, there is no clear evidence as to whether or
not such acoustic detector will operate adequately when two-phase leaks occur. Thus it is
suggested that the ideal leak detection system should employ both types of detectors. The
detection of a leak should be annunciated on an installation-wide basis. All installation
personnel, including visitors, should have received clear instruction as to the correct action to
be taken on the receipt of such an alarm.
The minimum cloud size to be detected should also consider the potential escalation. This
assessment should be conservative due to the diversity of potential escalation paths and the
analysts’ inability to assess them all.
Only leak detection can provide adequate warning to personnel of a potential explosion
hazard. Fire detection is of very limited value in the event of an explosion already having
occurred.
• UV and IR flame-detectors
• Smoke detectors
The flame-detectors will have the most rapid response of the above if they are in the vicinity of
the fire. However, very early smoke detector (VESDA) systems can respond rapidly based on
an arrangement where the detection system samples smoke at very low concentrations, this
has often been used in sensitive enclosed areas, computer systems have a long history of
being protected by VESDA systems.
IR detectors may also be obscured by water, for example, triggering deluge on gas detection
may impair subsequent fire detection, or the IR detectors may fail to register fire escalation to
adjoining process systems.
The fire-detection system should include a mix of each type of detectors and be appropriate to
the mix of release/fire/explosion hazards considered in the escalation path.
The comments concerning alarms made for leak detection are equally pertinent for fire
detection.
This is of equal importance to the management for both fire and explosion hazards. Obviously,
where explosion hazards are concerned, any beneficial effects will arise if the fuel inventory is
partially or completely depleted before an ignition takes place. This contrasts with the situation
where fire hazards are concerned, where the beneficial effects will continue to operate after an
ignition takes place. However, these beneficial effects on the fire-hazard will only ensue if the
automatic isolation and blow-down and flare systems are not damaged by any prior explosion,
to such an extent as to prevent their correct operation. Isolation and blow-down valves should,
wherever possible, fail to a “safe” condition; generally, this means that isolation valves “fail
closed” and blowdown valves “fail open” although there can be extenuating circumstances for
this rule.
Especially for large high pressure valves, the actuators can be significantly large pieces of
equipment, and their destruction in an accident can compromise the “fail safe” mode; such
valve actuators should be protected against blast and drag-effect damage as much as
reasonably practicable, but it must be accepted that there will be practical limitations on the
extent to which this can be achieved.
This emphasises the importance of early detection of leaks and the automatic initiation of the
ESD and blow-down systems upon the detection of a leak.
Whereas, ESD and blow-down systems do provide benefit in the management of fire and
explosion hazards, it is important to realise that these systems alone cannot be relied upon to
prevent subsequent failures of equipment or structural elements due to the effects of a fire.
Blow-down systems are almost universally designed to API RP520 [4.2]. This requires that the
internal pressure be reduced by 50 % or to 100 psig (22 barg); whichever is the lower; within
fifteen minutes. However, even if this is achieved, a significant fire could still be ongoing which
could cause failures, especially in congested areas.
The equilibrium size of a flammable cloud, produced by the accumulation of flammable gas
from a leak will be inter-alia, a function of the area-ventilation rate. The severity of an
explosion following the ignition of such a flammable cloud, will be, inter-alia, a function of the
mass of flammable gas in the cloud. Thus it follows that an increased rate of area ventilation
will have a beneficial effect upon the explosion hazard. The possible disbenefit of this is that it
could make early detection of a leak more difficult to achieve. Nevertheless, in most cases the
balance of risk will come down in favour of maximising the rate of area ventilation.
The influence of area ventilation rate on fires is less apparent than its influence on explosions.
The reported research [4.3] indicates that the suppression of pool fires by water/foam deluge
systems is aided by increased wind-speed i.e. an increased ventilation rate. However, the
possible distortion of the water spray pattern by the wind could mitigate this.
Where mechanically ventilated, enclosed areas are concerned; the internal wind-speeds are
unlikely to be sufficient to distort water-spray patterns. Note that for enclosed areas, the rate of
mechanical ventilation will usually be of the order of 12 air changes per hour. Research [4.4]
has indicated that for naturally ventilated areas ventilation rates in the order of a few hundred
air changes per hour are achievable.
It is possible to shut down ventilation systems to provide ventilation control of a fire, but it
should be noted that in order to prevent smoke and combustion products migrating along
ducts if the HVAC is not shutdown and isolated, (which could lead to fire or fire effects
spreading to other areas) that common practice is to shut down and isolate HVAC systems in
all but the most critical areas (such Temporary Refuges) on confirmed detection of fire.
For existing installations, there are constraints to the options for increasing the existing
ventilation rates. For mechanically ventilated areas, major refits are required for fans and
ducting sizes, for naturally ventilated areas, the ventilation rate may be increased by the
removal of any louvered wind walls.
For ‘new builds’ the influence of the rate of ventilation on both fire and explosion hazards
should be addressed in the design. For naturally ventilated areas a conflict may arise between
protecting the temporary refuge against smoke ingress and the maximisation of area
ventilation. It is conventional wisdom that wherever possible, the temporary refuge should be
up-wind of the prevailing wind direction. There will normally be bulkheads between the
temporary refuge and drilling and process areas. This means that the open sides of these
areas will be at a right angle to the prevailing wind direction limiting natural ventilation.
Equipment layout
The equipment layout within an area will have an influence on the area ventilation rate. The
most efficient layout to maximise the ventilation rate will be the same as that to minimise the
explosion hazard. Layout guidance can be found in Section 3.2.6.4 of this guidance.
For existing installations, it must be accepted that little can be done to change the existing
layout of equipment. For ‘new builds’ cognisance should be taken of the recommendations
given in the FLACS explosion handbook.
• If the leak is counter-flowing to the ventilation flow direction, the ventilation rate will be
reduced.
• If the leak is co-flowing with the ventilation flow direction, the ventilation rate will be
increased.
• If the leak is crosswind to the ventilation flow direction, the ventilation rate is effectively
unchanged.
Where,
It is suggested that a conservative estimate of this effect would be to reduce the area
ventilation rate by 30 % when the area deluge system is operating.
It is now well established that in well-vented areas, the presence of an area water deluge can
reduce the severity of explosions. This would appear to be an argument for the initiation of
water deluge, before the ignition of a flammable atmosphere takes place. The could have the
benefits of reducing the explosion severity to an extent that the water deluge system in
operation to control or mitigate the effects of any subsequent fire, and also prevent damage to
automatic isolation and blow-down systems. Reported research on the effects of water sprays
[4.5] has provided correlations to estimate the reduction in explosion severity by area deluge.
The correlations also demonstrate the variation in explosion severity with the gas
concentration in the flammable atmosphere. The correlations are:
PE 2 = PE 1 e
( −17.693((E −1.0563) −(E −1.0563) )) ......................................... Equation 4-3
2
2
1
2
PE 2 = PE 1 e
( −18.215((E −1.007) −(E −1.007) )) ............................................ Equation 4-4
2
2
1
2
where
C1
E1 =
CS
C2
E2 =
CS
and
C1 is gas concentration 1
C2 is gas concentration 2
It is not possible to provide a generic correlation for the absolute reduction in explosion
severity, as the domains in which the explosion takes place will vary from one another.
However, it can be stated that the ratio of the unmitigated explosion severity to the mitigated
explosion severity increases as the unmitigated explosion severity increases. Thus area
deluge mitigation of explosions is most effective where very severe explosions can occur. This
means that such a system will be most effective in large, congested well-vented areas.
As has been stated above, the presence of water-deluge will result in the reduction of the
natural ventilation rate. This will have the effect of increasing the equilibrium, size of the
flammable cloud and also increasing the time required to disperse this flammable cloud. In
ageing platforms, there has been a concern that the presence of water-deluge may increase
the probability of ignition due to water ingress into electrical equipment.
Thus, in any particular situation, the decision as to whether or not the activation of an area
water-deluge is appropriate can only be informed by an assessment of all the above factors.
Water-deluge systems, with or without foam, can be effective in suppressing and extinguishing
pool fires. The following correlations for the time to extinguish pool fires have been developed
from a research programme of fire trials [4.6]. These trials used diesel as the fuel but the
correlations would give a reasonable approximation for the time to extinguish stabilised crude
oil fires.
29
T50 = 494 − 376 Y + ............................................................. Equation 4-5
Y
80
TE = 859 − 448 Y + ............................................................... Equation 4-6
Y
where
Y = C ×U
and
These correlations are specific to water sprays with droplets having Sauter mean diameters of
400 to 500 microns. The research report [4.3] indicates that the water droplet diameter can
have a significant effect upon the time to extinguish a pool fire. In summary, large droplets are
more effective than small droplets, inasmuch as they are less easily displaced by ventilation
crosswinds and can penetrate the fire plume more effectively.
The addition of a foaming agent to the water spray system can reduce significantly the time
extinguish a pool fire compared to those predicted from Equation 4-5 and Equation 4-6.
One additional factor in foam compound selection is the viscosity of the finished foam. For two
dimensional pool fires a low viscosity of the finished foam is appropriate. However, for three-
dimensional running fires, such as may be encountered on a helideck, a high viscosity (or
sticky) finished foam is appropriate.
In locations where the ambient temperature can be below 0 °C for a significant time the foam
compound should be ‘freeze-protected.’
A number of characteristics affect the effectiveness of water spray systems (designed for
example to NFPA15 [4.6]) against either pool or jet fires. The effects of water systems with
respect to different fire types are discussed in more detail in various sub-sections in
Section 5.2.
However, area water deluge can provide significant protection against incident thermal
radiation from both jet and pool fires.
The research report [4.3] suggested the following correlation for the reduction in incident
thermal radiation.
where
x = f ×L
and
This indicates that the presence of area deluge could provide significant protection for
personnel escaping from the location of a fire. The same applies to the use of water curtains if
these are of adequate thickness.
Area deluge systems or water curtains cannot be relied upon to protect personnel from the
thermal effects of an explosion. These thermal effects are of too short a duration to prevent
any serious risk of failure of equipment or structural elements. Such risks would be associated
with the blast and drag effects of an explosion. Obviously, water spray systems can provide no
protection against such effects. Dual agent (foam and dry powder) can be effective in the
suppression and extinguishment of pool fires. Their effectiveness is probably limited to
enclosed areas due to the problem of delivering the dry powder to the base of the fire in open,
well-ventilated areas; where effective, dual agents can reduce the fire duration to less than
that where water deluge and foam are used.
Any area deluge or local cooling system should be fully operational as soon as possible after
the receipt of an initiating signal. The recommendation for the maximum value of this time
delay, given in NFPA, should be adhered to. This is because waterspray heads constructed of
brass or gunmetal will, when exposed to flame impingement, suffer major damage if water flow
has not been established. This level of damage is likely to occur within 60 seconds and
seriously degrade the effectiveness of the waterspray system. This could be avoided by the
use of waterspray heads constructed of a high melting point material, such as super-duplex
stainless steel. However this option would be accompanied by a severe cost penalty.
Water mist systems appear to be very effective against electrical fires in enclosed areas.
However, there is no general agreement as to whether or not unacceptable levels of damage
to such equipment would ensue. At the time of writing this Guidance, more evidence is
required to validate this objection to the use of water mist systems.
1. Inert materials;
2. Intumescent materials.
The inert materials provide excellent protection against fire exposure and a resistant to the
erosive effects of jet flame impact. They do suffer from the disadvantage of increased load on
the structure. It is for this reason that the intumescent materials are generally preferred. The
intumescent materials can also provide excellent fire protection. However, there is a concern
that the erosive effect of jet flame impact could dislodge the ‘char’ formed and thus reduce the
effectiveness of the fireproofing. Where these materials are to be used, the material
manufacturer should provide jet fire test data to demonstrate that this is not a problem.
The design standard performance specifications for fireproofing materials are generally based
on diffusion flame engulfment rather than jet flame impact. Thus the need for the test data
referred to above is reinforced.
In this context it is of course necessary to know whether diffusion flames or jet flames will be
encountered. The research report [4.7] does provide some evidence on the likely rainout of
liquid from an ignited two-phase release. If the rainout is significant then a pool fire will result.
If not, then a spray fire (equivalent to a jet fire) will result. It is suggested that for ignited two-
phase releases;
• If the GOR is low, then at drive pressures above 10 bar absolute a spray fire will result.
• If the GOR is high, than at drive pressures above 5 bar absolute a spray fire will result.
The nature of the interaction between explosion and fire will depend upon whether an
explosion precedes a fire (the usual base case) or whether it occurs during a fire. The effects
of interaction are discussed in the following sections.
For the purposes of this section, explosion shall be assumed to include the effects of
projectiles.
There are four categories of explosion damage to structures, three of which may affect
subsequent fire endurance.
1. A structure, which has responded to explosion while remaining in the elastic deflection
range everywhere and without connection failures. A Category 1 structure can be
considered to have been unaffected by explosion when considering its response to fire.
This is the case for structures subject to explosion within the SLB range.
2. A structure, which has responded to an explosion with plastic deformation but without
connection failures. A Category 2 structure will be unaffected in its response to fire
except in respect of:
3. A structure that has responded to explosion loading with or without connection failures
(local or global). Category 3 structures will be weakened and behave differently in fire
scenarios, compared to undamaged structures, with much reduced fire endurance.
Categories 2, 3 and 4 damage relate to structures designed to resist explosion in DLB range.
1. Calculating the reserve structural capacity for distorted and/or weakened structures;
It is therefore recommended to design the main parts of the structure to survive design events
with Category 1 (e.g. 104 years return period) or modest Category 2 damage. In practice this
will involve optimising the overall layout of the topsides facilities to minimise explosion
pressures.
This is a particularly advanced type of analysis but could be practical where the non-linear
software can determine both fire and explosion response. It is probably necessary to account
both for geometry changes and the straining that has occurred in strained members and this
will affect the material model for those members. For this reason it may not be suitable to use
different software for the fire and explosion response and merely use the output geometry from
the non-linear explosion software as input to the fire-response software.
As temperature increases, the yield stress and Young’s modulus of metals decrease. This can
result in comparatively small temperature rises resulting in a considerable increase in
explosion related deflection. This applies particularly where a component is designed to resist
explosion through plastic deformation. Explosions during fire can sometimes result from
equipment or vessel BLEVEs due to heating in fire or a delayed effect of explosions in one
area on an adjacent area, already in flames. This is part of a complex domino situation where
a first area is in flames and the explosion in that first area has caused leaks in a second
(adjacent) area, and it takes some time before the leaks in the second area ignite and cause
the second explosion, causing explosion overpressures in the first area.
Unless, analyses of escalation identify clear limits to potential damage, it is recommended that
the fire hazard strategy assumes a “burn down philosophy” and that the fire risk analysis
should confirm that the TR is not destroyed with an unacceptable frequency, in which case, a
different solution will be required (e.g. a revised layout or separate accommodation jacket).
Other damage can occur due to projectiles caused by vessel BLEVEs and to a lesser extent
from pipe failures. Another source of damage may be equipment and structure falling from
areas above that has become weakened by fires. The higher the module stack, the more
damage a dropped could cause. Where appropriate, this aspect needs to be linked to
dropped-object hazard evaluation. On F(P)SOs and converted jack-up type substructures the
damage consequence due to impact with the deck might be large and the protection
requirements difficult to meet without heavy protection such as thick steel plates or Bi-steel.
Rigorous numerical analysis for explosion effects on fire-damaged structure is currently not
practical in most cases, though the advanced non-linear techniques briefly alluded to in
Section 4.5.2.2 might be applicable here.
Coping with the explosion after fire scenarios is principally achieved with a suitable barrier
philosophy and distancing (sensitive equipment and structure from hazard). For vessel
BLEVEs distancing will not usually be sufficient due to long projectile trajectories. Barriers,
(which may be walls or other equipment installed between the location of the BLEVE and
vulnerable targets) can reduce projectile trajectories and will be required if projectiles form a
significant component of the continuing escalation hazards.
From the practical standpoint, where an explosion during a fire is a significant risk, the
temperature of structural steelwork may need to be kept significantly lower than for fire-only
loaded steelwork. This is to improve resistance to resist the secondary explosions. This can be
accommodated by more extensive application of PFP and this factor should be borne in mind
when contemplating reducing the extent of PFP coverage to meet only specific fire scenarios.
An additional consideration is that where there is a significant risk of an explosion during a fire
it is necessary to ensure adequate strength and bonding or fixing of passive fire protection
materials at high temperatures.
This section will discuss specifically the potential conflicts arising from the use of the protective
measures considered for fire hazard management. The detail of each measure discussed can
be found elsewhere in this guidance.
The conflicts will be reviewed in the context of their role in the protective hierarchy and the
issues “in conflict” will be described.
Reduction or elimination of inventory is desirable for all hydrocarbon related hazards and
presents no obvious conflicts with other hazard categories.
In general, the reduction or elimination of ignition sources is again desirable for all
hydrocarbon related hazards although care should be taken that dispersion of gas or vapour to
a “non-hazardous” area where ignition sources have been allowed is considered in the HAZID
and that suitable other steps have been taken.
The reduction or elimination of ignition sources will (theoretically) prevent ignition of any
release prior to dispersion or dilution having occurred.
A conflict arises with the open module concept. The normal practice for fire protection
engineers is to consider the firewater demand of the largest area plus adjacent areas to which
the fire may spread. It can be seen that the larger area (the practical result of opening
modules) increases the firewater demand and may make the demand impractical for normal
firewater pump sizing. The open area also decreases the likelihood that the fire will ever be
ventilation controlled, thus requiring the designer to consider other steps. This “open module”
measure does however improve the situation for explosions.
Therefore, for detection, the issue is more of omission (of particular applications) rather than
conflict and can be clarified by clear application to the defined hazards.
Concerning isolation valves and blowdown systems, these will limit the released inventory for
any release event and present no conflict in the execution of that function. However, to
function well in the event of an incident, these measures may require additional ESD valves
and blowdown lines.
The designers should be aware of one area of conflict in that the actuators of large valves are
themselves quite large and that they and/or blowdown piping will constitute significant
obstructions to explosion generated flame-fronts and thus increase overpressure loads which
may in turn require blast protection as both ESD valves and blowdown lines are safety critical.
The design process moves into a vicious circle whereby the safety items can increase the
severity of the event they are controlling. These issues are not insuperable and like many
safety issues are dealt with by adopting good layout principles.
1. Physical containment; to stop the fire either escalating to adjoining sensitive areas (where
personnel may be), or reaching new inventories or to otherwise limit the fire by ventilation
control.
With respect to the mitigation measures identified under item 1, these measures provide the
greatest conflicts with other hazard categories. Physical containment of areas, whilst
delineating fire areas, providing greater effectiveness for the applied fire water systems and a
degree of ventilation control (in circumstances where the area/module is well sealed) have
adverse effects on other hazards. Gas or vapour releases are also contained, they are not
dispersed beyond the area/module and the opportunity for dilution to below the Lower
Flammable Limit does not exist. Also, there remains the possibility that delayed ignition
initiates an explosion rather than a fire in which case the resultant explosion overpressure will
more than likely be higher than in an open module (though this may not always be the case
and a considered analysis should be undertaken). The avoidance of gas/vapour clouds in the
flammable or explosive region should always be the first priority.
Concerning mitigation measures identified under item 2, there is a range of demands for the
extinguishing systems dependent upon which fire type they are designed for. In addition, there
are different nozzle types and spray behaviour required for explosion suppression. The
mixture of nozzle types and their location should be considered carefully when designing the
firewater system. Dependent upon the hazards identified for an area, a decision can be taken
on the basis of the risk (considering both likelihood and consequence) of the “reasonably
foreseeable” events. The risk ranking of the types of events will provide an indication as to the
types and locations of firewater nozzles to be used.
There is also the effect of timing; deluge used for explosion suppression is required to be
activated early, i.e. in advance of any ignition and this has led to the practice of some
operators of initiating deluge on gas detection.
The critical consideration for the structural and safety demands required by mitigating
measures under item 3 is to maintain structural integrity. There are no obvious conflicts arising
from measures meeting these demands, the increased strength and/or added passive fire
proofing do not impact other hazard management measures. However, the addition of passive
fire proofing does increase the likelihood of accelerated corrosion due to trapped moisture
which may arise from leaking insulation or from temperature cycling generating condensation.
Another issue for manned areas can be toxicity of smoke from intumescent PFP. This type of
PFP is rarely used on corrugated walls but is common on bulkhead structures.
Corrugated walls are designed not to participate in the loads bearing capacities of the
structures they are integrated into and only have to have residual strength in fire to support
their own weight.
Bulkhead walls on the other hand do participate in the dead load carrying capacity of the
structures into which they are constructed and therefore require to be insulated to prevent
strength loss in fire. Most fire / blast walls do not otherwise require to be insulated, and
insulation of them is only normally required where they are used as boundaries to enclosed
occupied rooms.
Resistance to penetration by projectiles will be affected by temperature rise and this will
depend upon whether PFP is used or not. It also depends on whether or not the insulation is
on the fire attack side or the cold side of the wall.
In some cases relatively thin coatings of PFP have been applied to (carbon steel) corrugated
walls and this has the advantage of ensuring limited temperature rise during the important
early blow-down phase of platform equipment when BLEVE and projectile risk is highest (a
compromise solution).
Stainless steel corrugated walls have more residual strength at elevated temperatures and are
therefore more resistant to projectiles. On the other hand they tend to be thinner than
equivalent carbon steel walls and this diminishes the strength advantage in regard to projectile
penetration, but they are very ductile.
Support interface design is important as this must allow for thermal expansion of the wall in fire
and out-of-plane bending, due to preceding explosion or differential temperature through the
depth of the wall or both. The out of plane deflection due to fire is lower with corrugated walls
because the geometry of the wall profile ensures that the inner flange and outer flange are
heated equally, whereas large differential temperatures occur in bulkhead walls and stressed
skin construction (with the plate on the fire side) because the cold side flange of the stiffeners
is not heated directly: the temperature gradient is greatest with uninsulated walls.
Provided the supports are configured to deform without strength-loss, the residual strength of
the wall will not be affected by the distortion but care needs to be taken with the PFP in these
areas, particularly where such PFP is within the coat-back distance for the structure that
supports the wall. If in doubt, shaped stainless steel flashings can be used in such locations
with fibrous insulation behind.
4.8 Decks
Decks normally comprise a series of girders and a stiffened deck plate. Usually the PFP will be
applied to limit the temperature rise of main girders and those secondary beams that support
the higher categories of Safety Critical Equipment. Coat-back requirements are often relaxed
to 50 mm or so hence the overall percentage of cover to deck steel work will be relatively
small.
As a general rule it is preferable to specify the secondary deck beams and plating to have a
higher strength than the primary structure so that it’s loss in explosion and / or fire does not
lead to the primary structures being dragged down or losing their secondary stabilising support
members, for example for lateral torsion buckling. The welding of secondary steel and girder
connections needs particular attention and it is recommended to make welded connections
capable of transmitting the forces imposed during gross deformation of the secondary
members they connect without fracture (as in earthquake-resistant design).
Potential deficiencies in fire resistance of decks which support SCE’s or which act as fire-
boundaries can sometimes be overcome by the addition of deck to deck hangers. Where the
critical fire is below the deck these hangers would not be weakened as they would be located
in a different fire area. This is a solution that can be applied for retrofit situations.
It should be understood that there may be a problem of running pool fires on decks due to
distortion of plates arising from the fire. All analyses are based on a circular or bunded fire and
do not take into account potential running. At the time of writing, it is understood that HSE are
planning a test programme to investigate this effect.
Based on large scale experimental work (including unpublished studies by Advantica to which
access has been granted for this guidance) and on the predictions of validated models
developed and used by Shell and Advantica, typical fire loading data are summarised for the
fire types. Typical values can be used to assess the hazard to personnel and the likely effect
on fire impacted obstacles using a simple calculation method.
Also considered are the effects of deluge on fire behaviour, the potential heat loads from fires
and the effect on the temperature rise of an engulfed object, plus the manner in which PFP
may limit the rate of temperature rise of an engulfed object and how blow-down may reduce
the heat load and hence the likelihood of failure. Using these typical fire loadings and
calculations of heat transfer to objects, the steps to prepare an initial scoping or indicative
QRA of the fire hazards are also outlined.
An ignited pressurised release of a gaseous material (most typically natural gas) will give rise
to a jet fire. A jet fire is a turbulent diffusion flame produced by the combustion of a continuous
release of fuel. Except in the case of extreme confinement which might give rise to
extinguishment, the combustion rate will be directly related to the mass release rate of the fuel.
In the offshore context, the high pressures mean that the flow of an accidental release into the
atmosphere will be choked having a velocity on release equal to the local speed of sound in
the fluid. Following an expansion region downstream of the exit the flame itself commences in
a region of sub-sonic velocities as a blue relatively non-luminous flame. Further air
entrainment and expansion of the jet then occurs producing the main body of the jet fire as
turbulent and yellow. In the absence of impact onto an object, these fires are characteristically
long and thin and highly directional. The high velocities within the released gas mean that they
are relatively unaffected by the prevailing wind conditions except towards the tail of the fire.
The fire size is predominantly related to the mass release rate which in turn is related to the
size of the leak (hole diameter) and the pressure (which may vary with time as a result of
blowdown).
A factor which is often overlooked is the noise produced by sonic gaseous releases. This is
usually high pitched and so loud that it may prevent effective radio communication between
personnel. As a result emergency actions could be hampered.
A further point to note is that some combinations of leak size and pressure will not give rise to
an inherently stable flame. For hole sizes under 30 mm diameter, there is a lower bound
pressure which high pressure releases must exceed to produce stable flames. Simplistically,
this extends approximately linearly from 2 barg at 30 mm diameter to about 75 barg at 8 mm
diameter. In practice this means that most small leaks (see Section 5.4.1) will be inherently
unstable and will not support a flame without some form of flame stabilisation, such as the
presence of another fire in the vicinity to provide a permanent pilot or stabilisation as a result
of impact onto an object such as pipework, vessels or the surrounding structure. This implies
that unstable flames may self-extinguish revert to leaks thus contributing to potentially
explosive environments. This aspect of flame behaviour should be considered in determining
major hazard scenarios and their escalation paths, however, in the highly congested
environment offshore, impact within a short distance is very likely, and small leaks will most
likely stabilise on the nearest point of impact.
Apart from providing flame stabilisation, impact onto an obstacle may also significantly modify
the shape of a jet fire. Objects which are smaller than the flame half-width at the point of
impact are unlikely to modify the shape or length of the flame significantly. However, impact
onto a large vessel may significantly shorten the jet fire, and impact onto a wall or roof could
transform the jet into a radial wall jet where the location and direction of the fire is determined
by the surface onto which it impacts.
As noted above, the combustion process within a natural gas jet fire is relatively efficient and
produces little soot (carbon). Consequently these flames are not as luminous as higher
hydrocarbon flames. Radiation emissions from natural gas flames arise mostly from water
vapour and carbon dioxide, except for very large releases where soot production starts to
enhance the process. The long thin shape may also result in a flame path which is not optically
thick. The net result is that the radiative heat transfer to the surroundings is lower than for
higher hydrocarbon flames and this is reflected in the fraction of heat radiated, F, for such fires
(see Section 5.3.1, “Fire loading to the surroundings”). Similarly, the radiative heat transfer to
objects engulfed by the flame is generally lower than for higher hydrocarbon flames, but the
high velocities within gas jet fires can result in high convective heat transfer to objects. Clearly
the total heat flux which is imparted to an engulfed object will vary over the surface of the
object. In addition, the relative proportions of convective and radiative heat flux will vary over
the surface, with the highest convective component likely to be experienced close to the point
of impact of a flame where the highest velocities occur, whereas the highest radiative heat
load will be experienced where the more radiative part of the flame (usually nearer the end of
the flame) is viewed by the object. As the more radiative part of the flame is closer to the tail,
this can result in the highest overall heat fluxes being experienced on the rear surface of an
engulfed object which may seem counter-intuitive. Neglecting such spatial variations, broadly
speaking, for a given location of an object within a flame (as a proportion of flame length), the
convective component is more or less constant with increasing size of release, whereas the
radiative component increases with release rate as the flame becomes optically thick and
more smoky. Hence the relative proportion of convective to radiative flux varies with fire size
(see Section 5.4.2).
The activation of general area deluge can adversely affect the stability of high pressure gas jet
fires, particularly if the fire is not impacting onto an obstacle. However, in most practical cases,
this undesirable effect is very unlikely to occur due to impact onto obstacles providing
adequate flame stabilisation. Indeed, deluge has little effect on the size, shape and thermal
characteristics of a high pressure gas jet fire. Therefore, the heat loading to engulfed obstacles
is not diminished. The same is true for dedicated vessel deluge systems; the water being
unable to form a film over the vessel in the presence of the high velocity jet, and so dry
patches form where the temperature rise is undiminished by the action of deluge.
There is some evidence that the deluge increases combustion efficiency resulting in lower CO
and increased CO2 levels within the flame.
The major benefit of area deluge with jet fires arises from the suppression of incident thermal
radiation to the surroundings, which protect adjacent plant and in particular, aid escape by
personnel. For a medium velocity type (e.g. MV57) nozzle operating at 12 l min-1 m-2, incident
radiation levels can be reduced by about 20 % for a single row of nozzles, 30-40 % for 2 rows
and 40-60 % for more than 2 rows (general area deluge). Increased deluge rates can further
reduce incident radiation levels: 60-70 % at 18 l min-1 m-2; 80-90 % at 24 l min-1 m-2 for general
area deluge. Nozzles producing smaller droplet sizes can have an enhanced mitigation effect,
but there is an increased risk that the droplets will be blown away by the wind.
The behaviour of a jet fire within a confined or partially confined area will depend upon the
degree of confinement and the direction of the jet relative to the ventilation opening. If
ventilation is plentiful or the jet is directed through a vent then there may be little difference in
jet fire characteristics compared to an unconfined fire. However, if the release rate of gas is
large relative to the size of the confinement or the ventilation openings are small then the fire
may not be able to entrain enough air for complete combustion inside the compartment. This is
likely to result in increased levels of incomplete combustion products such as CO, increased
levels of smoke (soot) and increased flame temperatures, particularly in regions close to the
ceiling of a compartment where hot combustion products may be trapped and recirculate. This
leads to increased heat flux to objects and surfaces compared to an unconfined fire.
The location where combustion occurs and the hottest parts of the flame may also shift due to
the confinement. In tests involving horizontal jet fires in a compartment incorporating a single
wall vent, where the jet was directed away from the vent, increased temperatures were seen at
the interface between the smoke layer leaving the compartment and the air layer entering the
compartment, most particularly in the area furthest from the vent.
Unlike unconfined fires, the behaviour of under-ventilated confined fires changes with time as
the air initially available within the compartment is consumed, and this may lead to ‘external
flaming’ after a period of time when the body of flame moves through the vent in order to find
the oxygen required for combustion. CO levels of up to 5 % v/v at the vent may occur but after
the onset of external combustion the CO levels drop to typically less than 0.5 % v/v by the end
of the flame. Soot production is related to the equivalence ratio and hence the degree of
ventilation and may range from about 0.1 g m-3 at an equivalence ration equal to 1.3 to up to
2.5 g m-3 at an equivalence ration equal to 2.
Certain ventilation patterns could lead to flame instability and extinguishment. The worst case
condition is likely to occur if the jet fire is slightly under-ventilated as this leads to high heat
release rates and enhanced soot production.
Deluge of a confined jet fire may lead to flame extinguishment and hence a serious explosion
hazard from the continuing release. The likelihood of flame extinguishment is significantly
increased if the surroundings are already hot at the time the deluge is activated as the main
mechanism which results in extinguishment of the jet fire is ‘inerting’, that is evaporation of the
water droplets leading to a mixture of gas/air/steam within the compartment which is outside
the flammable limits. The water vapour may also contribute to flame instability by reducing the
burning velocity. However, if the deluge is activated at an early stage, prior to the compartment
walls becoming hot, then the fire may not be extinguished and some benefit in terms of
reduced flame temperatures and wall temperatures may accrue.
An ignited release of a pressurised liquid/gas mixture (such as ‘live crude’ or gas dissolved in
a liquid) will give rise to a two-phase jet fire. The gas stream atomises the liquid into droplets
which are then evaporated by radiation from the flame. However, a pressurised release of a
liquid can also give rise to a jet fire in which two-phase behaviour is observed if the liquid is
able to vaporise quickly. This is most likely to occur when a liquid is released from containment
at a temperature above its boiling point at ambient conditions whereupon flash evaporation
occurs, (for example propane, butane).
Pressurised releases of non-volatile liquids (for example, kerosene, diesel, or stabilised crude)
are unlikely to be able to sustain a two-phase jet fire, unless permanently piloted by an
adjacent fire; even so, some liquid drop-out is likely and hence the formation of a pool. At high
pressures, a spray of liquid droplets may be formed which can drift in ambient winds and
become dispersed over a wide area.
As for the gas jet fire described above, the two-phase jet fire is a turbulent diffusion flame
produced by the continuous combustion of a fuel at a rate directly related to the mass release
rate, producing a fire which is long and thin (although generally wider than a gas only jet fire)
and highly directional. The exception is when liquid drop-out occurs, leading to a potentially
increasing accumulation of fuel as a pool. Two-phase jet fires (particularly those generated by
flashing liquid releases) are significantly less noisy than gas jet fires. As for gas jet fires,
impact onto an obstacle larger than the flame half- width at the point of impact may shorten or
modify the shape of a fire significantly.
The liquid content results in relatively higher release rates for a given aperture and pressure
compared to gaseous releases and, when the release is two-phase (such as may arise from a
relatively long pipe connected to a liquid storage vessel), estimating the release rate is difficult.
The output from Codes used to characterise 2-phase releases should be viewed with caution
as these types of mixed fluid flows are very difficult to model accurately. The generally lower
exit velocities from flashing liquid releases lead to shorter flame lift-offs and proportionately
shorter and more buoyant flames overall. These lower velocities also make the fires more wind
affected whilst the higher hydrocarbon content of these fuels increases the flame luminosity.
However, two-phase releases involving gas dissolved in, or mixed with, a liquid can result in a
jet fire which combines the worst aspects of both the gas jet fire and the flashing liquid jet fire,
that is, high velocities and high flame luminosity.
The higher hydrocarbon content also results in more soot being formed than in a natural gas
jet fire, although there is no available experimental data quantifying the difference.
Measurements in the smoke downstream of a ‘live crude’ jet fire determined an optical
obscuration factor of typically 10 % over a 200 mm path length. This corresponds to a visibility
distance of about 5 m.
In the case of a pressurised gas-liquid mixture (such as ‘live’ crude), the high velocities may
still occur and result in a high convective contribution, whilst the higher hydrocarbon content
maintains a high radiative contribution; making these type of jet fires a ‘worst case’ in terms of
total heat flux to engulfed obstacles. Experimental work suggests that the maximum combined
fluxes occur for gas-liquid mixtures which are about 70 % by mass liquid.
A special case of interest at some installations is ‘live’ crude which includes a significant
quantity of water. Experiments have shown that mixtures with a ‘water cut’ (defined as mass of
water/mass of fuel x 100 %) of up to 125 % remain flammable, although not necessarily
capable of supporting a stable flame in the absence of some other supporting mechanism. The
inclusion of water also slightly increases flame length and flame buoyancy, and the amount of
smoke produced reduces significantly. For water cuts under 50 % no significant reduction in
heat fluxes to engulfed objects can be expected (<10 %). However, over 50 % the flames are
significantly less radiative, and the overall heat flux to an obstacle can be reduced by 40 % or
more.
Compared to the situation with a gas jet fire, the use of dedicated vessel deluge to protect a
vessel against a flashing liquid two-phase jet fire (e.g. propane, butane) can be more effective.
The water interacts with the flame to some extent; reducing the flame luminosity and the
amount of smoke produced. Nevertheless, at typical application rates (10 to 15 l min-1 m-2) it
cannot be relied upon to maintain a water film over the vessel and hence to prevent vessel
temperature rise in areas where dry patches form, although the rate of rise may be expected
to reduce to 20-70 % of the rate without deluge for a propane jet fire. Similar behaviour has
been noted for ‘live’ crude jet fires with dedicated deluge although, in this case, no reduction in
the rate of temperature rise was observed in the area where the fire impacted the obstacle.
However, in tests with an increased water application of 30 l min-1 m-2, a 2 tonne LPG tank
was effectively protected when subjected to a 2 kg s-1 flashing propane jet fire.
For ‘live crude’ jet fires, using area deluge at the ‘standard’ rate of 12 l min-1 m-2 is unlikely to
modify the flame behaviour although there is some evidence that a higher deluge rate
(24 l min-1 m-2) can result in water interaction with the flame, resulting in a shorter flame and
some reduction in heat fluxes to certain areas of an engulfed object, notably the front (where
flame impact occurs) and top areas. Since dedicated vessel deluge is more effective at
reducing the radiative heat fluxes in the region to the rear of the vessel, the combination of
area deluge and dedicated vessel deluge can be effective in reducing overall heat fluxes to a
vessel such that the temperature rise is halted or at least the rate of temperature rise is
reduced. This may prevent vessel failure, especially if combined with a blowdown strategy.
As for gas jet fires, a major benefit of area deluge of two-phase jet fires arises from the
attenuation of incident thermal radiation to the surroundings, which protect adjacent plant and
in particular can aid escape by personnel. Even dedicated vessel deluge alone can result in
some reduction (~15-20 %) in the incident thermal radiation to the surroundings as a result of
modifying the flame characteristics.
Confined two-phase jet fires are expected to behave in a similar manner to confined gas jet
fires (see Section 5.2.2.3).
The effect of area deluge on two-phase jet fires in compartments is expected to be similar to
that noted in Section 5.2.2.4 for gas jet fires. Extinguishment could give rise to a mist-air
explosion hazard and/or the formation of a liquid pool. In tests involving only partial
confinement around the upper area of a module, during which ‘dead spaces’ occurred close to
ceiling, area deluge was found to be beneficial in reducing heat fluxes to the ceiling surface,
reducing the flame extent and the amount of smoke produced.
Combustion of these relative high hydrocarbons inevitably leads to the production of large
quantities of soot, particularly in large pool fires where the size of the pool reduces the ability
of air to mix with the fuel evolving in the centre of the pool. The soot emissions result in the
characteristic yellow flame and large quantities of smoke can be produced; to the extent that
the smoke can result in reduced thermal radiation to the surroundings by screening of the
radiant flame.
Hence, the fraction of heat radiated, F (see Section 5.3.1 for definition), tends to decrease with
increasing fire size, although the smoke hazard may increase.
Except in very large fires where buoyancy driven turbulence may become significant, the low
velocities within the fire result in the flame being affected by the wind and this factor
determines the trajectory of the flame. These low velocities also result in low convective heat
fluxes to objects engulfed by the fire; the predominate mode of heat transfer being radiation.
General area deluge can be very effective in controlling hydrocarbon pool fires and mitigating
their consequences. If the water is capable of reaching the liquid pool, the cooling of the fuel
reduces vapour evolution and hence reduces the size of the flame. This, in turn, leads to
reduced radiative heat transfer from the flame to the fuel surface which also contributes to
reducing the vapour evolution. Consequently, with time, the fire size is reduced and complete
extinguishment may result or, if not, sufficient control achieved that manual fire fighting could
be safely undertaken. The ability of the water to enter the pool of fuel is higher on the upwind
side of the fire where the thickness of the flame is least. Consequently, as the deluge starts to
take effect on the fire, the flame retreats from the upwind side of the spillage. In tests involving
condensate, the fire coverage of the pool was reduced by over 90 % in 10 minutes. Hence,
after 10 minutes, the flame size was commensurate with a pool of less than 10 % of the
original area. The introduction of a small percentage (1 %) aqueous film forming foam (AFFF)
into the deluge system can significantly increase the rapidity of achieving fire control and
extinguishment.
Due to the much reduced fire size when a pool fire is subject to water deluge, the amount of
smoke is also significantly reduced. Measurements of the obscuration factor over a 200 mm
path length in the combustion products from a diesel pool fire dropped from typically 20-30 %
to negligible levels when the fire was deluged and CO levels at the same location dropped
from over 100 ppm v/v to typically 10 ppm v/v. However, if the water does not directly interact
with the fire itself and only interacts with the stream of smoke evolving then there is no
evidence that the water deluge ‘washes’ soot out of the smoke, nor that the toxicity (such as
CO level) is reduced. A point of note is that the cooling effect of deluge may reduce the smoke
buoyancy and possibly result in smoke being present at lower heights where it may hinder the
visibility for personnel trying to escape.
The heat loading to objects engulfed in a pool fire may also be reduced by the activation of
deluge, most particularly on the surfaces where a water film can be maintained. The
vulnerable areas will be the underside where the water cannot provide coverage and the
downwind side where the flame is likely to be thickest. Nevertheless, in these areas the rate of
temperature rise is likely to be reduced and additional benefit accrues from the action of the
deluge in reducing the fire size. The use of dedicated vessel deluge would be expected to
protect an object engulfed in a pool fire, especially in combination with general area deluge
which will, simultaneously, reduce the degree of fire attack.
As for jet fires, the water deluge will also provide benefit to objects not engulfed by the fire by
attenuating the thermal radiation (see Section 5.2.2.2)
The behaviour of confined pool fires will depend on the degree of ventilation and whether the
confining structure becomes hot and re-radiates heat to the fire. In the case of adequate
ventilation for combustion, the mass burning rate and fire behaviour will be similar to a pool fire
in an unconfined area, unless the walls become hot due to insulation in which case the flame
temperatures may rise significantly (by about 200-400 ºC) and hence the heat fluxes to objects
within and near the flame will rise. This is associated with soot combustion and can lead to
less smoke being evolved.
However if the ventilation is less than that required for combustion the fire becomes ventilation
controlled and the mass burning rate (and hence the vapour evolution rate) decreases to
match available air flow. Due to the reduced burning rate, the flame size and heat fluxes to
objects from ventilation controlled confined pool fires may be lower than from unconfined fires
unless re-radiation from hot compartment walls increases flame temperatures. The restricted
air flow may result in an external fire at the vent openings and so areas not previously exposed
to fire outside the compartment may now be exposed to flame engulfment and thermal
radiation.
In under-ventilated conditions both the CO and soot levels increase. CO up to 5 % v/v may be
measured at a vent prior to the onset of external flaming although at the end of an external
flame the levels are likely to fall to less than 0.5 % v/v. Soot levels up to 3 g m-3 might be
expected.
When deluge is activated within a confined space, the residence time of the water droplets in
the flame and hot walls leads to water evaporation within the flame and a significant reduction
in flame temperatures. This then reduces the radiation back to the pool surface and results in
a lower mass burning rate. An initially ventilation controlled pool fire may then become fuel
controlled at this lower burning rate and any external flaming that had formed is likely to be
reduced or to cease entirely.
Methanol differs significantly from the hydrocarbon fuels discussed above. It burns with a non-
luminous invisible flame. No soot is produced and the thermal emissions are dominated by the
molecular emissions associated with the production of CO2 and water vapour. The flame
height is about one third that expected from an equivalent sized hydrocarbon pool. The mass
burning rate increases with increasing pool size and a value of 0.03 kg m-2 s-1 has been
measured for a 10 m diameter pool. It is not known if the flame has reached ‘optical thickness’
at this scale and hence whether this would increase further for larger fires. The low radiative
emissions of the flame results in a low fraction of heat radiated, F, and low heat fluxes to
engulfed objects. On an offshore platform an important hazard may be to personnel entering
the flame unwittingly due to its invisibility.
Once established, a hydrocarbon pool fire on the sea will behave in a similar manner to an
unconfined pool fire on an installation (See Section 5.2.3.1). Consequently, depending on the
size of the fire, engulfment of the installation legs and the underside of the platform are
possibilities. Flame temperatures of typically 900 to 1200 ºC can be expected and heat fluxes
to engulfed objects up to 250 kW m-2.
The significant difference between liquid spills on an installation and liquid spills on the sea is
that on the sea it is unlikely that ignition will occur at all. Overall, the likelihood of ignition is low
(especially for less volatile hydrocarbons such as crude oil) due to a number of factors which
are discussed below. The likelihood of ignition also decreases with time following a spill,
sometimes rapidly, so spills where immediate ignition could occur (or ignition has already
occurred) are likely to be the main focus of attention.
Firstly, and perhaps most importantly, the likelihood of an ignition source being present near
the sea surface would generally be low. Assuming an ignition source is present, there are
three main factors that influence the ignitability of liquid spills onto the sea, all of which are
time dependent. Their significance in inhibiting ignition increases with time resulting in lower
ignition probabilities. These are: pool thickness; fuel flashpoint; and emulsification.
Following an initial spillage, the pool will spread out quickly reaching an equilibrium thickness
within a few hours, even for a large spillage. This equilibrium thickness depends upon fuel type
with typical values of less than 0.1 mm for light crude oils and 0.05-0.5 mm for heavy crude
oils. However, there is a minimum pool thickness which is capable of supporting a stable
flame; about 0.5 mm for condensate; 1 mm for light crude; and 1-3 mm for heavier oils. When
the thickness falls below these levels, the cooling effect of the sea prevents evaporation of the
fuel from the pool surface which is required for combustion. This is because the temperatures
at the pool/water interface are never above 100 ºC and are generally close to ambient
temperatures. When the pool is thick, a steep temperature gradient through the pool allows
evaporation at the pool surface and potential ignition, especially if a high energy ignition
source is present such as another fire which will enhance evaporation rates.
Therefore, the fuel flashpoint is also a factor in determining the likelihood of ignition. Fuels with
a flashpoint lower than the ambient temperature will ignite readily but those with a flashpoint
over 100 ºC (such as stabilised crude oil) will require the presence of a major heat source to
achieve ignition, such as a pre-existing fire on the platform. Therefore, the likelihood of ignition
of a liquid spill reduces with time as the lighter fractions evaporate.
Emulsification of a hydrocarbon fuel with sea water will reduce significantly its flammability. For
crude oils, emulsions with over 25 % water are considered to be not ignitable. The cut-off point
for condensate is unknown, but is likely to be higher. Emulsification of the fuel and water
arises primarily as a result of the initial spill conditions and the subsequent weather/sea
conditions. Breaking waves and wind speeds over 15 m s-1 will promote emulsification and
result in a low probability of ignition. (The wave action will also cause fluctuations in the pool
thickness and may result in breaking up of the pool and thereby prevent sustained burning).
Spills which plunge into the sea from the platform, (which, if burning, may be extinguished in
the process) are likely to break up and begin to emulsify. The least emulsification is likely to
result if spills run down an installation leg or occur close to the sea surface.
In the case of sub-sea oil pipeline failures in shallow water (<200 m), the oil plume widens as it
rises through the water and breaks up into small droplets. Any significant gas component in
the oil provides additional initial upward momentum and the oil droplets are likely to break the
surface in a location above the original failure and then spread radially. However, the pool may
then be carried along by tidal currents and wind. This process provides significant opportunity
for emulsification and reduces the ignitability of any resulting pool.
In deep water, some or all of the gas component may form gas hydrate solids and this results
in a reduced initial upward velocity for the leak, leaving the oil droplets to rise purely as a result
of their buoyancy. In these circumstances the lateral movement of the rising plume may be
significant and the oil eventually reaches the surface some distance from the original leak
location. Again, significant emulsification will have occurred resulting in very low ignition
probabilities.
In summary, a low velocity, ignited, large volume spillage of a volatile liquid hydrocarbon close
to the sea surface near to the installation in calm or moderate conditions represents the worst
case scenario in terms of a pool fire on the sea. Most other scenarios have a low likelihood of
producing a pool fire. Experiments have been carried out by Sintef in two experiment series at
Spitzbergen in 1994.
In deep water (>300 m) some formation of gas hydrates is likely and over 500 m some
researchers report complete conversion to hydrates, although this also depends on gas
composition and water temperature. In such cases, the hydrates will rise solely as a result of
buoyancy and are likely to reach the sea surface some distance laterally from the original leak
site. Some researchers suggest that water turbulence may keep the hydrates in suspension
and the gas may never reach the surface.
5.2.5 BLEVE
Fire impingement on a vessel containing a pressure liquefied gas causes the pressure to rise
within the vessel and the vessel wall to weaken. Even within a short timeframe, this may lead
to catastrophic failure and the total loss of inventory. The liquefied gas which is released
flashes producing a vapour cloud which is usually ignited. These events are known as Boiling
Liquid Expanding Vapour Cloud Explosions, BLEVEs. This highly transient event generates a
pressure wave and fragments of the vessel may produce a missile hazard leading to failure of
other items in the vicinity and hence the potential for escalation. In addition, there is a flame
engulfment and thermal radiation hazard produced by the fireball.
In the offshore context, a BLEVE hazard might be considered, for example, in relation to a
pressurised separator vessel containing unstabilised condensate and gas. However, a BLEVE
is unlikely to develop in the same way as described above for an onshore facility as the vessel
will probably be located within a module amongst other vessels and pipework. The potential
for escalation is thus much increased due to the proximity of other vessels and pipework which
may be struck by missiles. Additionally, the presence of this other equipment may lead to
increased overpressures being developed as the burning gas cloud expands through the
congested region. The presence of roof confinement will significantly modify the shape of the
developing fireball and lead to increased lateral development. Even a small inventory of fuel
being involved in a BLEVE event (<100 kg) would be expected to produce a fireball extending
throughout the entire volume a typical module. Consequently, apart from the risk of the BLEVE
causing escalation, the event presents a severe hazard to exposed personnel.
Whilst pre-activation of deluge (area and dedicated vessel deluge) may prevent or delay the
occurrence of a BLEVE, the deluge is unlikely to provide any significant benefit in terms of
mitigation of the event, especially within the region of potential flame engulfment.
Where:
E is the average surface emissive power of the flame (kWm-2) (Note the surface
emissive power varies over the surface of the flame and hence an area-based
average is required to represent the whole surface)
The view factor is a function of the flame shape. Consequently, most integral or empirical
mathematical models will assume some kind of simplified flame shape which is then used to
calculate the view factor. The flame average surface emissive power is also a function of the
flame shape. Therefore, average surface emissive powers used by the model will not
necessarily be the same as those measured during an actual fire.
Issue 1 May 2007 Page 184 of 493
FIRE AND EXPLOSION GUIDANCE
In the far field, (typically more than 2 flame lengths away) the flame shape is not critical, so a
simplified approach can be taken using the ‘point source’ model, whereby the difficulties of
defining a flame shape and associated average surface emissive power can be avoided. In
this approach, the fraction of the heat of combustion of the fuel radiated to the surroundings is
defined as:
EA
F= ....................................................................................... Equation 5-2
Q
Where:
Q is the net rate of energy release by combustion of the fuel (kW) and Q = m& H
The incident radiation received in the far field at a distance, d (m), from the fire is then
expressed as:
τ F m& H
qd = ................................................................................ Equation 5-3
4 π d2
The atmospheric transmissivity will depend upon the prevailing atmospheric conditions
(absolute humidity) and the path length, but might typically be 0.8 on a dry day. However, fog
would significantly reduce this value.
The activation of water deluge on an offshore installation, producing water droplets in the air,
effectively reduces the transmissivity by absorbing radiation. However, for the purposes of this
document, a revised ‘effective’ fraction of heat radiated is defined as F ′ , accounting for the
reduced transmissivity in the area being deluged, (but not including the transmissivity of the
atmosphere between the fire and the receiver which is outside the deluged area). The incident
radiation at a distance, d(m), from the fire can be estimated using:
τ F ′ m& H
qd = .............................................................................. Equation 5-4
4 π d2
Note that the above equation does not necessarily take account of any effect of the deluge on
the flame behaviour itself – such as lowering the flame temperature or size. As will be noted
later, jet fires are little affected by deluge, but pool fires can reduce significantly in size. In the
case of pool fires, this reduction in size (area of the surface actually burning) would result in a
reduced value of m& and hence would be reflected in calculations made using the above
equation.
( 4 3) dt ...............................................................................
S d = ∫ qd Equation 5-5
As a guide, a radiation level of about 5 kWm-2 can be tolerated for about one minute and
consequently represents a level from which it is reasonable to assume that escape, without
significant injury, would usually be possible for an average employee wearing typical protective
clothing, (see also Section 5.5.1.13).
However, the point source model is not suitable for estimating incident radiation to locations
close to (certainly within one flame length) of the flame, where it may be significantly in error.
In the near field, a mathematical model which defines a realistic flame shape (and ideally a
variation of surface emissive power over the flame to allow for smoke obscuration) should be
used.. Typical values of F and F ′ are provided in Section 5.4.2 for a range of fire types.
q1 = qrl + qcl
( )
q1 = ε f σ T f4 + τ f σ Ta4 + h T f − Ts ............................................... Equation 5-6
where
T f , Ts and Ta are the flame, object surface and ambient temperatures respectively
(K)
However, not all the thermal loading is necessarily absorbed by the surface, some may be
reflected back and the surface will also lose heat by radiation. Hence the total absorbed load
per unit area ( qt ) is given by:
where α s , α f are the absorptivities of the surface and flame respectively. Assuming that both
the flame and surface can be considered as diffuse grey bodies, then α s = ε s , α f = ε f and
τ f = 1 − ε f . Furthermore, the term involving Ta is small and can be neglected, giving:
qt = qr + qc
Issue 1 May 2007 Page 186 of 493
FIRE AND EXPLOSION GUIDANCE
( ) ( )
qt = ε s σ ε f T f4 − Ts4 + h T f − Ts ............................................... Equation 5-8
When considering an actual object engulfed by a fire, the flame temperature exposed to
different parts of the object surface may vary; similarly the flame velocities (and hence
convective heat transfer coefficient) may vary. Hence, to determine the total load absorbed by
an object, Equation 5-8 should be summed over the area of the object.
Also, as the object engulfed in the flame heats up, the absorbed load will reduce. This is
particularly the case with the convective load which reduces linearly with increasing object
temperature. Therefore, for an accurate transient calculation of the temperature rise of an
object, the parameters T f , ε f and h are required, together with the emissivity of the surface
(which itself may change as the surface heats up). Where possible, typical values of these
parameters are provided in Section 5.4.2.
However, researchers often quote heat fluxes measured during experiments using
calorimeters (for total heat flux) and radiometers (for radiative flux). These instruments are
designed to have a surface emissivity close to 1 and are maintained at a low temperature
throughout the experiments. Hence the fluxes measured and reported for calorimeters are
given by Equation 5-8 with ε s = 1 and Ts ≈ 333 K and can be regarded as a conservative
estimate of the total heat flux absorbed by an engulfed object. Radiometers are designed and
calibrated to measure ε f σ T f4 . At an early stage, whilst Ts is low, the flux measured by a
radiometer is approximately ( qr ε s ) and so, if ε s is taken as 1, it provides a conservative
estimate of the radiative flux absorbed by an object.
Subtracting the measured radiative flux from the measured total heat flux enables the initial
convective flux absorbed by the object to be determined. Using an estimated or measured
value for T f enables h to be determined at the measurement location. In this way,
experimentally measured flux levels can be used to derive input data for transient heat-up
calculations (see also Section 5.5.1.6).
Consequently, typical values of the total, radiative and convective fluxes (as defined in
Equation 5-8 above with ε s = 1 and Ts ≈ 333 K ) are also provided in Section 5.4.2 for the
range of fire types.
m&
φ =r ........................................................................................ Equation 5-9
a&
Where;
r is the mass ratio of air to fuel required for stoichiometric burning (that is ~15)
Hence, for stoichiometric burning, φ = 1 and the rate of formation of products will be (r + 1)
times the mass burning rate of fuel. For well ventilated fires where plentiful air mixes with the
fuel, φ < 1 and more products may be produced compared to the case of stoichiometric
combustion. However, the excess air in the products dilutes the smoke, reducing both the
concentration of toxic products and soot and also lowering the temperature. For fires where
the ventilation is restricted to an extent that insufficient air is available for complete
combustion, φ > 1 and the concentrations of intermediate combustion products (for example
CO and soot) will increase and are more likely to persist beyond the flame envelope.
The amount of CO within the combustion products is usually quantified in terms of its volume
concentration as a volume percentage (or ppm). For soot, the mass concentration of particles
in the combustion products is difficult to measure and an alternative approach is to determine
the optical density by measuring the attenuation of a beam of light passing through the smoke.
The optical density, D10 , is given by:
⎛ I ⎞ 10
D10 = −10 log10 ⎜ ⎟ = κ C L ............................................. Equation 5-10
⎝ I 0 ⎠ 2.303
Where;
The resulting fire size following an accidental release will be strongly dependent on the mass
release rate of the fuel, which will be determined by the hole size and pressure. For a QRA a
range of representative scenarios should be considered (see also Section 2.6.5.9).
For high pressure gas releases, these correspond to failure sizes of the order of 1, 10, 30 and
100 mm diameter respectively.
In the following section, these leak sizes are considered for the gas jet fires and two-phase jet
fires. For leak sizes 10 kg s-1 and above, the fire is large compared with the average module
and it may be necessary to consider the fire to be ‘confined’ with the consequent effects on fire
characteristics as discussed in Sections 5.2.2.3 and 5.2.3.3.
A small pool fire might typically result for a leak rate in the region of 1 to 2 kg s-1 and, within a
typical open module, would be expected to burn in the fuel controlled regime, that is, sufficient
air for combustion should be available and the fire behaviour would not be affected by
confinement or restricted ventilation. A large pool fire would be expected to produce a flame
reaching to the roof of a module and be affected by the confinement. It may also suffer from
restricted ventilation. Consequently, the effects of confinement on fire characteristics as
discussed in Section 5.2.3.3 need to be considered.
Issue 1 May 2007 Page 189 of 493
FIRE AND EXPLOSION GUIDANCE
A similar effect might arise for a small pool fire within a compartment within a module and
these fires should be considered as behaving like a large pool fire.
For pool fires on the sea, only large spills are considered, as small spills are unlikely to affect
the installation. Similarly, only a gas fed fire at the sea surface due to major failure of a 24”
diameter sub-sea pipeline is considered.
For BLEVEs, as discussed in Section 5.2.5 even a small inventory would be expected to give
rise to a fireball extending throughout a module resulting in serious consequences for
personnel within the immediate area.
Ideally, the fire size and thermal loading from fires should be assessed using mathematical
models which have been extensively validated against large scale data. A range of such
models are available on a licence or consultancy basis. (See Section 5.4.3 and Annex F).
However, a simplified approach was proposed in the Interim Guidance Notes, whereby
correlations for flame dimensions were suggested for jet and pool fires together with guidance
on typical heat loadings to engulfed objects. In this section a similar approach to the Interim
Guidance Notes is taken and updated to reflect recent knowledge and experimental work. For
the six fire types identified and discussed in Section 5.2, tabulated values are provided giving
guidance on typical fire sizes and heat loadings for the release rates identified in Section 5.4.1.
The values presented were derived from information in the literature; the results of an
extensive body of large scale experimental data (some of which is unpublished but to which
Advantica has kindly provided access); and predictions made by Shell and Advantica. In
essence the fire loading data presented here is an updated, more detailed and comprehensive
version of the guidance values provided in the Energy Institute document ‘Guidelines for the
design and protection of pressure systems to withstand severe fires’ Information on smoke
loading is also based on experimental data gathered by Advantica and Shell, much of which is
unpublished.
Wherever possible, the following information is provided for the four release rates of
Section 5.4.1:
• The expected flame extent, so that items or personnel within that range can be
identified and the consequences of flame engulfment considered.
• The Fraction of Heat Radiated, F, so that estimates of the far field incident radiation
hazard can be made using Equation 5-3 in Section 5.3.1.
• The total heat flux to an engulfed object together with the radiative and convective
components, so that calculations of the object heat-up can be performed (see
Section 5.5 “Heat transfer”). Note that these fluxes represent the initial values when the
engulfed object is cold. Values of typical flame temperature, emissivity and convective
heat transfer coefficients are also provided.
This information is presented in Table 5.1 for gas jet fires and Table 5.2 for two-phase jet fires.
As discussed in Section 5.2.2.5, for two-phase jet fires, the maximum heat fluxes to engulfed
objects have been found to occur when the mixture is about 30 % gas and 70 % liquid by
mass. Consequently, the values shown in Table 5.2 correspond to this worst case condition.
It should be noted in Table 5.1 and Table 5.2 that for the largest leaks (i.e. a flow rate
>30 kg s-1 a single number is given for the total heat flux which could be interpreted as
implying a constant value for all of these larger release rates. Where heat flux calculations are
required for larger leak rates, the heat flux figures should be used with caution, CFD
simulations can be used to obtain data on the effects of larger fires.
Flashing
liquid
Fuel mix of 30 % gas, 70 % liquid by
fires (e.g.
mass propane/
butane).
⎛ x ⎞
Use Fm = ⎜ ⎟ ⋅ ( FL − FG ) + FG where FG is the fraction of heat radiated for natural gas as
⎝ 100 ⎠
given in Table 5.1 and FL is the fraction of heat radiated for the liquid fuel involved. Take
FL = 0.24 for C3; 0.32 for C4, 0.45 for C6-C25 (including condensate and diesel); and
0.5 for crude oil.
• The expected flame extent, so that items or personnel within that range can be
identified and the consequences of flame engulfment considered.
• The mass burning, so that the duration of a fire following a spillage might be assessed
and to provide input to calculations of the incident radiation field.
• The Fraction of Heat Radiated, F, so that estimates of the far field incident radiation
hazard can be made using Equation 5-3 in Section 5.3.1, where the rate of fuel
combustion, m& , is taken as the mass burning rate times the area of the pool.
• The total heat flux to an engulfed object together with the radiative and convective
components, so that calculations of the object heat-up can be performed (see
Section 5.5). Note that these fluxes represent the initial values when the engulfed
object is cold. Values of typical flame temperature, emissivity and convective heat
transfer coefficients are also provided.
• The effect of deluge in terms of the reduction in the heat flux to engulfed objects and
the enhanced attenuation of incident radiation to the surroundings using the Effective
Fraction of Heat Radiated, F’ (see Equation 5-4).
Convective - - 0.02
Heat Transfer,
h Coefficient
(kWm-2K-1)
The following information is provided in Table 5.4 for hydrocarbon pool fires on the sea:
• The expected flame extent, so that items within that range can be identified and the
consequences of flame engulfment considered.
• The mass burning, so that the duration of a fire following a spillage might be assessed
and to provide input to calculations of the incident radiation field.
• The Fraction of Heat Radiated, F, so that calculations of the far field incident radiation
hazard can be made using Equation 5-3, where the rate of fuel combustion, m& , is
taken as the mass burning rate times the area of the pool.
• The total heat flux to an engulfed object together with the radiative and convective
components, so that calculations of the object heat-up can be performed (see
Section 5.5 “Heat transfer”). Values of typical flame temperature, emissivity and
convective heat transfer coefficients are also provided.
The gas outflow from a sub-sea pipeline will depend on the pressure and the pipeline size.
The release will also vary with time; this variation depending upon the length of pipeline which
is depressurising. Similarly, the area at the sea surface over which the gas emerges will
depend on the depth and the gas release rate. Furthermore, depending on the gas outflow and
the depth, the gas plume at the sea surface may not be within flammable limits. For these
reasons, simplified guidance cannot be readily provided and the use of a model is
recommended. This topic is an area of some uncertainty and model predictions vary
considerably. For illustrative purposes, predictions of the fire hazard following the rupture of a
long 24” diameter natural gas pipeline operating at 100 barg at a depth of 50 m suggest that
the fire diameter might be of the order of 100 m with a flame length of 150-200 m. On the basis
that the fire is a low velocity laminar flame, it can be regarded as a large pool fire and the
values presented in Table 5.4 for fraction of heat radiated and heat fluxes are recommended.
5.4.2.5 BLEVEs
BLEVEs are highly transient events in which a fixed inventory is instantaneously released. The
subsequent combustion gives rise to a fireball which grows in size to a maximum before
burning out as all the fuel is consumed. Consequently, the key parameters of interest in terms
of a consequence assessment are the extent of the flame and the incident radiation hazard to
personnel outside the flame. These parameters are also highly transient. In relation to incident
radiation levels outside the fireball, both the maximum level experienced and the ‘dosage’ over
the duration of the event are of interest in order to determine the effect on people.
• Typical maximum fireball diameter (assuming unconfined) based on the mass of fuel
involved in the BLEVE, and the maximum flame volume calculated assuming a
spherical geometry. Hence the area of a module which would be expected to be
engulfed in flame can be assessed by dividing the volume of the fireball by the height
of the module.
• The expected duration as a function of the mass of fuel involved in the BLEVE.
• The Modified Fraction of Heat Radiated F*, which can be used to calculate the
maximum incident radiation received at a location d, remote from the fireball (more
than one fireball diameter distant from edge of fireball) using the equation:
d is the distance from the centre of the fireball where the dosage is
experienced (m)
Various correlations have been developed relating the maximum diameter (D), maximum
height (h) and duration (t) of the fireball following an unconfined BLEVE to the mass of fuel
released, for example CCPS Guidelines for Chemical Process Quantitative Risk Analysis [5.1]
suggests that:
D = 6.48 x M0.325
h = 0.75 x D
t = 0.825 x M0.26
These equations have been used to derive the values presented in Table 5.5 for maximum
diameter and duration. Comparisons with large scale data showed reasonable agreement.
0.35
(ONLY for use in Equation 5-11 to derive
Modified Fraction of Heat Radiated, F*
maximum incident radiation at a locations remote
from the fireball)
• Empirical models;
• Integral (or phenomenological) models;
• Numerical (CFD) models.
Integral models use equations relating the fire characteristics to the physical processes
involved, such as mixing, combustion and thermal emissions. However, the relationships are
simplified and are generally one-dimensional. Such models will also often contain some
parameters which have been empirically derived from experimental data. Nevertheless,
integral models provide an effective method for predicting fire characteristics and are generally
easy to use. Strictly speaking, they should only be applied to the range of circumstances for
which they have been validated by experimental data. However, because of the physical basis
of the equations, the models can be applied, within reason, to situations outside this range.
Numerical models (CFD) attempt to model in 3-dimensions the time varying processes within a
fire such as the fluid flow and combustion processes. In principle, this physical basis enables
these models to study complex geometries and conditions far removed from experimental data
used to validate them. It is noted that resulting predictions may be sensitive to small changes
in input parameters if not used properly. Therefore these models generally require ‘expert’
users.. For these reasons, CFD codes are not routinely used for general risk assessments.
However, they can be useful to study in detail a particular fire scenario of interest due to its
severity. The impact of potential design changes (such as increased ventilation) can then
compared and provide at least qualitative guidance on how to reduce the hazard. The CFD
predictions use more realistic geometry and dynamic models and may require the risk
assessment to take into account new parameters such as the leak jet direction, leak location,
and the dynamic behaviour of the fire. This makes the risk analysis larger. For explosion risk,
the CFD method is well established following the NORSOK Z13 standard [5.2]. However, for
fire risk calculations, it is not routinely used.
Annex F discusses the above model types in more detail and provides an in-depth review of
different fire modes currently available.
Basic heat transfer by radiation, convection and conduction is well covered in the standard text
books (e.g. Incropera and De Witt, 2002 [5.3]). This section concentrates on determination of
heat transfer using the values identified in Table 5.1 through to Table 5.5 for key parameters
measured in intermediate and large scale trials as; previously, these have not been readily
available. This follows on from the approach recommended by the Energy Institute (formerly
the Institute of Petroleum) in assessing the effect of severe fires on pressure vessels (Energy
Institute, 2003) [5.4].
5.5.1.2 Radiation
Radiation from the hot gases and incandescent soot particles is the main mechanism for
transferring heat. For flames with relatively little momentum, e.g. pool fires, radiative transfer to
an impinged object represents at least 80 % of the heat transferred. Even with impinging high
velocity jet fires, radiative heat transfer still represents 50 % to 60 % of the heat load.
If an object is definitely not directly impinged by flame, the radiative heat transfer is given by
Equation 5-12 below.
where VF is the geometric view factor, E (kW m-2) is the surface emissive power of the flames
and is the atmospheric transmissivity.
The view factor is purely a geometrical parameter determining the proportion of radiation
leaving one surface which reaches a second surface. As radiation travels in straight lines, only
those parts of the respective surfaces that can see one another contribute to the value of the
view factor. Analytical expressions for the view factor are available for standard geometries,
e.g. McGuire J H, 1953 [5.5]. For example, pool fires may be represented by tilted cylinders,
jet fires by a conical frustum and fireballs by circular discs through the centre of the fireball.
Numerical integration may be used for more complex geometries where the flame surface is
divided into a series of regular shapes (e.g. triangles or squares) and the view factors for each
of these summed.
Equation 5-13
Where
288.651
X ( H 2O ) = Rh d S mm ..................................................... Equation 5-14
T
Rh is the fractional relative humidity, d is the path length (m), Smm is the saturated vapour
pressure of water (mmHg) at atmospheric temperature T (K). This expression assumes that
the flame is 1500 K, which was chosen as an average between that of a propane fire and a
LNG fire. The transmissivity given by this expression at 15 °C is illustrated by Figure 5.5.1.
As indicated in Section 5.3.1, the radiation to the surroundings may be represented by a point
source model. For a point source model, the radiation received (qd, kWm-2) at a distance d (m)
is given by:
τ F m& H
qd = .............................................................................. Equation 5-15
4π d2
Generally, the heat of combustion (H, kJ kg-1) will be known from the literature (e.g.
Weast [5.6]) and typical values for the fraction (F) of the heat of combustion radiated for six
main fire scenarios considered are given in Section 5.4.2. The mass burning rates ( m & ) for
hydrocarbon pool fires are given in Table 5.3. Slightly higher values are given for C3/C4 and
condensate pool fires if the pool diameter is greater than 5 m. For jet fires, the mass burning
rate is based on the leakage rate and, for QRA, these are generally assumed to be 0.1, 1, 10
or > 30 kg s-1. In the case of fireballs, the mass burning rate is based on the total amount of
fuel released divided by a fireball duration calculated using an expression (0.825. mass0.26)
based on the mass released.
Application of the two techniques is illustrated using data from the BLEVE of a 2 tonne LPG
tank (Roberts et al., 2000 [5.7]). The relevant data are summarised in Table 5.6 below.
Parameter Value
Heat of combustion 46000 kJ kg-1
Amount of fuel released 1708 kg
Duration 7s
Mass burning rate 244 kg s-1
Fraction of heat of combustion radiated 0.38
Surface emissive power 312 kW m-2
Fireball diameter 71 m
The full data set indicated that the maximum output from the fireball was at the lift off point.
This situation can be modelled by treating the fireball as a disc through the centre of the
fireball just touching the surface and the target as a vertical receiver (normally it is necessary
to determine both the vertical and the horizontal component of the view factor) on the surface
(see Figure 5.2).
Figure 5.2 - View factor for circular disc with receiver off axis but parallel
⎛ ⎞
⎜ y2 + z 2 − R2 ⎟
VF = 0.5 ⎜ 1 − ⎟ .......................... Equation 5-16
R4 + 2 ( y2 − z 2 ) R2 + ( y2 − z 2 )
2
⎜ ⎟
⎝ ⎠
⎛ n ⎞
VF = 0.5 ⎜1 − ⎟ ................................................................. Equation 5-17
⎝ 4 + n2 ⎠
Table 5.1 provides the data for applying both a solid flame and point source model. Assuming
an atmospheric transmissivity of 1, the results from application of each model are plotted in
Figure 5.3.
Figure 5.3 - Comparison of solid flame and point source model for a fireball
Figure 5.3 suggests that a solid flame model should be used if the object of interest is closer
than two flame widths/lengths from the flame as, at these distances, the receiver cannot “see”
all of the flame.
The above models are only applicable if there is no direct flame impingement. If the flames are
impinging on an object then the radiation received may be approximated (ignoring reflection
and re-radiation, see Section 5.3.2 for the derivation) by Equation 5-18.
where εf, εs are the flame and surface emissivities, σ is the Stefan-Boltzmann constant
(5.6697 x 10-8 Wm-2K-4), and Tf, Ts are the flame and object surface temperatures (K).
Section 5.4.2 gives typical values for these coefficients for a range of fire types and sizes.
5.5.1.3 Convection
Heat transfer by convection occurs when there are hot gases flowing over the surface of the
object. Convective heat transfer will always occur to some extent if there is direct flame
impingement and, in these circumstances, at least as much radiative heat transfer will
accompany it. Convective heat transfer can occur without significant radiative heat transfer if a
plume of hot gases is channelled to an object not in direct (or reflected) line of site with the
flames. Heat transfer by convection from impinging flames is represented by Equation 5-19.
where Tf and Ts are the flame and object surface temperatures respectively (K) and h is the
convective heat transfer coefficient (W m-2 K-1). The convective heat transfer coefficient varies
with geometry, boundary layer conditions, gas velocity and temperature. Typical values for the
heat transfer coefficient for a range of types and sizes of fire are given in Section 5.4.2. In
cases where there is convective heat transfer from a hot plume, the plume temperature can be
used in Equation 5-17 instead of the flame temperature if it can be reasonably estimated.
5.5.1.4 Conduction
Heat transfer by conduction is very small compared to the other methods of heat transfer but
needs to be taken into account in some circumstances. One-dimensional heat conduction
under steady state conditions is represented by Equation 5-20 below.
qcond = k
(Ts − Tl ) ......................................................................... Equation 5-20
L
where Ts is the temperature (K) of the surface exposed to flame, Tl is the temperature (K) at a
thickness L (m) and k is the thermal conductivity (Wm-1K-1). The thermal conductivity of carbon
steel is about 45 Wm-1K-1 and hence, even with a fairly large temperature differential, the heat
transmitted is low. Hence, in most circumstances, the heat transmitted by conduction can be
ignored. However, there can be problems through differential heating at the joints between
thick and thin thick-walled structures. The other conditions where conduction is normally taken
into account are where heat is transferred through passive fire protection or through the walls
of a vessel or pipe to a fluid inside.
Generally, flames are not static. They will move around in the wind and will vary with the fuel
release rate, amount of back radiation etc. For a pool fire, the wind may tilt the flame towards,
away from or sideways to the receiver. With jet fires, a co-flowing wind will elongate the flames
and a variable crosswind will move the flames from side to side. A fireball will present a
smaller flame area up and down wind compared to the crosswind area. An understanding of
the geometry of the flame is essential in order to apply the heat transfer mechanisms identified
in the previous section.
• Carsley (1995) [5.11] has developed a model for predicting the probability of
impingement of jet fires;
• Cracknell et al. (1995) [5.12] have developed one for the heat flux on a cylindrical target
due to the impingement of a large-scale natural gas jet fire;
• Chamberlain (1995) [5.13] considered the hazards from confined pool fires in offshore
modules.
A feature of most of these models is that the surface emissive power used for a particular
situation will depend on how the flame geometry is modelled for that situation. Hence a model
using a high surface emissive power and relatively low flame area may/should give the same
answer as a model using a relatively low surface emissive power but larger flame area.
Combustion models used in computational fluid dynamics (CFD) have advanced, enabling
more realistic modelling in situations where the fire scenario can be fully described (this is
discussed further in Annex F). However, in preparing a safety case, only general assumptions
are normally made and in practice, CFD would only be used to look at a particular case in
detail when the extent of the safety issues or costs at risk justify it.
In assessing the heat transferred, the key decision is on whether or not the object is impinged
by flame. For the general case, it may be sufficient to apply a safety margin, e.g. 50 %, to the
flame lengths given by a model or the relevant table in Section 5.4.2. If a key structural item is
of particular concern, e.g. a platform support leg, one approach used by industry is to estimate
(using a solid flame model) the distance for 50 kW m-2 received radiation and assume that
everything within this distance is impinged by flame and that everything outside this distance
only receives radiation.
In practice, the heat transferred to a receiver will depend on whether it is fully, partially or not
enveloped in flame and, in partially or totally enclosed modules, how much re-radiation there is
from walls, ceilings and process plant. Even when there is full engulfment, the situation is still
complicated as the:
• Relative proportions of radiative and convective load from a flame will vary depending on
the fuel type and location of the object within the flame.
• Total heat loads will vary depending on the fuel type, the size and shape of the object
and the location of the object within the fire:
Particularly with jet fires, the flames can be channelled along and around an object where heat
loads will vary over the surface of the object and the heat absorbed by the object will vary with
time.
Whilst detailed analysis may now be made using CFD and finite element analysis, calculations
for an initial analysis can be readily performed if some of the above factors are simplified.
In these circumstances, the heat transferred to the object surface from an impinging flame
may be represented by Equation 5-8.
If the object is not impinged by flame (e.g. beyond the 50 kWm-2 distance) then, ignoring the
hot plume case, the heat transfer is by radiation and the solid flame model (Equation 5-1)
should be applied.
If the object is more than two flame widths/lengths away then the point source (Equation 5-3)
or a multipoint source model (where the source is split into a number of zones, each
representing a fraction of the total radiation emitted and each zone represented by a point
source emitting this fraction of the radiation) may be used as an alternative to the solid flame
model. It may be used at closer distances but the results will be very conservative. This may
be acceptable in some situations.
τ F m& H
qrad = ............................................................................ Equation 5-23
4π d2
All the equations given above provide the heat flux to the surface of the receiver. The key
requirement is to determine the temperature rise in the item being considered and the time
taken to reach the critical temperature for that particular component. The main situations
considered are:
• Unprotected steel;
• People.
As the heat absorbed is a time dependent process. Mathematical models, particularly finite
difference methods, are available which can undertake these calculations from first principles
or with the input parameters εs, εφ,, Tf and h as determined by the particular model used or as
provided in the tables in Section 5.4.2. Such models may also simultaneously calculate the
heat up of a structure, a vessel or pipe work contents. However, conservative calculations of
heat up can be undertaken on the basis that, at any particular time, steady state conditions
exist.
The equations given in FABIG Technical Note 1 [5.14] are still valid. However, those equations
used a section factor (Hp/A, m-1) defined as the heated perimeter (Hp, m) divided by the steel
cross-sectional area (A, m2). ASFP (2002) [5.15] comment that in new European fire testing
and design standards (e.g. ENV 13381-4 2002 [5.16], BS EN 1993-1-2 2005 [5.17] and
BS EN 1994-1-2 [5.18],) the section factor (the unit remains the same, i.e. m-1) is defined as
Asteel/Vsteel (note: the steel subscripts are provided here to avoid confusion with other
parameters) where Asteel is the surface area of steel exposed to fire per unit length and Vsteel is
the volume of the section per unit length. Using the Asteel and Vsteel notation, for a fully engulfed
steel member, e.g. an I - beam, the heat up of the steel member is described by Equation 5-24
below.
dT
ε s σ ( ε f T f4 − Ts4 ) + h (T f − Ts ) =
Vsteel
Csteel ρ steel .................... Equation 5-24
Asteel dt
Where Csteel is the steel heat capacity (Jkg-1 K-1) and ρsteel is the steel density (kg m-3). A steel
section with a large surface area will receive more heat than one with a smaller surface area
and the greater the volume the greater the heat sink. Hence the lower the section factor the
slower an I - beam will heat up. For an I - beam, the heated perimeter (ASFP still use this in
their examples and data sheets) is calculated as:
Where B and D are the overall breadth and depth of the section and W is the web thickness. A
comprehensive list of heated perimeter equations for different types of beams, columns etc are
given by ASFP [5.15].
Vsteel dT
qrad = V f E τ = Csteel ρ steel ............................................... Equation 5-25
Asteel dt
In this case, the heated perimeter is the projected area of the member that sees the radiation.
Equation 5-24 and Equation 5-25 can be solved numerically (e.g. by using a spreadsheet with
fixed cell addresses for the constants) by using incremental time steps. An example is given in
Section 5.5.1.9 on pressure vessels.
The Interim Guidance Notes [5.19] advocate a heated perimeter approach when the steel is
insulated. The equation assuming that the fire protection material has negligible heat capacity
is shown below (Equation 5-26). It is assumed that the insulation surface temperature (Ts)
rapidly reaches the flame temperature.
Asteel K PFP
dT = (Ts − T ) dt .................................................... Equation 5-26
Vsteel Csteel ρ steel L
where KPFP is the thermal conductivity of the protection material and L the thickness of the
insulation material.
It should be noted that the thermal conductivity and heat capacity of both the steel and the
insulation material will vary with temperature and, for accurate calculations; these would have
to be expressed as parametric equations. The problem is that it is very difficult to obtain a
realistic value for both the thermal conductivity and heat capacity as most forms of passive fire
protection react in a complex way.
Generally, steel may be protected from fire by passive fire protection, which may take the form
of a cladding or a coating (cementitious, vermiculite or intumescent). Summaries of their
properties are reiterated below and should be read in conjunction with further detail in
Section 3.2.8.1, “Firewalls” and 3.2.8.9 “Passive fire protection methods”.
1. Inert cladding e.g. ceramic boards, a thin steel panel backed by mineral wool, a removal
jacket or a composite panel. The insulation backed steel panels act as passive insulator
until the insulating materials melts leaving voids. Insulation materials such as rock wool
contain resins that will melt and migrate. Composite panels may comprise a series of
panels of different materials with either air gaps between them or some or all of the gaps
filled with insulating material. In most of these cases, the thermal conductivity needs to
take account of different materials and of internal voids giving rise to internal convection
effects and heat capacity will vary with each material used.
2. Cementitious coatings. These will act as passive insulator with a thermal conductivity
dependent on the amount of water present until the temperature reaches about 100 °C.
The temperature will be kept at this until all the chemically and physically bound water
has been driven off. The temperature will then rise with the material again acting as
passive insulator but with a different thermal conductivity. Hence, an overall thermal
conductivity value must account for movement and evaporation of water in a situation
where the total amount of physically bound water is not likely to be known.
Not withstanding all the problems identified, the manufacturers will have data from furnace
tests with cellulosic and hydrocarbon heat up curves and will have resistance to jet fire test
data. In general, the manufacturers will use the ASFP (2002) [5.15] method to derive the
thickness of material required to protect against a particular fire scenario or combination of fire
scenarios e.g. jet fire preceding a pool fire. The manufacturers will have performed a series of
furnace tests conducted on structural elements with varying section factors, usually between
50 and 350 m-1, to various fire durations and limiting temperatures. The thickness of material
(L) required to provide specific standards of fire resistance e.g. at least 1 hour for a mean
temperature rise of 140 °C, is derived by means of the empirical relationship:
Vsteel
tresist = a0 + a1 L + a2 L ............................................................ Equation 5-27
Asteel
where tresist is the fire resistance time (minutes). The furnace tests are chosen to cover the
range of section factors, thicknesses and duration required. The constants, a0, a1 and a2,
applicable to each material are determined by multiple linear regressions. Once a satisfactory
correlation has been obtained, the protection thicknesses for a given section factor and
required fire resistance time can be derived using the rearranged equation:
tresist − a0
L= .......................................................................... Equation 5-28
V
a1 steel + a2
Asteel
Generally, interpolation of fire test data is allowed but extrapolation is not. ASFP (2002) [5.15]
give illustrations of how this works with product data sheets based on cellulosic fire curve
furnace tests.
A method of combining the results from furnace and jet fire tests is to compare results from
tests on substrates with similar section factors (usually about 100 m-1) and use this to derive
an “erosion” factor which is added to the value obtained from the expression derived from the
furnace tests. This data can also allow approximate thermal conductivities and heat capacities
to be determined but they will be product specific and the manufacturers of the products being
considered should be consulted.
There are many different processes occurring when a flame interacts with a pressure vessel
due to the complex behaviour of the flame, the vessel and the vessel contents. API has
considered the requirements for pressure relief valves (API 520, 1997) [5.21] and emergency
depressurisation systems (ISO 23251:2006, 2005) [5.20] and these are considered in
Section 7.7 discussing relieving and other process responses. However, API only considers
relatively small hydrocarbon pool fires and, if it is a realistic fire scenario, a pressure vessel is
much more likely to fail in a jet fire. This was reviewed by Roberts et al. (2000) [5.22] and the
Institute of Petroleum (2003) [5.4] have published guidance on the effects of severe fires on
pressure vessels and Scandpower (2004) [5.23] have considered this in regard to emergency
depressurisation.
Issue 1 May 2007 Page 208 of 493
FIRE AND EXPLOSION GUIDANCE
The key processes occurring during jet-fire impingement on pressure vessels include:
• Heat transfer between the fire and outer surface of the vessel, in the vapour and liquid
'zones', by radiation and convection;
• Heat transfer through the vessel walls by conduction. The wall may comprise of an outer
passive fire protection (PFP) coating plus the underlying steel wall;
• Heat transfer into the vessel fluids by predominantly radiation in the vapour space, and
by natural convection or nucleate boiling in the liquid phase;
• Mass transfer from the bulk liquid or vapour to the outside environment through any holes
in the vessel;
• Mass transfer out of the vessel through any open or partially open pressure safety valves
(PSVs);
• Mass transfer within the liquid phase by flow of heated fluid into a stratified 'hot' layer
lying above the bulk liquid. The hot layer may or may not be stable;
• Mass transfer between the liquid and vapour phases by evaporation;
• Pressure, enthalpy and composition changes (e.g. relative fractions of mixed
hydrocarbons in a separator) in the fluids during each of the above processes;
• Catastrophic vessel failure resulting in a possible BLEVE.
The heat transfer processes described above are shown schematically in Figure 5.5.
Various models have been proposed that take these factors into account although few have
been fully validated. Persaud et al. (2001) [5.24] have applied the Shell HEATUP model to the
heat up and failure of LPG tanks. They give equations for all the physics describing heat and
mass transfer processes and predict vessel failure by comparing the hoop stress with the
ultimate tensile strength of steel.
Issue 1 May 2007 Page 209 of 493
FIRE AND EXPLOSION GUIDANCE
In practice, when a fire impinges on a vessel containing liquid, the wall in contact with vapour
will heat up very quickly and the wall in contact with liquid will stay at a relatively low
temperature unless film boiling occurs. In flashing liquid propane jet fire trials on unprotected
2 tonne LPG tanks (Roberts et al., 2000) [5.25] the vapour wall reached up to 870 °C on failure
whilst the wall in contact with liquid did not exceed 230 °C.
LPG trials indicate that the prime cause of failure, at least for relatively thin walled vessels,
was heating the wall in contact with vapour to a temperature where the steel weakened rather
than due to over pressurisation although over pressurisation will be an important factor if a
vessel becomes hydraulically full. Gayton and Murphy (1995) [5.26] also suggest that time to
metal plate rupture is used in depressurisation system design. On this basis, a conservative
estimate can be made of the time to failure by ignoring the heat transfer to the contents. As
indicated above, the iterative process for solving the time dependent heat transfer equations is
illustrated for the vessel vapour wall case.
Δt q0
ΔT = .......................................................................... Equation 5-29
Csteel ρ steel L
where the initial heat absorbed by the wall (ignoring heat losses to the contents) is given by
Equation 5-30 below.
At time t1 = t0 + Δt, the surface temperature will be T1 = T0 + ΔT, where T0 is the initial surface
temperature.
Using the new T1 and substituting into Equation 5-30, then the heat absorbed at time t1 is,
So, in general, at time ti, the thermal flux absorbed by the object is given by:
and the temperature of the object will increase to Ti+1 = Ti + ΔTi where
Δt qi
ΔTi = .......................................................................... Equation 5-33
Csteel ρsteel L
In order to illustrate the conservatism of the data in Section 5.4.2, both trials data and data
derived from Table 5.1 are given below in Table 5.7.
Flashing liquid
fires Trials
Parameter
1 kg s-1 data
(From Table 5.1)
The predicted rise in wall temperature, for an initial temperature of 20 °C, is illustrated in
Figure 5.6. The measured times to failure and maximum wall temperatures (all at positions in
contact with vapour) for each degree of fill are summarised in Table 5.8, the same failure
points also shown in Figure 5.6.
Heat up times
1200
1000
Wall temperature (oC)
800
600
0
0 60 120 180 240 300
Time (s)
Figure 5.6 - Comparison of heat up time with LPG failure times and temperatures
A comparison can also be made with data for an unwetted 25.4 mm plate, which .gives
12 minutes to reach 593 °C. Use of the small hydrocarbon pool fire data in Table 5.3, gives
about 11 minutes as the time; (the data quoted above are based on calculations from a
gasoline trial with a 0.125” plate).
More discussion of the response of process systems including pressure vessels is considered
further in Section 7.7. As indicated above, the actual heat transfer processes are very
complex. Traditionally, the API approach has been used to calculate the heat transfer to a
vessel contents. For vessels containing only gas, vapour or super-critical fluid the vessel wall
is considered to be unwetted and the heat transfer to the contents is not directly calculated.
For vessels containing liquid, the approach is based on the heat transfer to the wetted surface
of vessels up to a height of 7.6 m; as only relatively small hydrocarbon pool fires are
considered. Two expressions are given; one (Equation 5-34) where adequate drainage and
fire fighting equipment exists and one (Equation 5-35) where it does not.
where Qabsorb is the total heat absorbed (W), F is an environment factor and A is the total
wetted surface area (m2). The expression A0.82 is an area exposure factor which recognises
that large vessels are less likely than small ones to be completely exposed to the flame of an
open fire. In the likely confinement offshore, it would be more appropriate to use A rather than
A0.82. The environment factors are given in Table 5.9.
Note that credit is only given for insulated vessels. API now makes it clear that the insulation
must be passive fire protection but the requirement is that the insulation material should
function effectively up to 904 °C. As is recognised by API, their approach is not suitable if the
fire scenario identified is more severe than a 110 kW m-2, that is, it is not suitable for a jet fire
or a confined hydrocarbon pool fire.
Hekkelstrand and Skulstad (2004) [5.27] consider slightly higher heat fluxes than API. They
consider small to medium size fires on the basis that the aim is to prevent escalation to a large
fire. Two figures are given for the incident heat fluxes from fuel-controlled fires. The local peak
heat load is used to calculate the rise in steel temperature and global average heat load is
used to calculate the pressure profile. Their incident heat fluxes for jet and pool fires are
summarised in Table 5.10.
Jet fire
Pool
Heat load
Leak rate Leak rate* fire
> 2 kgs-1 > 0.1 kgs-1
Local peak 350 250 150
(kWm-2)
Global 100 0 100
average
(kWm-2)
* This calculation is
for an object close
to the fire.
Various rules are given for the application of these values and the original publication [5.27]
should be consulted before using the values given.
There has been considerable interest in the use of directed deluge in protecting against jet
fires. Shirvill and White (1992) [5.30] have shown that deluge systems with the usual medium
velocity nozzles are not effective in protecting against natural gas jet fires. Lev (1995) [5.31]
has suggested that it may be possible with systems using high velocity nozzles and Shirvill
and White suggest it may be possible with high velocity water monitors. Shirvill (2004) [5.32]
has shown that a system delivering about 17 l m-2min-1 is not effective in fully protecting
vessels (keeping the wall temperature to 100 ºC or less) against 2 to 10 kg s-1 flashing liquid
propane and butane jet fires. Roberts et al. have shown that about 30 l m-2min-1 will protect
2 tonne vessels against 2 kg s-1 flashing liquid propane jet fires. Hankinson and Lowesmith
(2003) [5.33] have looked at the effectiveness of area and directed deluge in protecting
against “live” jet fires and all these recent results are summarised in a special edition of the
Journal of Loss Prevention in the Process industries (March, 2003) [5.34]. Even though a
directed deluge system may not be fully effective (primarily in protecting the unwetted wall) in
protecting against flashing liquid propane and butane jet fires, Shirvill [5.32] suggested that the
overall rate of heat transfer is reduced by 50 %. This is consistent with results (Roberts, 2003)
[5.35, 5.36 and 5.37] from 20 % filled LPG tanks.
where kPFP is the thermal conductivity (Wm-1K-1) of the PFP, Trelief the temperature (°C) of the
vessel contents at relieving conditions and L is the thickness (m) of the insulation. API
provides thermal conductivities for a range of materials but these may only be strictly
applicable to hydrocarbon pool fires.
5.5.1.13 People
The response of people to fires is considered in Section 7.8. Hymes et al. (1996) [5.41] have
considered the physiological and pathological effects of thermal radiation and relate these to a
thermal dose (note: dosage is usually taken as irradiation x time).
4
TL = t ( qrad ) 3 10−4 ........................................................................ Equation 5-37
where t is the exposure time (s), qrad the radiation (Wm-2) received and 10-4 a convenient
scaling factor. The radiation received should be calculated from either the solid flame model, if
close to the fire, or the point source model if more than two flame widths/lengths away from
the source.
1. How long can a worker continue to operate in an emergency system whilst exposed to a
given level of radiation?
2. What fraction of the population will die or sustain injury given exposure to a certain dose of
radiation?
In regard to the former, API [5.21] provides permissible design thermal radiation levels for
personnel. These are given in Table 5.11 below (Note: ISO 23251:2006 [5.20] should be
consulted to consider these in the context - disposal by flaring - in which they are given).
Permissible
design level Conditions
(kWm-2)
Maximum radiant heat intensity at any location where urgent emergency action by
personnel is required. When personnel enter or work in an area with the potential for
9.46
radiant heat intensity greater than 6.31 kW m-2, then radiation shielding and/or
special protective apparel (e.g. a fire approach suit) should be considered a
Maximum radiant heat intensity in areas where emergency actions lasting up to 30 s
6.31
may be required by personnel without shielding but with appropriate clothing b
Maximum radiant heat intensity in areas where emergency actions lasting 2 to
4.73 3 minutes may be required by personnel without shielding but with appropriate
clothing b
Maximum radiant heat intensity at any location where personnel with appropriate
1.58
clothing b may be continuously exposed.
Superscript notes:
• It is important to recognise that personnel with appropriate clothing b cannot tolerate thermal
radiation at 6.31 kW m-2 for more than a few seconds.
• Appropriate clothing consists of hard hat, long-sleeved shirts with cuffs buttoned, work gloves,
long-legged pants and work shoes. Appropriate clothing minimises direct skin exposure to
thermal radiation.
The lethality to the population is usually addressed by probit or logit analysis. The two
commonly used probit relations for fatality are:
Eisenberg (based on nuclear bomb data) ........... Y = −14.9 + 2.56 ln ( X ) Equation 5-38
Where X = t qrad
43
Hymes et al. [5.41] gives doses for probability of 1 % and 50 % lethality as 1050 s(W m-2)4/310-
4
and 2300 s (W m-2)4/310-4 respectively. These correspond to a radiation dose of 8.6 kW m-2
for 1 minute or 2.6 kW m-2 for 5 minutes for 1 % lethality and 15.4 kW m-2 for 5 minutes for
50 % lethality.
More details on using these and other methods are given by Lees et al. (1996) [5.42]. The
response of personnel is considered further in Section 7.8.
Gas explosions can be defined as the combustion of a premixed gas cloud containing fuel and
an oxidiser that can result in a rapid rise in pressure. Gas explosions can occur in enclosed
volumes such as industrial process equipment or pipes and in more open areas such as
ventilated offshore modules or onshore process areas [6.4].
For an explosion to occur a gas cloud with a concentration between the Upper Flammability
Limit (UFL) and Lower Flammability Limit (LFL) must be ignited. The overpressure caused by
the explosion will depend, amongst other things, on:
• The congestion or obstacles within the cloud (size, shape, number, location)
For stoichiometric hydrocarbon gas clouds, filling a closed volume initially at atmospheric
pressure, combustion without heat loss will result in overpressures of close to 8 barg. This
pressure rise is mainly due to the temperature rise caused by the combustion process and is
generally not dependent on the congestion within the volume. This type of explosion is
referred to as confined. A stoichiometric air/fuel mixture is such that it contains exactly the
required amount of oxygen to completely consume the fuel.
Gas explosions in more open environments can also lead to significant overpressures
depending on the rate of combustion and the mode of flame propagation in the cloud. All of the
above points can affect the explosion overpressures in this type of environment.
If the rate of volume generation within the explosive region is greater than the ability of the
vents to release this volume then the overpressure will continue to rise.
Two types of explosion can be identified depending on the flame propagation rate:
Most vapour cloud explosions offshore would fall into the category of deflagrations.
In an environment typical of gas explosions on offshore platforms the gas cloud engulfs many
obstacles including equipment, piping, structure etc, often referred to as congestion. It is also
usually confined by a number of solid planes such as plated decks, blast walls, equipment
rooms etc. The explosion typically starts as a slow laminar flame ignited by a weak ignition
source such as a spark. As the gas mixture burns, hot combustion products are created that
expand to approximately the surrounding pressure. As the surrounding mixture flows past the
obstacles within the gas cloud turbulence is created. This turbulence increases the flame
surface area and the combustion rate. This further increases the velocity and turbulence in the
flow field ahead of the flame potentially leading to a strong positive feedback mechanism for
flame acceleration and high explosion overpressures. The behaviour of the explosion will be
influenced by both the degree of confinement and the congestion within the combustion
region.
Large components of the structure such as solid decks or walls experience loads due to the
pressure differences on opposite sides of the structure. Typically within an explosion there will
be a strong variation of the spatial and temporal pressure distribution. There will typically be
localised high regions of overpressure with lower values of average pressure acting on large
components. The overpressure at a location within a gas explosion will typically rise to a peak
value and then fall to a sub atmospheric value before returning to zero overpressure. The
duration of the positive phase in an explosion can vary greatly with shorter durations
associated with higher overpressure explosions. Typical durations range from 50 to 200 ms.
For smaller objects such as piping the overpressures applied to the front and reverse side of
such items will be of approximately the same magnitude at any moment in time and in this
case the overpressure will not apply any net load to the object. For this type of object the
dynamic pressure associated with the gas flow in the explosion will dominate the applied
loads.
Methods for calculating loads acting on intermediate sized objects such as large vessels are
described in Section 6.11.3.
The peak overpressure in this blast wave will then decrease with distance while the blast wave
duration will typically increase and as a result the impulse will decrease more slowly than the
overpressure. The blast wave will be affected by other confining objects such as decks, blast
walls and accommodation blocks that will result in reflection and diffraction of the blast wave.
This may affect the decay of the blast wave and in some cases can increase local
overpressures where a blast wave is reflected from a surface or object. The received pressure
on a flat surface may be greater than that in the incident blast wave. At pressure levels typical
of a blast wave generated by a hydrocarbon explosion, this received pressure may be up to
twice the incident pressure, a process which is referred to as ‘pressure doubling’.
The category of the installation does not preclude the use of more sophisticated methods of
assessment which may result in reduced conservatism and potentially reduced cost. The
treatment in this section concentrates on higher risk methodology techniques with
simplifications for the low risk methodology suggested for each of the tasks described.
An explosion assessment is performed in the following steps, for the earlier steps, the reader
will note the similarity for preparing for a fire risk assessment.
2. The time history of the release rate is calculated. The probability of the occurrence of
the release may be estimated from published failure statistics or even from simulation.
3. A dispersion analysis will predict how the gas or vapour cloud develops and disperses
under wind and ventilation conditions. Part of this cloud will be within the explosive
concentration limits of the gas/air mixture.
4. An ignition source within the explosive part of the gas cloud is then assumed to ignite
the local fuel/air mix causing expansion resulting from combustion in the region
surrounding the ignition point [6.8].
5. Explosion loading software is then used to calculate how the flame front accelerates
through the surrounding environment. Interaction with obstacles gives rise to increased
turbulence, flame folding, increased flame area, increasing overpressures and
increasing gas velocities within and outside the gas cloud.
8. Small objects may be picked up during the explosion, creating secondary projectiles.
The peak energy for typical projectiles may be calculated from the dynamic pressure
load time history and their mass.
9. Secondary, ‘external’ explosions may result as the unburnt fuel/air mixture comes into
contact with the external (oxygen rich) atmosphere.
10. The explosion loads on piping and equipment may result in further releases with
consequent fires or explosions.
11. A blast wave will propagate away from the explosion region and impinge on adjacent
structures.
This section deals with tasks 3 to 11, effectively the ‘Consequence Analysis’.
It is unlikely that the SCEs will withstand a worst case explosion scenario defined as that
scenario which considers a maximum stoichiometric cloud filling the compartment or engulfing
the installation ignited at the worst position. Design explosion loads with a known probability
must then be derived, which the structure and other SCE’s must resist. A method is discussed
which uses exceedance curves for representative peak overpressures for the
compartment/installation. This is discussed in Section 6.10 on the generation of exceedance
curves and Section 8.5.2 on the classification of SCE’s for explosion response assessment.
In order to provide some measure of asset protection as well as protecting life and the
environment two levels of explosion should be considered, the strength level blast (SLB) and
the ductility level blast (DLB).
The first step in the compilation of a frequency versus overpressure curve is the determination
of overall explosion frequency. This can be achieved by standard means used in Fire Risk
Analysis (FRA) using the following steps:
The weak points in the estimation are the variability of gas cloud size with ventilation and
environmental conditions and the choice of ignition time and location. A Monte Carlo approach
may be used to explicitly represent the variability of these and other parameters. Usually a
phenomenological method of calculation of overpressures is used in view of the large number
of simulations necessary. The increased accuracy in the representation of frequency and
consequence variability will offset the reduced accuracy in load determination in the
determination of explosion risk.
6.4 Dispersion
6.4.1 General
Once the release rate and frequency has been determined then the dispersion characteristics
of the gas cloud, vapour cloud or liquid spray release must be calculated. This may include a
time history of the cloud’s extent and the identification of the likely ignition sources in the
flammable range.
The direct CFD method has the advantage that ignition sources and their position in the gas
cloud may be modeled with the effect of wind speed and direction being represented. The
software used for the dispersion simulations may be the same as that used for the explosion
simulation itself. The disadvantage is that at present these simulations do take some time to
perform in view of the long time scale of the dispersion process as compared with the
explosion simulation. This approach is discussed further in the section on the NORSOK
procedure Section 6.13.
The majority of the releases were at a constant rate of between 0.5 to 10 kg s-1 but the effects
of declining release rates were also considered. Gas concentration during the gas release
event was recorded at up to 200 locations within the rig. A correlation for the flammable
volume of gas within the rig (between 5 and 15 % concentration) was derived based on simple
experiments and dimensional considerations. A plot of an upper bound estimate of the fraction
of the module filled with flammable gas against the non-dimensional parameter R is given
below:
R= (dm/dt) / ( ρ s U V L2 )
Where: dm/dt = mass flow rate of gas released into module (kg s-1)
Uv = The average ventilation velocity in the module before the gas is released
(m s-1)
It was generally found that greater confinement gave lower ventilation rates and larger
flammable cloud volumes, however, it should be noted that the larger rate releases
themselves changed the ventilation flow within the test rig.
In reference [6.18] this approach is extended to a ‘workbook’ form. This requires the separate
determination of the ventilation flow rate through a confined and congested region and the
determination of the flammable gas cloud volume. Two estimates of the flammable volume are
made:
• A upper but realistic estimate of the flammable volume that a given release would produce
for use at the ‘screening’ stage
• A mid-range estimate of a typical flammable volume that a release will produce to give a
‘best estimate’ of the likely outcome.
The flow through the module is characterised by a representative ventilation velocity that is
assumed to be related to the external wind velocity. Four generic module layouts are referred
Issue 1 May 2007 Page 223 of 493
FIRE AND EXPLOSION GUIDANCE
to specific details are not described. The normalised volume of the flammable gas cloud is
also defined by a non-dimensional relationship. Finally, a relationship for flammable gas
volume between two given concentrations is given. It is stated that the workbook could be
combined with accidental release rate/frequency data held by regulatory authorities.
LVent RLeak
Mg = 3600
LModule RVentilation
It is stated that this simple model will often give a good estimate of the amount of gas within
the module, provided that the ventilation flow field is close to uniform. For more complex flow
fields the model uncertainty increases.
Hansen [6.21] describes a parameter called ‘Q5’ that is calculated during FLACS dispersion
simulations. To calculate the Q5 parameter the mass of gas at non-stoichiometric
concentrations is multiplied by the burning velocity and the volume expansion ratio at the
concentration, both normalised to that for a stoichiometric mixture. This process calculates the
total mass of gas in the equivalent stoichiometric gas cloud. The filters used in this process
are shown in Figure 4, on page 10 of this reference [6.21]. It is also stated that for very
confined modules the burning rate filter becomes less important and in the case of a fully
closed vessel, only the volume expansion filter should be used.
Pappas [6.22] describes how the complex shape of a dispersed cloud can be represented
using a cubic cloud typically extending from floor to ceiling in the module of interest. It is stated
[6.18] that this method will generally give pressures of similar strength for the equivalent
quiescent clouds as for the non-homogenous and strongly turbulent clouds ignited in full-scale
tests. It is also stated that the explosion overpressure durations may be shorter than for the
non-stoichiometric clouds that may in turn affect the structural response.
A curve relating the likely overpressure to the fraction of the module filled with a gas cloud
normalised to the fully filled case was derived. For fill fractions above 80 % the explosion
overpressures are predicted to be as high as those with a stoichiometric cloud completely
filling the test rig. The experimental data and a possible curve fit to it are shown in Figure 6.2.
It is suggested [6.19] that a simple straight line could be added to this figure to form an upper
bound for the likely overpressures at small fractional equivalent stoichiometric fill volumes.
Data are shown for each large-scale realistic release experiment. The data and correlation for
the idealised partial fill experiments are also shown [6.24].
It is hoped that this process can be improved or that the CFD/phenomenological codes may be
validated against experiment for the case of varying density within the gas cloud.
6.5 Ignition
6.5.1 General
The probability of the occurrence of a detectable overpressure being developed ‘Prexpl‘ is the
product of the probability of the release ‘Prrel‘ and the probability of delayed ignition ‘Prign‘.
The IP review [6.25] of the estimation of ignition probability and noted that adopting generic
correlations for the probability of ignition based on the mass release rate was overly simplistic
and potentially overly conservative. The correlations have been developed to support the use
of ignition probability calculations in QRAs. A model workbook and look-up correlations have
been provided.
The report reviews a range of sources of ignition probability data and benchmarks against
collected incident and reported data. The review looks at linkages with dispersion and
fractional module fill as well as reporting on the effect of ignition source density.
A comparison table [6.25] is reproduced below, see Table 6.2, to illustrate the
comprehensiveness of the review undertaken and upon which the model is based.
Note: 60 % of full module cases, [6.25], probability based on a mass release rate of 2 kgs-1,
the flow indicated by the JIP Gas Build-up Workbook as at transition point at which an open
ended module would become “saturated” with gas. Other volumes are based on simple
momentum jet representation.
The probability review Table 6.3, presents compressed data into a coarser ranking, this
summary is shown below.
Release rate Release rate Cox et al, Cox et al, Revised oil &
category (kgs-1) gas leak oil leak gas
During the Phase 3b tests [6.24] it was observed that for realistic releases giving a non-
uniform cloud density, the ignition of the cloud did not occur every time the ignition source was
activated. This was due to the fact that the source may be located in a non-flammable region
of the cloud or that the initial combustion ceased as the small initial flame front progressed to
non-flammable regions before it could develop. Further information may be found in the E&P
Forum hydrocarbon leak and ignition database [6.29].
If a full dispersion analysis is performed then intermittent and continuous time dependent
ignition may be considered. Assuming a largely uniform distribution in space of ignition
sources will result in a time dependent probability of ignition proportion to the rate of
generation of flammable cloud volume.
Empirical models based on correlations with experimental data and usually used to predict far
field blast effects outside the gas cloud combustion region. The limits of applicability and
accuracy of these methods are generally determined by the extent of the experimental data
that they are based on. They can be simple and quick to use so they can be a practical design
aid but in general the least accurate and cannot address general scenarios, as they should
strictly be used within the range of data on which they are based. Examples of empirical
models include Baker-Strehlow, Congestion Assessment Method and Multi-energy method
and-equivalency [6.1].
Phenomenological methods are simplified physical models that attempt to model the essential
physics of explosions. Generally they represent the actual scenario geometry using a
simplified system, for example a small number of interconnected chambers with turbulence
generating source terms between them, to represent the fully 3 dimensional nature of the real
geometry. This can be a reasonable representation of some geometries such as an offshore
module but may not be adequate for more complex situations. Phenomenological models
typically generate a peak overpressure or a single pressure-time history taken as
representative throughout the area under consideration. Some codes can also predict the blast
wave that will propagate away from the gas combustion region into the far field. Short run
times make this type of model suitable for running large numbers of explosion scenarios.
Examples of phenomenological models include CLICHE/CHAOS, SCOPE (note CLICHÉ and
CHAOS are now included in the Advantica ARAMAS package).
A Monte Carlo approach may be used to explicitly represent the variability of these and other
parameters. Usually a phenomenological method of calculation of overpressures is used in
view of the large number of simulations necessary. The increased accuracy in the
representation of frequency and consequence variability will offset the reduced accuracy in
load determination as compared with CFD simulations in the determination of explosion risk.
Computational Fluid Dynamics (CFD) are in principal the most fundamentally based of the
methods discussed here and have the best potential for accurate prediction of gas explosion
behaviour over a wide range of geometries and explosion scenarios and in both the near and
far field. These tools solve the conservation equations of mass, momentum and energy
including turbulence and combustion in a large number of relatively small control volumes
covering the region of interest. These tools can provide a wide range of information about the
flow field and the explosion behaviour at the expense of significant effort required to set up a
suitable geometry model and significant computational power requirements. In practice
accuracy is limited by:
• Available computation power limiting the numerical resolution that can practically be
used;
• Accuracy of numerical models;
• The underlying empirical sub models for;
o Reaction zone,
o Turbulence generation,
o Turbulence length scale,
o Turbulent combustion.
These models are therefore calibrated against experimental data of which full-scale data is
preferable to avoid scaling effects known to exist in gas explosions [6.30]. The full-scale tests
performed in the Spadeadam test rig during Phases 2, 3a and 3b of the Fire and explosion JIP
therefore provide important reference data for CFD explosion prediction tools. Importantly
Phase 2 of this JIP [6.31] gives a comparison of predictive capabilities for selected explosion
simulation tools.
Examples of specialist CFD gas explosion simulation tools include: AutoReaGas, FLACS,
EXSIM. A simplified formulation CEBAM has been developed in the US.
• The codes are mostly designed to deal with fully turbulent flames.
• The codes do not directly model flame distortion and diffusion/hydrodynamic instabilities
that occur between ignition and fully turbulent combustion. Consequently the codes must
rely on empirical flame folding models that are valid for a limited range of fuel-air
concentrations and boundary conditions.
• The codes do not model flame propagation phenomena involving instabilities associated
with acoustic waves and shocks.
• The codes should not be expected to accurately model flame quenching due to
deficiencies in the models, and due to lack of validation with experiments where
quenching can be directly observed.
Many of these deficiencies are partly due to the current limited understanding of the various
flame propagation phenomena, and due to inadequate computer resources which prevent
sufficient spatial and temporal resolution.
Important inputs to the analysis are the laminar and turbulent flame velocities. The turbulent
flame velocity is related to the laminar flame velocity in Appendix A of the basis document
[6.1]. Further data are available [6.32, 6.33].
• The phenomenological code SCOPE and ‘simple’ CFD codes AutoReaGas, EXSIM and
FLACS are in widespread use
• Phenomenological and CFD methods generally give fairly good accuracy (within an factor
of two*) so these models yield solutions that are approximately correct
• It is recommended to develop ‘advanced’ CFD codes that will allow fully realistic
combustion models and resolution of all obstacles but is stated that it is likely to be 10 or
more years before such tools are available. This is primarily due to the large
computational expense of this type of model.
It is considered however that the present phenomenological and CFD models are adequate for
the assessment process being carried out given the uncertainties in the other stages of the
process.
It should be noted that the view in Norway is that a correct application of the NORSOK
protocol for explosion simulation will result in an accuracy of +/- 30 % in peak overpressures
[6.18, 6.22].
Further extracts from this report can be found [6.1] along with a brief description of the
empirical, phenomenological, and ‘simple’ CFD codes that are described in the report.
‘In light of the fact that gas explosion predictions are needed now, but that it will probably be
ten or more years before the CFD-based models will incorporate fully realistic combustion
models, be able to more adequately model turbulence and turbulence-combustion interaction
as well as being able to accurately represent all important obstacles in real, complex
geometries, one must make the best use of the currently available models. However, it may
be unwise to rely on the predictions of one model only, given the uncertainties that remain –
especially if the model is used outside its range of validation. One must also be aware of the
uncertainties associated with whatever modelling approach is used’.
‘The accuracy expected from, say phenomenological and ‘simple’ CFD models is generally
fairly good (to within a factor of two), e.g. the models yield solutions which are approximately
correct, but, importantly, only for a scenario for which the model parameters have been tuned.
This limits the accuracy of these models as truly predictive tools.’ (no. 8 of main findings).
‘Perhaps the safest that can be advised at this point is that it would be unwise to rely on the
predictions of one model only, i.e. better to use a judicious combination of models of different
types, especially if a model is being used outside its range of validation.’ (no. 9, of main
recommendations).
During the early stages of a typical offshore project, only the general layout and location of the
major pieces of equipment are known. The level of geometric detail usually increases as the
project proceeds as smaller pieces of equipment and objects such as piping and cable trays
are defined. For explosion overpressures predictions at each project stage the likely effects of
geometry detail to be added later in the project should be accounted for. If this is not done it is
likely that the calculated explosion characteristics such as overpressure and impulse will
increase significantly as detail is added throughout the project duration. Two possible methods
of addressing this have been postulated [6.23].
• Make allowance for later increases in explosion loads by multiplying the explosion
overpressures predicted for a given level of geometry detail by applying a factor for
equipment growth (and hence congestion) based on previous project experience
• Addition of anticipated ‘probable’ congestion into the explosion geometry model to allow for
as yet undefined geometry
Detailed investigation of an integrated deck platform typical of the central/northern North Sea
showed that reasonable prediction of the likely final overpressures required the definition of all
major equipment, boundaries (decks, TR/accommodation blocks), all piping with diameters
> 8”, Primary structure, secondary structure with cross section dimensions > 5”.
The anticipated additional congestion likely to be added as the design is progressed can be
based on historical data for similar previous projects, equivalent equipment with all of its
associated pipe work. Several possible measures of the ‘completeness’ of the current
geometry model such as the total length of the defined obstacles or various measures of the
blockage ratio have also been proposed.
• Uniform cells should be used in the region of a CFD model where turbulent combustion will
take place
• It is recommended that in FLACS simulations there should be at least 13 cells across an
unconfined gas cloud. Fewer cells are necessary with confinement, [6.29, 6.34, 6.35].
• For AutoReaGas the recommended constants provided for turbulent combustion modelling
(factor slope and turbulent combustion modelling constant) should be used with close to
1 m3 cells.
• It is recommend that uniform stoichiometric concentration gas clouds are used in explosion
modelling due to lack of calibration/validation for non-uniform non-stoichiometric
concentration clouds
• A sufficiently detailed geometry model should be used with explosion prediction models
that rely on a detailed geometry model of the facility
Issue 1 May 2007 Page 232 of 493
FIRE AND EXPLOSION GUIDANCE
• An explosion prediction code with a demonstrated predictive capability should be used,
consult your code supplier.
• The numerical mesh should be extended sufficiently far from the region of interest to
prevent boundary conditions from affecting the simulation results of interest to the project
• The computer code EXSIMPO is available for use with EXSIM which determines the
appropriate cell size from the layout.
6.6.6 Validation/calibration of gas explosion prediction tools
It has been found experimentally that gas explosion behaviour in confined and congested
environments is dependent on the scale of the test [6.30, 6.31]. Thus one of the main
objectives of the Phase 2 BFETS JIP [6.31] was to provide specific information on the
characteristics of explosions in a full-scale test rig intended to be representative of an offshore
module. Comparison between results for complete stoichiometric methane fills of a 1:3.2 scale
and full size Spadeadam test rig showed overpressures between 5 and 2.5 times greater at full
scale. The full-scale test results from the Phases 2 and 3a can now be obtained from the UK
HSE and are an important resource for validating/calibrating explosion assessment tools.
It is worth noting that the only assessment of full scale blind explosion predictions, made
before the relevant test results were publicly available, were conducted in Phase C of the
Model Evaluation Exercise conducted during Phase 2 of the Fire and Explosion JIP [6.31].
This was a demonstration of certain predictive capabilities of the range of gas explosion
simulation tools available at this time.
The validation process should demonstrate the “predictive” capability of the proposed tool
rather than simply calibrate a result to one set of experiments.
• local response and subsequent generation of shock waves through the (bolted) structure.
Whatever the cause investigations have shown [6.36] that the influence of these short duration
loads is insignificant for components with natural periods more than 0.02 seconds (natural
frequency less than 50 Hz) which includes most components. These spikes which can take the
observed overpressures beyond 12 bar may therefore be ignored and pressure traces may be
smoothed by time averaging over a period of 1.5 milliseconds. Other more refined smoothing
techniques have been investigated [6.37].
Existing CFD explosion simulation codes do not generate these spikes as they cannot
represent any of the processes identified above so overpressure traces from CFD simulations
may be used directly as the input loading for some finite element packages (FEA) packages.
This form is not characteristic of far field blast waves outside a compartment. A typical trace
for this case is shown in Figure 6.4.
Issue 1 May 2007 Page 234 of 493
FIRE AND EXPLOSION GUIDANCE
Figure 6.4 - Typical pressure trace at some distance from a vent – blast wave.
The reliability of the results of this method will depend on the reliability of the base simulation.
The method is based on the assumption that any gas within the module is perfectly mixed and
that the probabilities of an explosion occurring at any concentration within the flammable range
are equal.
It is recommended that the variation of explosion overpressure with ignition point location is
investigated by considering at least three ignition points at representative points, such as both
ends and the centre of the module, again assuming that the module is fully filled with a
stoichiometric concentration cloud.
1
0.9
0.8
Normalised Overpressure
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0
0 0.1 0.4 1
Normalised Cloud Volume
The influence of water spray mitigation, based on a small data set, is quantified by the use of a
ratio of the unmitigated overpressure to the mitigated pressure ‘Pr.’. This varies with the
unmitigated explosion overpressure as given below:
Maximum unmitigated
explosion overpressure Pr
(Bar)
0 to 0.2 1
0.2 to 0.5 2
0.5 to 1.0 3
1.0 to 2.0 3.4
2.0 to 4.0 6
> 4.0 8
The factors given in Table 6.2 represent median values, with a large spread in the data for all
overpressure ranges. The use of these factors may considerably under or over estimate the
real local overpressure peak values.
As the spatial variation of explosion loads will not be well represented, it is not recommended
that nominal overpressures or dynamic pressures are used as a design basis at later project
stages, for the assessment of existing platforms or for high risk or novel installations. Nominal
overpressures are defined as peak representative overpressures by installation/module type
determined on a non-statistical basis from acquired experience or simulation for a
demonstrably similar situation.
If it is necessary to calculate blast wave effects in the far field, for example at an adjacent
platform, this could be done using one of empirical blast wave propagation methods from a
knowledge of the vent areas and the mass of fuel in the gas cloud. The external explosion
which may occur as a result of the ignition of a vented unburnt fuel/air mixture is not explicitly
included in the approach although in some of the data the external explosion may have
contributed to blockage of the vents and increased the overpressures in the combustion
region.
At later project stages, and for re-assessment of existing facilities it is recommended that a
suitably validated phenomenological or a specialist CFD explosion simulation tool is used.
A Rule Set defining nominal, space averaged, peak explosion overpressures or nominal
overpressures may be developed to assess alternative concepts at early project phases. This
could be based on data from previous explosion load simulations for the range of concepts,
module sizes, module types and process characteristics.
• Production rate
• Gas compression pressure
• Gas composition
• Number of production trains
• The values need to represent space-averaged overpressures over the affected area, they
are defined as the average of all simulated (or measured) overpressure peaks within the
affected region. It is assumed that in the case of measured overpressures they have
been smoothed by time averaging over a window of 1.5 ms.
• There should be sufficient gauge points to represent the spatial variation of pressure
within the explosion.
• The scenarios simulated should represent the DLB design level explosion for the ductility
level event occurring at the appropriate frequency level.
• A CFD or validated phenomenological simulation method should be used for all the data.
Contemporary analysis methods and up to date software should be used.
• An indication of the form of the overpressure traces (duration, and impulse) should be
included.
The resulting nominal overpressures, frequencies and durations should then be a good
indicator of the expected severity of the design explosion event and the level of risk arising
from the explosion hazard.
In a ventilated compartment the explosion load given by overpressure and duration is mainly
determined by the relative ventilation and the level of congestion.
For compartment volumes of up to 1000 m3, with relative ventilation area of about 0.5,
stoichiometric gas cloud ignition expected to give approximately 1bar with a medium level of
congestion. High congestion levels may increase overpressures by a factors of 2 to 3. Larger
volumes also tend to increase overpressures.
Design overpressure in a ventilated shale shaker room with less than 1000 m3 volume and
moderate congestion may be taken as 2 bar, combined with a pulse duration of 0.2 s
(200 milliseconds) unless a more detailed assessment is carried out.
Design overpressure on an open drill floor area may be 0.1 bar combined with a pulse duration
of 0.2 s unless a more detailed assessment is carried out.
The vent area Av may be taken as sum of free opening and blow out panel areas where static
opening overpressure is less than 0.05 bar.
Durations for explosions is expected to vary from 0.2 s for fairly open compartments to 1 s for
quite closed compartments.
If panels or walls are intended to give explosion relief by failing a peak overpressure of 2-3
times their failure pressure can still be expected in the compartment. This is only the case if
ventilation dominates. For large and congested compartments local overpressures may be
greater.
Long compartments with length/diameter ratio greater than 3 will tend to give higher
overpressures due to long flame acceleration lengths. The effective diameter can be estimated
as D = √A where A is the smallest cross-section area and L is the largest compartment
dimension.
For completely enclosed compartments generally, bulkheads that must survive an explosion
will be designed for 4 bar.
For process areas on open deck covering not more than 20 m x 20 m with an uncongested
arrangement a design overpressure of 0.2 bar with a pulse duration of 0.2 s may be used.
Volume blockage ratios (VBR’s) of 0.05 may be considered as not congested, where VBR is
the ratio of the blocked volume to the total volume considered.
For larger or congested process areas a design overpressure peak of 0.5 bar with a pulse
duration of 0.2 s may be used. A volume blockage ratio of 0.05 may be considered not to be
congested.
See Table D1 in paragraph 617 of the reference [6.38] for a summary of these results.
Without undertaking detailed modelling it is not practicable to establish the overpressure time
history for the specific situation, however, by establishing the blast duration, the peak
overpressure loads can be translated into useable loads for preliminary response calculations.
This load time history may be translated into an equivalent static load which is more readily
usable in the concept definition and FEED stages.
It is recommended that in the absence of project specific data the relationship between
impulse and peak overpressure described in Hoiset [6.40] is used to derive a positive duration
for the overpressure based on the assumption of a triangular pressure-time history with equal
rise and fall times. These relationships are based on CFD simulations of a small number of
geometries and should only be considered as approximate example values. The explosion
overpressure impulse, I, is given by:-
25
20
15
Impulse kPas
Impulse kPas
10
0
0 0.5 1 1.5 2 2.5 3 3.5 4 4.5
Overpressure (Bar)
The curves given [6.40] in Figure 6.6 and Figure 6.7 may not be applicable for large open
areas such as occur on F(P)SOs and Spars, as it was derived for enclosed compartments.
These curves do not apply to blast waves from a distant explosion as in this case the impulse
may be near zero and the positive phase duration may be much shorter. The blast wave from
a distant explosion (>20 m from the vent) will develop into a sharp fronted wave with a
negative phase often represented with duration twice that of the positive phase.
1.6
1.4
1.2
1
Duration (s)
0.8 Duration s
0.6
0.4
0.2
0
0 0.5 1 1.5 2 2.5 3 3.5 4 4.5
Overpressure (Bar)
Note that the assumption of a symmetrical triangular positive phase will not apply if there are
two clear paths for the pressure disturbance to reach the observation point such as would be
observed on the deck below an explosion. An external explosion may result in a double peak
in the overpressure.
The ductility level blast is the design level overpressure used to represent the extreme design
event.
The strength level blast represents a more frequent design event where it is required that the
structure does not deform plastically and that the SCEs remain operational. This load case is
recommended for the following reasons:-
• The SLB may detect additional weaknesses in the design not identified by the DLB
(robustness check).
• An SLB event could give rise to a DLB by escalation – this should ideally not occur as
elastic response of SLB and supports should be maintained.
Design explosion loads were in the past derived from a worst credible event assuming a gas
cloud of maximal extent with stoichiometric composition ignited at the worst time in the worst
position. Usually the ultimate peak overpressure ‘Pult’ derived in this way is far too large to be
accommodated by the structure. ALARP arguments are appropriate and can be used to
demonstrate that risk has been reduced to satisfactory levels, relying on frequency and risk
arguments. Pult will often correspond to an event with an adequately low probability of
occurrence.
A probability of between 10-4 and 10-5 per year is considered reasonable for the ductility level
design event by comparison with the treatment of environmental and ship impact loads which
are often considered at the 10-5 level. The assessment principles for offshore safety cases
document APOSC [6.41] states that ‘the frequency with which accidental events result in loss
of integrity of the temporary refuge within the minimum stated endurance time, does not
exceed the order of 1 in 1000 per year’. Earlier versions of the safety code previously issued
by NPD (now under the jurisdiction of the Petroleum Safety Authority in Norway) [6.42] gave a
limit on TR impairment probability of 10-3 per year. The revised regulations, (available for view
on the internet [6.43]) have now been redrafted into a more risk based approach. It is
reasonable and conservative to assume that the threat from fires exceeds that from explosions
by a factor of 10 to 1 and an impairment frequency of 1 in 10,000 per year is a reasonable
estimate for explosion impairment. Hence a target of 10-5 exceedance per year for an
explosion event which directly impinges on the TR is reasonable. An explosion event in the
process area will be separated from the TR by a barrier or blast wall which should withstand
the load and have an impairment frequency of much less than 10 % giving a target frequency
for such an event of the order of 10-4 exceedance per year.
The space averaged peak overpressure for the compartment is used for determination of the
design explosion loads as it is more generally representative of the severity of the event. A
local overpressure peak may be used to generate exceedance curves for the determination of
load cases for local design of blast wall for instance. Impulse exceedance curves may also be
generated which take into account the duration of the load and its peak value are a better
measure of the expected response of the target which will be dynamic in nature.
The SLB may then be identified from a space averaged peak overpressure exceedance curve,
as that overpressure corresponding to a frequency one order of magnitude more frequent or
with a magnitude of one third of the DLB overpressure whichever is the greater. The reason
for the reduction factor of one third is related to the expected reserves of strength in the
structure and the observation that the primary structure will often only experience received
loads of this reduced magnitude. Section 8 and its various sub-sections provide more detail of
the issues related to explosion loads.
Figure 6.8 - Example overpressure exceedance curve – location of DLB and SLB design
load cases (Pstr and Pduct)
The SLB overpressure, ‘Pstr’ may then be identified as that overpressure corresponding to a
frequency one order of magnitude more frequent or with a magnitude of one third of the DLB
overpressure, ‘Pduct’ whichever is the greater. The reason for the reduction factor of one third
is related to the expected reserves of strength in the structure and the observation that the
primary structure will often only experience received loads of this magnitude [6.44, 6.45].
Many other forms of this curve have been produced with various combinations of log and
linear axes, this gives the impression that the curves differ in shape which depends on the axis
choice. Other forms of curve may be plots of local peak overpressures for a particular location
There is some evidence that the curve has underlying exponential distribution characteristics
[6.45, 6.46] which gives a straight line when plotted with log-linear axes as in Figure 6.8.
The same convention may be used for plotting other measures such as dynamic pressure
exceedance curves for a particular part of the combustion region. The dynamic pressures
corresponding to the SLB and DLB load cases may then be obtained in the same way by
selection of the appropriate frequencies of exceedance.
The program is used by building an approximate model of the various field development
concepts from a list of elements so that each concept can be ranked and potential ‘concept
stoppers’ can be identified at an early stage.
The tool includes an explosion assessment method based on FLACS simulations of more than
15 modules/geometries conducted using the NORSOK procedure to generate an explosion
pressure exceedance curve. For a specified solid barrier the model can be used to calculate
the explosion pressure for a defined annual frequency of occurrence e.g. 10-4 per year.
The model has been developed based on data from ordinary offshore modules and is
therefore not recommended for extreme cases.
The model includes parameters that characterise the degree of congestion and confinement
explicitly. They make no claims for the validity or otherwise of the present version which is still
very much at an early stage of development.
Several methods of generating exceedance curves are in use, [6.1]. The range of methods
represents the fact that at an early stage of a project the available information may be
sufficient only to apply a relatively simple methodology with more complex methodologies
applied as the project develops. However, the range is also due to the number of factors that
can contribute to an explosion occurring with different methodologies accounting for these
factors. The release, cloud formation, ignition and explosion must all be considered in
generating exceedance curves. Decisions must therefore be made about how to represent
these influences on the explosion. Natural variability, in for example, release or ventilation
rate, and uncertainty in both the data and models should be considered.
There are methods of extrapolating from a small number of explosion simulations representing
differing ignition points to represent various (equivalent stoichiometric) cloud sizes and the
expected overpressures [6.17] and Section 6.10.5. An exceedance curve may be constructed
using these extrapolated results.
Section 6.10.5 presents a simplified method based on the assumption of exceedance curve
shape which in theory requires only requires a small number of simulations to be performed.
Issue 1 May 2007 Page 245 of 493
FIRE AND EXPLOSION GUIDANCE
The other point uses the probability of a release forming a cloud combined with the probability
of a late ignition Prexp, corresponding to the zero overpressure exceedance probability. This
method may be used only at an early project phase when sufficient information for more
sophisticated methods is not available.
It is important to identify the explosion scenarios with the higher overpressures as these will
determine the required exceedance probabilities in the required range (10-5 to 10-4
exceedance). Explosions with a frequency of exceedance of greater than 10-3 will also
dominate the accuracy of the exceedance curve around the 10-4 exceedance level. The total
probability of an explosion gives a method of determining if adequate scenarios have been
considered and convergence is being achieved.
Figure 6.9 illustrates the sequence of tasks for exceedance curve generation.
At the highest level of sophistication this would involve consideration of ventilation rates
by wind speed and direction by CFD simulation. At a lower level the expected higher
explosion overpressures would occur in situations of poor ventilation with the wind from
a direction blocked by a barrier or equipment. A simplified method might assume a near
constant release rate to generate a series of cloud sizes with equal probability, a
workbook approach [6.18] is described in Section 6.4.2 could be used.
At the highest level the probability of ignition from a continuous source, will be
estimated as a time history and will be proportional to the rate of generation of
inflammable cloud volume which should be available from a CFD dispersion calculation.
At a lower level the ignition probability could be assumed constant irrespective of cloud
size but with say 3 widely spread locations for the ignition sources.
5. calculate equivalent stoichiometric cloud size (Section 6.4.4) note the reservations
quoted in this section on the accuracy of this step in the analysis process.
A high level of sophistication method could use CFD for the cases where the highest
overpressures are expected with calibrated phenomenological simulations for
interpolation between scenarios if required.
7. assemble the space averaged peak overpressure exceedance curve from probabilities
of occurrence of the overpressures for the scenarios simulated.
If local overpressure exceedance curves are needed for a reliability analysis of a blast wall for
example these may be generated based on the probabilities for the averaged pressures and
transfer functions relating these two values for the chosen location [6.48].
The worst credible scenario assuming a stoichiometric cloud filling the module and ignited at
the worst position may not be representative of the general population of explosion events. In
addition it will be difficult to determine its probability of occurrence. A representative scenario
at around the 10-4 per annum exceedance level or the 10-5 frequency of occurrence level
should be used if it can be identified.
A simplified method which may be used for the purpose of design explosion load
determination, is presented later (see Section 6.10.4).
One problem with the use of this type of generic curve is that they do not allow for the fact that
the level of overpressure will affect the shape of the plot because if the overpressure is already
close to 8 bars it is unlikely to significantly increase. Ratios of a parameter called severity
index rather than the overpressure can be used to allow for this. Severity index, S, is based on
runs of SCOPE 3 [6.48] and tends to infinity at 8 bars which would correspond to adiabatic
combustion of a stoichiometric hydrocarbon without expansion. An expression for S is given
as:
S = P.e
(0.4 P
E1.08 −1− P
)
Where P is the overpressure in bars, E is the expansion ratio at atmospheric pressure. Note
that this approach assumes that P is a typical overpressure, for example over a complete
congested region. If P is replaced by S in an expression fitted to some experimental data then
at low overpressures the predicted overpressures will be unchanged. If the correlation is used
for S and S inverted to get P using the above equation it will automatically be limited in a
realistic way to 8 bar.
It is however difficult to prove the general applicability of generic curves as their detail is likely
to vary between different modules/plants. It is stated that the only feasible way to take into
account the complexity of the physical processes in a gas explosion is to use a Monte-Carlo
method that requires performing many thousands of model runs to obtain valid statistics. The
SCOPE model that only takes a few seconds to run is used for this purpose. Where further
detail is required CFD runs are performed using EXSIM. Transform (or transfer) functions that
relate the median overpressure produced by SCOPE to features such as localised high
overpressures or geometry effects such as shielding or pressure wave reflection are then
defined. The method takes account of variations in leak rate, fuel type, wind speed and
direction, ignition location and stoichiometry.
Flammable gas cloud sizes can be calculated in two stages using EXSIM (ventilation flow
followed by dispersion simulation), or using a zone model to predict ventilation flow followed by
a random-walk dispersion method.
Transform functions at each ‘receptor’ are calculated by running EXSIM for range of initial
conditions. The idealisation of the module used in the SCOPE input is adjusted if necessary so
that with the module fully filled with gas and ignition at the centre of the module would give the
same median overpressure with both models.
Example exceedance frequency and exceedance probability curves are given for pressure and
impulse in the reference.
The guidance given is conservative in certain aspects in an effort to ensure that the estimated
blast loads remain firm throughout the design process. Four separate approaches are
described in ascending order of complexity. The first two approaches are hazard
consequences based while the last two are risk based.
This method is based on the a priori fact that the statistics of random events such as
explosions indicate that the intervals between such events will often have an exponential
distribution. [6.50].
A recent paper by Yasseri [6.46] has processed the historical data on explosions in the North
Sea given by Vinnem [6.51] and has shown that there is a good fit for the data to the
exponential distribution.
An exponential distribution gives a straight line for the exceedance diagram with the axes
chosen.
Possible methods of calculating the two required overpressure and frequency points include
the following:
• A point at zero overpressure corresponding to the probability of an ignited gas leak Prexpl.
• A high overpressure, low frequency event based on the ignition of a full stoichiometric
concentration fill of the module Pult and its associated probability.
SCEs of criticality level 1 and 2 should be assessed against the SLB, SCEs of criticality 1 will
be assessed against the DLB as derived in the previous section.
If the general level of dynamic pressure loads is not known then it is acceptable to take a load
equal to 1/3 of the overpressure at the location for the DLB load case. The duration should be
chosen so that the impulse matches that of the overpressure trace. This load must also be
applied in the reverse direction. In open areas, such as the decks of FPSOs, these loads
should also be applied in the vertical plane.
The performance of the structure and SCE’s for these scenarios must then be tested against
the appropriate high level and equipment specific performance standards.
• Drag loads (similar to the Morison drag loads experienced in fluid flow) proportional
to the square of the gas velocity, its density and the area presented to the flow by
the obstacle.
• Inertia loads proportional to the gas acceleration and the volume of the obstacle.
• Pressure difference loads.
Drag loads dominate for obstacles with dimensions less than 0.3 m or on cylindrical obstacles
less than 0.3 m in diameter in particular in regions of high gas velocity near vents. Both drag
and pressure difference loads are significant on objects between 0.3 m and 2 m in the flow
direction.
Exceedance curves for dynamic pressures may be developed from simulations and used in
the same way as for overpressures in deriving design dynamic overpressures.
S
E W
N
Explosion
Vessel 70kN/m Overpressure load
The unburned gas is pushed out of the module through the vented area with a velocity. This
velocity will be available directly from a CFD simulation or by the approximate method given in
the next section.
The air ahead of this front is pushed out through the vent in the West wall over a vessel and
pipe work spanning the vent giving the possibility of vessel or piping failure, with further
release of inventory and consequent escalation. The gas velocities in this case will occur
predominantly near the vent. The magnitude of drag forces on the pipe work (with diameter D
typically less than 0.3 m) at any time is given by the drag term in Morison’s Equation.
The force should be calculated for engulfment of the obstacle in the burnt and unburnt gas
mixture as the burnt gas/air mixture may be travelling at a speed of ten times the speed of the
unburnt mixture even though the unburnt mixture is ten times denser.
Drag coefficients are given in Figures 4-55 and 4-56 by Cjujko [6.19] and Table 1 [6.53].
A typical time history for the drag load is shown below in Figure 6.11, [6.55].
Two peaks are shown corresponding to the peak gas velocities ahead of and behind the flame
front. In a vented compartment flow reversal of gases into the compartment could also occur at
a later stage in the explosion. This would give a trace with a negative phase.
Drag loads are particularly important in open areas such as on the deck structures of an
F(P)SO. The gas clouds associated with explosions on FPSOs may be very large and gas
velocities up to 500 ms-1 could be experienced. The direction of gas flow may also be very
variable for example in the case of the pipe rack of an FPSO acted on by an explosion ignited
at low level. Secondary projectiles may be a problem for FPSOs in view of the higher gas
velocities.
The drag loads may be used to represent the total force on obstacles with in flow dimensions
less than 0.3 m. For larger diameter obstacles or vessels, the pressure difference across the
vessel will also need to be calculated and added to the drag force above.
The IGNs [6.58] state that the validated methods for determination of loading due to blast wind
are strictly only applicable to distant explosions:
These validated methods are based on TNT equivalent explosions with non-turbulent fluid flow
at a distance allowing the use of Morison’s Equation to determine the load on a body.
Catlin’s paper describes some experimental validations of formulae for both vented gas
velocity from a compartment open on one face and the loads on vertical cylinders in the vent
area [6.59].
Δt = D/U
The pressure difference across the vessel ΔP may be read from the indicative trace shown in
Figure 6.12.
Figure 6.12 - Estimation of the pressure difference across a vessel from a pressure
trace
This process is conventionally applied for the phase of the explosion where the vessel is in the
unburnt air/fuel mix using the appropriate speed of sound. The part of the curve relevant to this
calculation is before the peak. Under these assumptions, this same load may be applied after
the peak acting in the opposite direction. A time history of drag load may then be estimated.
For piping the response to the drag load may be estimated using a single degree of freedom
method such as the Bigg’s method described more fully in Sections 8.7.5 and 8.7.6.
This same model may be used to estimate the tension effects in one-way spanning blast
panels, see the general discussion on response prediction in Section 8.7.
One problem with this method is that overpressures are generally recorded at the cell centres.
This should not be a problem for objects large in relation to the size of the control volumes use
in the simulation (3 times the cell dimensions). If the object is large and the gauge points are
located at the centres of the object cross section then the computed pressure differential may
be multiplied by 2/π to allow for the sinusoidal variation of load direction over the surface of the
object.
It should also be noted that the gauge points would not capture local pressure increases
where the flow stagnates on the object if they are far from the obstacle in relation to the object
diameter. This may add short duration loads (durations of a few milliseconds) particularly a
high Mach number flows.
For intermediate obstacle sizes it is suggested that the CFD numerical grid be locally refined
until the object is sufficiently resolved in the flow field. The DLM can then be applied.
Alternatively, it is stated that near module vents forces calculated by the DLM and drag
methods are similar. Near the centre of a module the loads on obstacles it is recommended in
the references that both approaches should be used and the larger of the two loads used for
design. It is unlikely that drag loads would in any case be large at these locations so the
pressure difference approach is recommended in this Guidance.
For the simulations considered during the referenced work, it was stated that the peak drag
pressures were about 30 % of the maximum local field pressures and 60 % of the average
overpressures experienced within the module.
Methods for dealing with multiple objects that contribute drag forces to the total load on an
item of equipment are briefly outlined [6.53, 6.60], including a method for dealing with groups
of objects that are partially shielded from the blast wind.
1. The SCOPE experiments executed by Shell where gas velocities were measured
directly
2. The Phase 3b tests where an instrumented cylinder was placed in the vent area of the
Spadeadam test rig [6.39].
The general view is that in CFD codes the pressure and gas velocity is so closely linked at
each point in space and time, that validation of pressure may be sufficient to assume that the
gas velocities are being correctly calculated.
The asymmetric expulsion of vented gases from a compartment may give rise to out of
balance loads or strong shock response.
During a vented internal explosion there may be an out of balance lateral force on the
compartment depending on the distribution of vent areas around the module.
Initially it seems that the out of balance force on the module will be equal to ΔPA less any net
forces on internal equipment, piping and vent obstructions. In fact the time for pressure
disturbances to cross the module may be appreciable compared with the load duration and the
inertia of the un-burnt products and external atmosphere will affect the net force. The net force
on the gas volume contained in the module may also be calculated from rate of change of
momentum of the enclosed gas. However, if the local speed of sound is exceeded then the
flow becomes ‘choked’ and a second shock wave front is set up at the vent, which will restrict
the flow. Obstructions at the vent such as louvers may accelerate the flow locally and induce
these standing shock waves. The backpressure for confined flow may be represented by a
‘loss factor’, which represents the loss of momentum encountered by the flow [6.59].
• Available inventories
• Hole sizes and leak rates
• Leak locations and directions
• Wind speeds, directions and ventilation rates
• Cloud build up
The procedure briefly also covers response calculation and consideration of overpressure
mitigation methods such as deluge.
In early project phases the project must be simplified according to the design information
available, but the general structure and principles must be maintained. The amount of
equipment is estimated based on equivalent areas in previous studies. Sensitivity studies are
used to establish whether minor changes in amount of equipment, pressure relief areas and
ventilation will change the gas explosion loads significantly. In cases where low loads are
expected or where the structure has high strength (so that larger conservatism can be
accepted) the procedure may be simplified provided the conservatism is under control.
7 Response to fires
Concrete is not commonly used offshore but there are about 24 platforms in the North Sea
with concrete substructures. The top of the concrete is usually several metres below the
underside of the main deck, but it can be subjected to pool fires on the sea surface or the jet
fires from risers. Concrete can withstand a pool fire for a significant time, the outer layer of the
concrete normally serves to protect the underlying steel from corrosion, but in a pool fire
protects the steel and the bulk of the concrete from the effects of fire, at least for some time. In
a jet fire the concrete cover can rapidly be eroded, exposing the steel reinforcement to the
effects of the flame
For other grades of steel, one of the best sources of information is FABIG Technical Note 6
[7.1]. This contains mechanical properties for:
Carbon Steels
Stainless Steels
Stainless steels tend to maintain their strength and stiffness at elevated temperatures
compared with carbon steels.
It can be seen in the table that the strength of steel falls very quickly. This makes an
assessment of the steel temperature very important. At about 500 ºC a 10 % difference in
temperature can lead to a 16 % loss of strength.
For some heat treated and special steels it may be necessary to carry out tests to establish
the necessary properties. This is because the enhancement of properties caused by the heat
treatment may be lost if the steel is heated beyond the heat treatment temperature.
The mechanical properties given in EC3-1-2 are based on anisothermal tests. In these tests,
the steel is first loaded and then heated. The steel responds by expanding due to thermal
expansion and elongating due to the stress. As the steel loses strength and thickness the rate
of elongation increases until a run-away occurs. From a series of such tests at different stress
levels, stress strain curves can be derived for a range of temperatures.
The rate of heating is important. The EC3 data are based on steel being heated at about 10 ºC
per minute. This corresponds to a 60 minute fire resistance in a building where failure will
occur at about 600 ºC. For heating rates between 2 ºC and 50 ºC per minute the EC3 data are
reasonable and the effects of creep may be ignored. Because of the effects of creep, if the
heating rate is faster, the data will be conservative and for slower heating rates the mechanical
properties given by EC3 will be over-estimated. It should however be emphasised that
potential heating rates are much faster in fire incidents offshore. In any hydrocarbon fire flame
temperatures can be in excess of 1500 ºC and temperatures of close to 1800 ºC have been
recorded. The maximum temperature will depend on the size of the fire and the degree of
ventilation.
Concrete loses strength at a broadly similar rate to structural steel but loses stiffness at a
faster rate. The best reference is EC4-1-2 [7.2] (composite construction).
Both BS 5950-8 and EC3-1-2 give the same information on the strength of bolts and welds at
elevated temperatures. As these are not well known, the information is shown here in Table
7.2. The yield strength is also shown for comparison.
It can be seen that both bolts and welds lose strength at a faster rate than structural steel.
However, because of the partial factors used for normal and fire design this effect is not as
significant as it might appear (see Section 7.4.2).
The thermal properties of the common structural steels are given in EC3-1-2. The thermal
properties of concrete are given in EC4-1-2.
The temperature time curve of the ISO and BS hydrocarbon test fires are compared with the
standard cellulosic fire in Figure 7.1.
Fire resistance tests are generally only useful for comparing the performance of different
products under constant conditions. Regulations and specifications will often refer to a
performance standard measured in a fire resistance test. Extrapolation to real fire behaviour
can sometimes be misleading.
1200
Hydrocarbon
1000
800
Temperature (°C)
Cellulosic
600
400
200
0
0 30 60 90 120
Time (mins)
Figure 7.1 - Time temperature curves for hydrocarbon and cellulosic fires in fire
resistance tests
The method provides an indication of how passive fire protection materials perform in a jet fire
that may occur. Jet fires give rise to high convective and radiative heat fluxes as well as high
erosive forces. In the test, a sonic release of a gas (0.3 kg s-1) is aimed into a shallow
chamber, producing a fireball with an extended tail. Propane is used as the fuel. High erosive
forces are generated by release of the sonic velocity at about 1000 mm from specimen
surface.
The results from the small scale test have been compared with full scale jet fire test results
from four testing establishment laboratories.
The test standard gives guidance on the use of the test result and its application to the
assessment of passive fire protection material.
It is also important that the consequences of minor failures on system are analysed with
respect to their effects on other systems. For example, a minor structural failure could lead to
the fracture of a pipe or breakdown in an electrical system.
Another consideration is repair. Has something failed if it does not have to be repaired? Minor
residual deformations following a fire may not impair the function of the component or any
other component and can probably not be described as failure.
A summary table of the failures of the more obvious (safety critical) elements which may give
rise to escalation and to which the above issues should be applied may be found below.
Fire spread by loss of compartmentation will increase the likelihood of most types of failure so
loss of compartmentation is an important type of failure and within the UK; regulations refer to
loss of insulation and loss of integrity. Testing a component in isolation in a fire resistance test
may result in acceptance criteria that may be simple to achieve. In the test, a combination of
good detailing and a suitable thickness of insulation will normally suffice. However, when a
component, such as bulkhead is built into an offshore structure, the interaction between the
bulkhead and its boundaries must be considered. Restrained thermal expansion can lead to
buckling which may dislodge fire protection material. Boards and thickly sprayed material will
be more affected, whilst intumescent coatings will normally be sufficiently flexible.
Intumescent coatings will not protect against a loss of insulation. Their activation temperature
is generally greater than the limit on temperature rise (140 °C).
The biggest problem is in preventing gaps opening up through which the fire might spread.
Awareness and good detailing are probably the best ways to prevent this type of fire spread.
Designers should be aware of the likely magnitude of any gaps. In some circumstances the
use of intumescent mastic may be of use.
Frequently compartment boundaries will be penetrated by pipe work or some form of duct.
Maintenance of compartmentalisation will normally depend on the performance of a
proprietary penetration seal for which there should be suitable test evidence and careful
installation and regular inspection.
Linear expansion
Expansion is difficult to resist and a heated member can exert extremely large forces at its
supports. Fully restrained steel will yield at a temperature below 200 ºC, the exact temperature
dependent upon the grade of steel. A beam, designed to resist bending, has a relatively large
axial resistance and, if restrained, may be affected at some distance from any source of heat.
In building fires, damage to bracing members has been observed 40 m away from the fire.
Buckling can also occur in any member in compression, when the buckling resistance falls to
the level of the applied or design load. The onset of this type of buckling may be exacerbated
by axial restraint. However, often, if supporting structure is capable of exerting compressive
restraint, then it is also capable of taking up load when a member starts to buckle. This is a
complex mechanism which depends on the extent of a fire as well as the structural form.
Thermal bowing
Any section which is non-uniformly heated will tend to bow. For most sections the free bowing
is a simple function of the temperature difference across the section. A 500 mm deep section,
12 m long, with a temperature difference of 300 ºC will bow by about 125 mm. A linear
gradient will cause no stress in a steel member. A non-linear gradient will cause longitudinal
shear stresses to be induced. In some types of partially protected steel beam, compression
flanges can, in the early stages of a fire, go into tension.
In a continuous member, thermal bowing will lead to very large induced restraining moments
which are added to any existing moments (Figure 7.2). This can lead to failure of connections
and buckling of compression flanges and webs.
Deformation caused by thermal bowing can cause disruption of services and effect equipment
performance.
Increase due to
thermal bowing
Figure 7.2 - The effect of thermal bowing on the bending moment in a continuous beam.
Bending
Beams will generally withstand large deformations before they are unable to support their
design load. In fire tests and actual fires deformations in excess of span/20 are common.
Continuous beams may be more vulnerable because of the addition of thermally induced
moments at their ends. This may make laterally torsional buckling of some cross sections
more likely.
Often, if a beam supports a plated floor, the beam and plate can act together in fire, although
not designed to do so. This can enhance strength and stiffness.
Large deformations due to loss of bending stiffness will affect connections, as described
above.
Tension
Tension members will lose strength in direct proportion to the loss of yield strength. Isolated
tension members are rare in any structure so, as a tension member loses strength and
lengthens under load, loads redistribution tend to occur. Elongation can be significant. At
550 ºC, a tension member carrying 50 % of its normal resistance will elongate by about
1.25 %. This Assumes a stress induced component of 0.5 % and a thermal expansion
component of about 0.75 %. For a 6 m length this is 75 mm.
Compression
A member in compression will fail at a lower temperature (about 80 ºC lower than a bending
member at the same load level). This is because the stiffness of carbon steel reduces at a
faster rate than the strength.
For most compression members, the applied stress in fire may be increased due to restrained
thermal expansion, see above.
Generally, in highly redundant structures, any mode of failure will be ductile as there will be
redistribution of load. However, failures such as those caused by induced thermal stresses on
welds and bolts will be brittle but may be followed by an immediate redistribution of load to
other parts. The consequences of the failure of large elements in redundant structures need
careful consideration. For example, Topsides with significant cantilevered decks, which
support the TR at the extremity, are prone to progressive local collapse, especially where
critical MSF deck braces are required to support the cantilever. Localised failure due to
yielding under fire however will in most cases redistribute the gravity loads elsewhere to
unaffected areas, except under extreme e.g. riser rupture type scenarios, thus, as damage
and local failures accumulate, the final failure may be sudden as redistribution of load
becomes impossible.
Fractured
end plate
Typical split in connection
occurring on cooling
• The assessment of potential escalation paths from an initiating event towards a major
accident hazard as defined in the Safety Case or towards a “safe” shutdown;
• Identification of the mechanisms by which that initial event could escalate to impinge on
key safety systems or facilities (such that the available safety systems can no longer
function to slow or stop the escalation);
• Evaluation of the probability of each escalation path and the time duration from the initial
event.
Appropriate consideration should also be given to the actions of key personnel in responding
to an incident, taking into account the effects of the hazard under review. In the case of fire,
these effects would comprise heat, smoke other products of combustion, the impacts to be
considered would be injury, burns, obscuration of vision and impaired breathing and
judgement. The growing scale of the incident should be understood and the dynamic of the
incident growth such that there were not unrealistic expectations of personnel performance,
e.g. speed of running, ability to carry or assist injured colleagues etc.
This assessment should include how operators have contributed to the detection of the fires
(especially in the case of a Normally Unattended Installation) as well as how they respond.
The speed and accuracy of detection will impact the potential escalation paths of the initiating
incident and if additional detection information from operating personnel contributes to an
accurate diagnosis of the event underway, this should be included in the emergency response
assessment.
In the UKCS, the requirement for defining Safety Critical Elements is included in Statutory
Instrument 1996 No. 913 “The Offshore Installations and Wells (Design and Construction, etc.)
Regulations 1996,” [7.7] where Safety Critical Elements means “such parts of an installation
and such of its plant (including computer programmes), or any part thereof -
a major accident.
If a major fire occurs then safety of the occupants is the major priority. It is important to give
occupants sufficient time, either to escape or to sit it out in the Temporary Refuge until the
danger has passed. Depending on the location of a fire, any escape route must be adequately
insulated to be tenable.
For further details on impacts to human beings and therefore understanding the limits to
escalation, see Section 7.8.
For fire hazards, acceptance criteria are set for any components tested in a standard fire
resistance test. In addition, in critical areas more stringent requirements may be set by the
safety authorities or specified by the client.
The most straightforward criteria are the failure criteria specified in fire resistance test
standards.
Linear structural elements such as beam only have to satisfy the load bearing criterion as they
are do not form a barrier to the spread of a fire. Separating elements, which directly prevent
the spread of fire, such as a bulkhead have to satisfy all three criteria.
For steel beams, the application of any of the deformation criteria will have a small effect as
the difference between the time to collapse and the time when any of the criteria might apply is
small.
Fire containment or the resistance to fire penetration (E) is the ability to maintain the integrity
of the element against the penetration of flames and hot gases (this applies to fire-separating
elements).
Integrity failures should be rare in fire resistance tests for essentially steel elements. Problems
are more likely to occur in actual fires at junctions between elements.
Thermal transmittance refers to the resistance to the transfer of excessive heat (I) and is the
ability to provide insulation from high temperatures (this applies to fire separating elements).
An insulation failure is deemed to occur when the average temperature rise on the unexposed
face of a separating element exceeds 140 ºC or the maximum temperature rise exceeds
180 ºC, whichever occurs first. These limits are to prevent combustion of any material which
may be close to the unexposed face. Their origins are unknown and, in many cases, the limits
may be excessively conservative.
In a fire test an insulation failure will occur because the insulation is not adequate, or, it may
occur because the insulation becomes detached, often called a “stickability” failure. Often tests
on vertical separating elements are carried out on unloaded, unrestrained elements. Results
from such tests must be interpreted with care and the systems tested must be carefully
installed.
Component Requirement
Load bearing beams and columns R
Load bearing floors, walls and partitions R,E,I
non load bearing separating floors, walls and partitions E,I
Relationship between criteria used in standard fire tests and actual performance in real fires
In the UK, fire tests are carried out on small elements. Beams generally have a span of 4.5 m
and columns, which in any case are rarely tested, are 3.2 m high. Wall panels are tested at
3 m x 3 m. Elements in real structures are often many times the size tested or have no
associated test evidence. Structurally, there will often be little to learn from a Standard Fire
Test and designers must look elsewhere, at the limited evidence available from some large
scale tests or rely on FE models. Even if the test is considered to be reasonable, any time
measured in the test should not be thought as actual time in any real fire.
Fire resistance test results on passive fire protection tests in the cellulosic fire should be used
with extreme care when considering performance in any hydrocarbon fire.
A jet fire rating equivalent to an A or H rating has been proposed in the latest draft version of
the ISO (22899-1) [7.5], (based on the jet fire test criteria proposed in ISO 13702 [7.11])
specified as: Type of application / Critical temperature rise (°C) / Type of fire / Period of
resistance (minutes)
In order to analyse any structure in fire a thermal model is required. For simple linear
elements, all that is required is the temperature distribution across the section at the mid point.
This may be computed using a 2-D thermal analysis. For more complex elements and whole
structures, ideally, the complete temperature history of all parts of the structure is required
although some simplification may be possible.
In carrying out a thermal analysis, the modelling of proprietary fire protection is not
straightforward. For fairly simple insulating materials, it should be possible to obtain a
reasonable estimate of the thermal properties. Intumescent materials behave in a very
complex manner, as they react differently in different situations. The local thickness of steel
and the heating rate are important.
When carrying out any analysis, it is necessary to establish the applied loads on the structure.
BS5950-8 and EC3-1-2 allow loads to be reduced below the normal design values in fire as it
is considered that the probability of fire and full design load occurring at the same time is rare.
BS5950 is slightly more conservative than the Eurocodes. For an offshore structure, the partial
factors should be agreed between all parties.
It is also important to use appropriate mechanical material properties. BS5950-8 and EC3-1-2
effectively specify identical material properties for use in fire. However, BS5950 specifies
different strain limits for different types of element and mode of behaviour, the elements
referred to comprise composite structures not seen in the offshore industry (steel and concrete
arrangements, see Sections 7.5.3 and 7.5.4 for more details).
Gk + Ψ fi Qk ,1
where
Ψ fi is the combination factor for fire situation, given either by (frequent value) or
(quasi-permanent value) according to paragraph 4.3.1(2) of EN 1991-1-2 [7.13].
It is expected that, in the UK, the more conservative frequent value, Ψ 1,1, will be used for Ψ fi
BS 5950-8 Eurocode
Type of load Location/type
γf ψ1,1
Imposed Office 0.50 0.50
Escape stairs and lobbies 1.00 0.70
Other (including residential) 0.80 0.50
Storage 1.00 0.90
Snow 0.00 0.20
Wind 0.33 0.20
Permanent All 1.00 1.00
The values in the above table have been derived for buildings and may not be applicable to
offshore structures. They are based on statistical evidence and are almost certainly
conservative. It should be possible to derive similar information for offshore structures and
subsequently eliminate possible costly over design.
As an illustration of what might happen consider wind loading. The design case for wind might
be for a once in 50 year’s gust. During a fire, a structure might be vulnerable for a few hours.
For the same level of reliability, the wind load might be only 20 % of the 50 year level.
The assessment methods can be used for beams and compression members. Little
information is given for plated structures. It is normal to assume that members are
unrestrained. Problems relating to expansion and restraint were discussed earlier.
For compression members it is normal to consider the possibility that the degree of end-fixity
may increase in fire leading to a reduction in effective length. Codes such as EC3-1-2, allow
the effective length in fire to be 50 % of the system length, although, in the UK this may be
conservatively limited to 70 %. The reduction is based on two factors. Firstly, in a building a
column will be constructed as a continuous member and secondly, it can reasonably be
expected that the temperature at the ends will not be as high as at the mid-height position.
The method is useful for beams or columns which are not heavily restrained and for simple
ties.
7.5.3 BS5950-8
BS5950-8 covers both non-composite construction and composite construction (steel acting
with concrete). For non-composite all the guidance relates to beams, columns and tension
members. It gives some guidance on unprotected steel but this is limited to 30 minutes fire
resistance in the standard cellulosic fire and would not normally be applicable offshore.
For beams it gives two methods of assessment. The load ratio – limiting temperature method
is largely based on fire resistance test results and is principally for I - section beams. The load
ratio is the ratio between the member resistance in fire and the normal, cold, member
resistance. The code assumes that the strength of a beam can be characterised by the
temperature of the bottom flange and that, in some circumstances, a colder top flange will be
beneficial. However, a colder top flange is assumed to be supporting a concrete floor. No
guidance is given for beams supporting steel plated floors.
The second method is based on moment resistance. From knowledge of the temperature
distribution across the section and the material properties at elevated temperatures, the plastic
bending resistance may be computed. This method is useful for unusual sections but cannot
be used without the temperature distribution. Where a comparison can be directly made, this
method is slightly more conservative than the load ratio – limiting temperature method.
For members in compression, the only method given is the load ratio – limiting temperature
method and the information is, again, based on standard fire resistance test data. For
compression members with comparatively low slenderness, there is a built in assumption that
the column will have an effective length in fire of about 85 % of the assumed cold effective
length.
BS 5950-8 gives simple interaction formulae to allow the load ratio to be calculated for both
beams and columns.
In a useful annex, BS 5950-8 gives guidance on re-use of steel following a fire and what one
should look for when inspecting a building.
7.5.4 EC3-1-2
EC3-1-2 is for non-composite construction only. EC4-1-2 deals with composite construction.
For use in the UK (for buildings) both codes will have a national annex. All Eurocodes contain
some nationally determined parameters. They also contain some informative annexes. For any
country, the National Annex will give values for the nationally determined parameters and
guidance on the use of informative annexes.
The structural Eurocodes are all written in the same format. The design methods start with
tabular data. This is followed by simple design methods and finally there is some guidance on
advanced methods.
EC3-1-2, however, has no tabular data as the only useful data would be on the protection of
steels using proprietary fire protection materials. The bulk of the design information is in the
form of simple calculation methods. It concludes with some guidance on advanced methods.
The term “simple” is sometimes a misnomer, as a small program or spreadsheet is required.
For beams in buildings, EC3 is generally less conservative than BS 5950-8. However, for
beams not supporting concrete floors it is very similar to BS 5950 8. EC3 starts from the
assumption that beams are uniformly heated. Their bending resistance is reduced by the
reduction in yield strength. It then allows an “adaptation” factor to be applied that may take into
account of a temperature gradient and, for a continuous beam, colder support conditions.
EC3-1-2 gives some guidance on members made from sheet steel with class 4 cross-sections.
These thin sections rapidly heat up and quickly lose strength. The guidance is for
completeness and academic interest.
The strength of bolts and welds at elevated temperatures was given earlier in Table 7.2,
EC3-1-2 gives some guidance on checking connections in fire. For example, for a bolt, EC3
states:
γM2
Fv ,t ,Rd = Fv,Rd kb,θ Where;
γ M , fi
kb, θ is the reduction factor determined for the appropriate bolt temperature from
Table 7.2.
Fv,Rd is the design shear resistance of the bolt per shear plane calculated assuming
that the shear plane passes through the threads of the bolt
Guidance is also given on advanced calculation methods. In this context, this refers to finite
element modelling. It states that the model for mechanical response shall take account of:
EC3-1-2 and EC4-1-2 have their roots in the ECCS Model Code on fire engineering [7.14].
This code also includes information on fires, covered by EC1-1-2. It also contains a
commentary on many of the clauses.
In due course, conflicting national standards will be withdrawn. At the time of writing, the
loading code, EC1-1-2 was published at a full European standard in 2002. EC3-1-2 and
EC4-1-2 are undergoing final editing and should be available during 2005. For all three codes,
the UK National Annexes are expected in 2007.
Finite element models can range from frame models with simple linear elements to complex
models utilising a number of element types, some of these applications are discussed in the
following sections.
In all examples and applications, the FE package being used should have been validated
against test data and the engineers using the package should be trained and preferably
experienced in the types of analysis being undertaken.
Complex finite element models should give the best prediction of structural performance.
However, any model is only as good as its input data. There is little point carrying out an
expensive FE analyses unless the thermal history is known with a degree of confidence and
the design scenarios assumed are reasonable.
It is sometimes reasonable to use the same structural model as was used for the normal, cold
design in fire. Applied loads are appropriately factored and elevated temperature values for
yield stress and Young’s modulus are used. For a structure, or parts of the structure, which are
not highly restrained or which are not highly redundant the method may give reasonable
answers but it is impossible to say whether the results from such an analysis will be
conservative or not.
In some areas it may be possible to carry out some preliminary “scoping” analyses to get
some idea what answers might be expected from the FE.
Following any analysis, the results should be carefully examined and anything that looks
unusual should be investigated. It may be correct or it may be due to an error in the
conceptual model.
Compared with an elemental approach, any FE approach based on the same temperature
distribution should give more reliable results. However, many FE models will not properly
predict localised behaviour such as connection failure due to the need to refine the mesh
density, unless the analyst is aware of the possibility of such failure and has made an
allowance for it in the model.
The main problems in any FE modelling start with the fire. In order to get a reliable estimate of
structural behaviour a reliable fire model is required. Often, designers will impose the Standard
Fire (hydrocarbon, cellulosic etc) on the structure. This may meet any regulatory requirements
but it can never model reality. In any real fire scenario, the heat flux impinging the structure will
be different from place to place and will vary in time. Imposing the Standard Fire will not allow
effects due to temperature differences to be modelled.
7.5.5.6 CFD
Computational fluid dynamics can potentially predict the growth and movement of air, smoke,
and flame. CFD is probably more complex than structural mechanics and although,
researchers have been working on CFD for many years it is still in its infancy. In building
design, it is used to predict smoke movement but many think it is not particularly good at
predicting pre-flashover fires. This should be less of a concern for any form of hydrocarbon fire
as the pre-flashover phase will be less significant.
Some of these requirements may appear to be very severe. It is recommended that they need
not be followed for every structure analysed but they do emphasise the need to use validated
software.
For example, a secondary beam, spanning between larger primary beams and supporting a
plated floor may be sacrificial in fire. For the fire scenario under consideration, deformation of
the floor may be unimportant. A steel plated floor system will often be able to act as a
membrane and not require additional support. The beam may not be critical for giving restraint
to the primary beam. However, in a severe fire heat may be conducted along an unprotected
beam into the primary beam and thus reduce the fire resistance of the primary beam. For
practical reasons it might be better to protect the entire secondary beam rather than simple
coating the ends.
Secondary members, which when cold, restrain a primary member may require fire protection
to continue fulfilling this function when hot. However, experience has shown that at the
reduced applied loads in fire, the restraint may not be necessary. For example, loads may be
resisted by membrane action and the restraint may not be required. It is important to consider
that it does not follow that a member which carries load will always be required in fire. The
function of all members should be looked at. Only members which may fail or deform in fire
leading to a performance requirement not being met should be considered for protection.
Simple design methods are not able to provide information on whether secondary members
require special consideration. Only a full non-linear FE analysis will provide this information.
The attachment acts as a heat conductor into the primary steelwork. Hence, it can introduce a
localised hot spot at its connection with the primary member. The extent of the hot spot
depends on the relative geometries of the primary member and the attachment. The purpose
of the coat-back is to reduce heat conducted through the attachment into the primary member
and hence limit the extent and severity of the local hot spot. In this way, the potential of
premature failure can be avoided. The coat-back length needs to be adequate to achieve this
objective.
A joint industry study [7.15] of the effects of coat-back on the primary member temperature
demonstrated the following:
• The required coat back length should be determined based on the local average
temperature which can be tolerated in the primary member at the attachment location.
As the coat-back temperature increases this temperature reduces. However, beyond
150 mm, any further reduction is small.
• The ratio of the cross sectional area of the attachment to that of the primary member
was found to have a significant influence on the temperature. The ratio of the section
factors (Hp/A) has secondary significance.
• The effect of the attachment on the temperature increased with increasing fire
resistance period. Thus, to maintain the same temperature in the primary member a
longer coat-back length would be required for a 2 hour duration than for 1 hour.
• Within the limits of the study, it was found that the section shape (of both the primary
member and attachment) had negligible effect.
• The properties of fire protection material have a small effect on coat-back length.
There are numerous references that discuss relief devices and relief sizing; examples are
Parry (1992) [7.16], DIERS (1992) [7.17], CCPS (1998) [7.18] and the Energy Institute (2001)
[7.19]. Roberts et al. (2000) [7.20] have reviewed the literature available (up to 2000) on the
response of pressurised process vessels and equipment to fire attack in regard to the new
data available since publication of the IGNs [7.21] and the remaining gaps in knowledge.
7.7.2 Relief
Traditionally, API 520 (2000) [7.22] has been used to size pressure relief valves for non-
reactive systems using heat inputs derived from the fourth edition of ISO 23251:2006 [7.23].
These heat inputs have not been changed in the fifth edition of ISO 23251:2006 although it is
now recognised (e.g. Energy Institute, 2003) [7.24] that more severe fires can occur than
those assumed by API. It should be recognised that pressure relief will not protect a vessel or
pipeline from failure if there is a high heat load to wall in contact with gas or vapour is this will
rapidly heat up to a temperature where the steel weakens. However, if the vessel/pipeline can
be prevented from failure due to weakening, e.g. by PFP (or deluge although it is not currently
taken into account), then the pressure relief valve can be effective under fire loading providing
that the possibility of two-phase flow is adequately considered. There are a considerable
number of standards for relief valve sizing e.g. API 520, NFPA 30 [7.25] and NFPA 58 [7.26]
(for LPG) and ISO 4126 [7.27]. These were reviewed by the Energy Institute (2001) [7.19] and
recommendations are made, based on experimental data, for the safe and optimum design of
relief systems. Their publication also goes into detail on which is the most appropriate relief
device for the different situations. In particular, they consider the advantages and
disadvantages of using:
They provide advice on relief system design, sizing of relief system systems and design of
flare and vent systems. In general, the recommendations complement those of API 520 and
ISO 23251:2006 but, in the specific case of two-phase discharge, they suggest that the API
method may not be adequate, particularly in the case of high-pressure discharge. This
conclusion is based on experiments involving the two-phase discharge of mixtures of natural
gas, propane and condensate through orifices and relief valves.
On the basis of comparisons with experimental data, the Energy Institute (2001) suggests that
the homogeneous equilibrium model (HEM) gives the best predictions for two-phase relief
flows and is preferred to the API method. They suggest that the HEM method deals naturally
with cases where the flow upstream is gaseous and where condensate is formed. These
cases may not be calculated accurately with the API method. Since both the API method and
the pure HEM method involve flash calculations, they consider that there is little benefit from
the simplification represented by the API method. The Energy Institute gives details of
application of the HEM method. Whilst the HEM method for two-phase relief has been
validated by tests, there is still no recognised procedure for certifying the capacity of pressure
relief valves in two-phase service.
7.7.4 Blowdown
The emergency depressurisation of process vessels is complex and the behaviour of the
process vessel during depressurisation varies depending on the vessel contents and the
conditions of the vessel. During depressurisation at ambient temperature, the temperature of
the vessel may drop dramatically as the contents are released, leading to the need to consider
the minimum design temperature requirements of the vessel. At the same time, however, if the
vessel is exposed to an engulfing fire, the behaviour of the vessel will be very different and the
pressures and temperatures experienced will significantly differ from those normally
considered. The design of depressurisation systems must therefore address both the
depressurisation and also the characteristics of any impinging flame, which may be the cause
of the emergency depressurisation.
The Energy Institute (2003) [7.24] performed a survey of methods used by industry for
protection against severe fires and, from the responses and information received, concluded
that:
• There is little consistency in the design methodology used, even within a single
company;
• Some said they had limited in-house expertise and engaged a specialist design
contractor; and
• Some applied API RP 521 (1997) and assumed that by designing to that code,
the risk was adequately addressed.
The revised version of API RP 521(2005) recommends that a vapour depressurising system
should have adequate capacity to permit reduction of the vessel stress to a level at which
stress rupture is not of immediate concern. For sizing, this generally involves reducing the
equipment pressure from initial conditions to a level equivalent to 50 % of the vessel design
pressure within approximately 15 minutes. This criterion is based on the vessel wall
temperature versus stress to rupture and applies generally to carbon steel vessels with a wall
thickness of 25 mm or more.
Gayton and Murphy (1995) [7.29] suggest that in more severe fires, rupture can occur well
within the 15 minute criterion used by API. Roberts et al. (2000) [7.20] discuss applications of
the Shell BLOWFIRE program to give vessel wall temperature-time relationships as input to
the ANSYS finite element program predicting thermal mechanical response of a second stage
separator with a wall thickness from 16 to 20 mm. The BLOWFIRE predictions were that after
an initial pressure drop on opening, the pressure could then increase and the ANSYS
programme suggested that failure could occur at 6 minutes. It was suggested that the worst
case might be partial fire engulfment where local heating of the shell causes local material
expansion and the expanding material pushes against colder, unheated sections, leading to
premature buckling and an increased probability of failure. The general implication is that
process plant fitted with protective systems designed to API RP 521 or a similar standard may
be insufficient to prevent failure of the pressure system before the inventory has been safely
removed in a severe fire.
• For each item of equipment, define the type of fire (pool, jet, partial or total
engulfment) likely to affect it.
• Calculate the rate of temperature rise of the vessel wall neglecting heat transfer
to the contents. This simplification is appropriate for jet or other fires, which
might affect only a small area of the vessel. More complex methods can allow
for heat transfer to the contents.
• Estimate the time to vessel rupture. From this temperature-time profile prepare
a yield –stress-time profile and a corresponding rupture pressure-time profile.
Compare this to the actual pressure vessel versus time for the required
blowdown time.
• If the time to rupture does not meet the established safety criteria (such as time
to evacuate), then design changes may be necessary to improve the vessel
protection. These may be a reduction in blowdown time, or application of fire
protection insulation, or changes to the plant layout to reduce the fire exposure.
In 2003, the Energy Institute published their interim guidelines for the design and protection of
pressure systems to withstand severe fires [7.24]. In this publication, the heat transfer to the
vessel is split in terms of radiative and convective fractions and the heat transfer to the vessel
contents is discussed in a similar way (see Section 5.5). They give an iterative procedure
based on calculating, for each process segment (isolatable section) and each time step:
• Pressure;
• Liquid levels;
The Energy Institute approach is based on that of Hekkelstrand and Skulstad (2004) [7.32].
They have refined their approach with the emphasis on using fast depressurisation making the
maximum use of the flare stack capacity and on minimising the use of passive fire protection.
Failure of a steel component will occur at the time at which the superimposed stress exceeds
the material strength and/or deformation limit. Knowledge of the time to failure is critical in
deciding on the remedial methods to be applied to delay failure. The time to failure of a vessel
or pipe work depends on the severity of the fire, the extent and type of fire protection, and the
pressure response and can vary between a few minutes and a few hours. The Energy Institute
(2003) [7.24], considered three calculation methods:
• Creep rupture stress (where both temperature and time are taken into account).
In theory, the most appropriate failure criterion is the creep rupture strength, rather than the
tensile strength since, as the time to rupture goes to zero; the creep rupture strength becomes
equal to the tensile strength. However, in view of the complexity of creep rupture calculations
(see, for example, Benham et al., 1996 [7.33]), tensile failure criteria are often used. In severe
fires, the rate of temperature rise in the wall above the liquid level or in a gas/vapour only
system is very high (of the order of 100 to 200 K min-1 depending on the steel thickness) and
the material strength falls rapidly once the temperature exceeds 500 °C. In these
circumstances, where the time involved is very short, the use of UTS may be acceptable if
used with an appropriate safety factor.
• Vapour-liquid interface.
The Energy Institute states that it is not clear which of these features are critical in assessing
failure or to what degree, if any, current failure criteria are conservative. Experiments are
required to assist in the validation of models intended to assess such features. Unless the
failure criteria are properly set, it is difficult to see how time to failure or realistic blowdown
rates can be properly set.
Data from jet fire trials (170 – 190 kW m-2 incident heat flux) on pipes pressurised with nitrogen
to 85 to 90 % of their design pressure endeavoured to take the pipes to failure and determine
their failure criteria. The modelling of the heat transfer to the pipe used Equation 5-7 (see
Section 5.3.2) and found good agreement with the measured values for small pipes but found
that the model overestimated the temperatures above 600 ºC for 250 mm pipes. It was found
that pipe failure was adequately predicted by comparing the equivalent stress (von Mises) with
the UTS. However, it was noted that the pipe corrosion allowance should not be used when
making the calculations and that good high temperature UTS data was needed. Hekkelstrand
and Skulstad (2004) [7.32] have incorporated these results in the latest edition of their
guidelines. They imply that the method may be applicable to pressure vessels containing
vapour and liquid but the complexities identified above are not explicitly considered. They also
provide data on the high temperature properties of steels. Data are also available from Burgan
(2001) [7.35] and Billingham et al. (2003) [7.36].
Following reviews undertaken by SCI, non-linear finite element analysis permits the rupture
calculations of a piping system to be based on more accurate methods which accounts for the
reserve strength inherent in many design codes. It also overcomes the approximations that
have been identified with the use of simplified methods.
• Rule sets in a QRA are set to reflect the standards to which safety critical
systems are to perform, e.g. no escalation of the initial fire event in an area.
• This rule set assumes that isolation and depressurising systems, and a
dedicated deluge cooling system are functional, available on demand and
survive the initial fire (performance standards).
• The systems are designed to meet the normal engineering acceptance criteria
for stress, deformation, temperature etc.
• DALs are determined for the systems whose risk, calculated by QRA, exceeds
the risk based performance standards.
Before formal industry guidance could be given on such links, guidance is needed on the rule
sets to use in QRA, the determination of DALs and appropriate engineering acceptance
criteria.
7.8 Personnel
7.8.1 General
Fires have the potential to cause severe harm and death to personnel offshore as a result of
the evolution of both heat and toxic combustion products. This potential is present both in the
immediate vicinity of the fire but also through transport of hot products at remote locations
through the action of buoyancy and wind. Inhalation of toxic and irritant smoke is the largest
single cause of fatalities in both onshore and offshore fires.
The objective of any system to mitigate the effects of fire on personnel must be to remove the
fire hazard either through fire extinguishment, reduction of the received insult or separation of
personnel and fire hazard.
This section outlines the main issues to be considered in defining and quantifying the fire
hazard effects on personnel offshore and what preventive measures may be available to a
designer to minimize this hazard.
The fires which can occur offshore are many and varied. The major concern lies with the
process fluids themselves. These can give rise to fireballs, vapour cloud, jet, or pool fires.
However, other fuels are present on the plant such as plastics, hydraulic fluids, cabling, seals,
paints, etc. These may become involved in the later stages of a process fluid fire or be the
main fuel consumed. General fires, not specific to the chemical process industry or offshore,
involving the structure and contents in the accommodation, control rooms and other occupied
buildings on the installation must also be considered.
All these fires produce heat in the form of radiant and convective fluxes. In particular exposure
to high radiant heat fluxes can produce severe burns to the skin and even ignite clothing.
Smoke is also produced. Here smoke is taken to comprise the airborne solid and liquid
particulates and gases evolved when a material undergoes pyrolysis or combustion together
with the quantity of air entrained or otherwise mixed into the mass. Smoke contains a complex
mixture of:
• Asphyxiant gases such as carbon monoxide and hydrogen cyanide which can
cause partial/full incapacitation and death.
• Irritant products (gases and aerosol) which at low and medium exposures
cause partial incapacitation thus hindering evacuation, while at high exposures
may lead to delayed death. The main irritants are acid gases for example
hydrogen chloride and low molecular weight aldehydes such as acrolein and
formaldehyde. These materials attack the eyes and respiratory tract.
The combustion product plume will also be at elevated temperature. Movement beneath or
within a smoke layer may result in exposure both to radiant and convective heat fluxes. Such
exposure may give rise to hyperthermia and skin burns while inhalation of hot products may
result in burns to the respiratory system.
Finally the lack of oxygen in the fire plume may induce a condition known as hypoxia. This can
cause dizziness and ultimately loss of consciousness.
Movement of a smoke plume around the installation under the combined influence of the wind
and inherent buoyancy must also be considered since its influence may extend beyond the
immediate vicinity of the fire. The potential for smoke movement must always be considered;
particularly when the identification and design of escape routes and muster points is
undertaken. This is a difficult area which can only be approached using models based on
computational fluid dynamics or physical modelling. Experience with the applications of both
these techniques to smoke movement remains however very sparse and the conclusions
should be treated with caution.
In general the production of toxic and irritant species in a fire is expressed as a yield - the
amount generated per unit mass of fuel burned. This product is then mixed with air entrained
into the fire plume and the hazard of asphyxiant and irritant gases and liquid irritants is
expressed as a concentration in air, either in volume or mass terms as ppm or mg l-1
respectively.
There does not appear to be a standard form for specifying the smoke hazard. Several may be
encountered. It can again be quantified as a mass concentration of product in the fire plume or
alternatively in terms more closely related to the hazard presented by smoke - a loss of visual
capability. Some parameters used include visibility – the distance in metres at which
unilluminated objects can be seen through smoke, an obscuration (%) – the amount of
attenuation of light over a given path, or an optical density. The latter is alternatively defined in
terms of either natural (De) or common (D10) logarithms:
Where
K is a property of the type of smoke and depends on its size distribution and optical properties.
There are limited data available though some measurements for flaming and non-flaming fires
involving plastics suggest figures of 7.6 and 4.4 m2 g-1. The product of K and C is known as the
extinction coefficient and has dimensions of m-1.
It has been shown that the optical density expressed as a unit path length (D10/L (dB m-1))
correlates reasonably well with general visibility through smoke with an optical density of 1 dB
m-1 corresponding to a visibility of ~10 m. Smoke production is often specified in terms of the
volume in m3 s-1 of unit optical density smoke issuing from a fire.
A further smoke measure often quoted is the mass optical density, Dm. This is more easily
measured in experimental tests and is related to the optical density measured in a volume flow
of combustion products V, resulting from a mass loss of smoke producing material ΔM:
The exceptions to such a rule are large pool fires involving the heavy hydrocarbons such as
crude oil, which may produce copious quantities of dense smoke and the situation of
significant confinement which restricts ventilation. In these circumstances (vitiated fires), the
lack of oxygen in the combustion zone leads to an increase of incomplete products of
combustion including carbon monoxide and smoke.
It has been noted that the levels of species production for under-ventilated confined fires can
be parameterized in terms of the equivalence ratio, defined as the fuel air ratio relative to
stoichiometric conditions and data have been presented which suggest that for solid phase
fires the rates of production of incomplete products may increase by factors of ~5-10 over the
well-ventilated situation. Experimental measurements have indicated concentrations of
oxygen, carbon monoxide and smoke of 12 %, 2 % and 2.0 g m-3 respectively for confined jet
fires where for such fires without containment carbon monoxide concentrations <0.1 % might
be expected.
Both experimental and theoretical studies have focused on the heat hazards from such fires
and there are considerable data on such issues (see Section 5.2 for discussions about
combustion effects). There are little data on the typical species output levels for fires involving
offshore process fluids.
Fires offshore may also involve solid phase fuels. These are present in a wide range of
locations. They may include cabling, seals, building materials and building contents including
accommodation modules and control buildings. Some of these materials have the potential to
produce heavy yields of smoke, toxic and irritant products, for example aromatic polymers
such as polystyrene and polyurethane foams. Such fires are likely to conform to the general
character of compartment fires observed onshore with distinct initiation and growth phases
leading to flashover and a fully developed fire.
From the toxic hazard viewpoint there are a number of specific fire types which may occur in
isolation or as stages during the course of a developing compartment fire which are of
particular concern and which specific toxic threats. These are non-flaming fires which occur
during the initiation phase of a fire.
• Small flaming vitiated fires which may occur if a fire does not grow to flashover as a
result of lack of ventilation.
A classification of the toxic hazards represented by these fire types is summarized in Table
7.7. These will vary with the fuel involved, particularly the mix of irritants and the level of
smoke but can be taken as a general guide.
CO2/CO
Fire Rate of growth Toxic hazard Temperature
ratio
Non-flaming/ Slow ~1 CO 0-1500 ppm 400 °C
smouldering O2 15-21%
Irritants
Little smoke
Small flaming Rapid 1000 down CO 0 –1%
to 50 CO2 0-10%
O2 10-21%
Irritants, heat, smoke
Small vitiated flaming Rapid then slow <10 CO 0.2-4%
CO2 1-10%
O2<12%
Irritants, heat, smoke
Fully-developed/post Rapid <10 CO 0-3% 800 °C
flashover HCN 0-500 ppm
Irritants
High temperatures
Dense smoke
• The first comprises a period when the fire is growing but before the victim is affected by
the stimuli from the fire - heat and smoke. During this phase the victim has the full
capacity and opportunity to escape and the main factors determining survival are
concerned with detection and response to alarms.
• The next phase is the period of exposure to heat and smoke. The effects of increasing
exposure to heat and toxic products increasingly hinder a victim’s escape capability
and induce growing incapacitation. Escape will become increasingly problematic. At
some stage a stage of full incapacitation will be reached.
• The third phase will result from prolonged exposure to heat and combustion products
and will result in serious injury or death.
Hydrocarbon fires involving process fluids may not exhibit the first of these phases. From this
analysis four major stages can be identified. The times at which these stages are reached are
critical to an individual’s survival.
1. Time to and level of partial incapacitation. The onset of partial incapacitation hinders
escape, reducing an individual’s evacuation speed increasing exposure to fire and the
chance of more serious consequences.
Here tu is the time from the start of the fire at which conditions become untenable. This may be
the time for full incapacitation should external rescue not be possible or the time to serious
injury or death if external intervention is available. te is made up of a sum of various
component times. For example:
where
ts is the time required to attain a place of safety or removal of the fire hazard.
General
A number of reviews have been produced adequately summarizing the basis of radiative
transfer relevant to hazard analysis and the hydrocarbon processing industries, others have
concentrated on the effects of radiation on humans. Thus Hymes et al (1996) [7.37] has
produced a comprehensive study; along with other studies, these provide suitable
methodologies for computation of the radiation received from flames and assessment of its
effect on man.
Significant casualties resulted from exposure to radiation during the Los Alfraques Campsite
and Lowell Gas Company incidents
Where
θ is the angle between the normal to the target and the line of sight from the
target to the point source location,
Alternatively the widely used method of view factors can be used. In this model the received
flux is given by:
Here E is the flame surface emissive power and ϕ the view or configuration factor. This is a
geometrical factor depending on the target location and orientation relative to the flame and
the flame dimensions and shape. ϕ takes values between 0 and 1. Lees (1996) has
parameterised several view factors relevant to process safety in terms of the geometry of the
situation. More complex computationally-based models used within computational fluid
dynamics suites are also available for the computation of radiation fields.
Beyler has provided a methodology for calculation of the transmissivity τ.. He has shown that it
depends principally on water vapour concentration in the atmosphere (in general, at distances
< 100m, and relative humidities up to 50 %, τ. > 0.7). For lower humidities and for targets
closer to the source, τ. = 1 would be a reasonably conservative assumption.
Burn injuries
Burn injury correlates closely with skin temperature and the severity of burning increases with
failure of the blood supply to remove heat incident on the skin. The severity of burns has been
previously classified in terms of degree as indicated in Table 7.8 below.
Injury due to exposure to short but strong pulses of thermal radiation may be correlated in
several ways; the most appropriate factor is the thermal dose – the product of radiation
intensity and time. However, it has been found that this underestimates the effects of high
intensities and that a better correlation is obtained if injury is with a dose, D, in the form:
Where t is the time in seconds, and I is the radiant intensity in kW m-2, this gives D in thermal
dose in units of (kW m2)4/3 s. Table 7.9 shows the spread of selected experimental burn data
for infra-red radiation correlated with the severity of injury. The degree of variability is high.
Table 7.9 - Summarised burn data for level of injury with threshold dose
Mean Range
Pain 92 86-103
Threshold first degree burn 105 80-130
Threshold second degree burn 290 240-350
Threshold third degree burn 1000 870-2600
Fatality criteria similarly based on the thermal dose can be derived for hazard analysis
purposes.
An alternative approach to deriving the level of fatality is the use of probit functions. Unlike
linear harm functions they account better for extremes of injury and the variable response of a
population. They are based on the statistical normal distribution. The probit function, Y, takes
the form:
V is the thermal dose in (kW m2)4/3 and a and b are constants derived by a fit to data. A
number of probits have been developed as shown in Table 7.10.
Table 7.10 - Probit equations for the fatality effects of thermal radiation.
The extent of exposed skin has an important effect on survivability in high radiation
environments. Thus reducing the burned area as a result heavy duty, well designed and
specified clothing can provide significant mitigation. Even without a hat and gloves an
individual wearing a one piece long sleeved overall and shoes will have an exposed body area
of <20 %. With only the hands, face and neck exposed this is further reduced to about 15 %.
Such exposures, even with full depth burns, significantly reduce the level of fatality.
The issue is then to avoid ignition of clothing. This issue is not well understood and further
work is required. For example Hymes (1996) [7.37] has examined the ignition properties of
various grades of clothing and counter intuitively he has predicted that fire retardant cotton will
ignite more easily than other clothing types. All useful clothing, for example man made fibres
may melt and as a result may increase exposure by melting on to the skin.
Hyperthermia
Simple hyperthermia involves prolonged exposure (>15 minutes) to heated environments at
temperatures too low to cause burn injury. This means temperatures below 120 °C and 80 °C
in dry and saturated air respectively. The main effect is a gradual increase in core
temperature. When this is raised to 40 °C consciousness becomes blurred, temperatures
above 42.5 °C cause death in minutes. The time taken to reach such a state depends on a
number of factors including the heat flux exposure, level of activity, air movement, humidity
and amount of clothing. The latter may reduce tolerance since it restricts mitigating
evaporative cooling. This suggests that at temperatures above about 100 °C exposures in
excess of a few minutes should give concern particularly in conditions of high humidity and if
the subject is working hard as might be expected if evacuating from a fire.
Convective heating
Above about 120 °C skin burns become increasingly likely. Clothing may provide some
protection but at temperatures around 200 °C pain levels become intolerable after a few
minutes due to burns. If temperature and humidity are sufficiently high to produce facial skin
burns they will also cause internal burns to the respiratory tract. Dry air at 300 °C will cause
burns to the larynx in a few minutes and breathing air at temperatures down to 120 °C will be
painful and potentially cause incapacitating burns.
In practice heat flux and temperature tenability limits intended to protect victims from
incapacitation from skin burns should be adequate to protect from burns to the respiratory
tract.
Conducted heat
The handling of hot objects can produce pain and severe burns. For metals for a few seconds
exposure at temperatures or 50 °C to 60 °C, 60 °C to 70 °C and ~80 °C can produce
discomfort, partial thickness and full thickness burns respectively.
Where W is a constant dose and t is an exposure time. The units of W are generally ppm min.
The effect of other constituents including most irritants is concentration dependent and the
effects are felt immediately. The response to other materials such as carbon dioxide and low
oxygen concentrations is a combination of dose and concentration.
The concept of a fractional effective dose (FED) has been introduced to allow the combined
effects of combustion product mixtures to be examined. For FED the Ct product for small
periods of time during exposure are divided by the Ct product dose causing the toxic effect.
This can be done for a number of components. The fractional doses are then summed until the
fraction reaches unity when the toxic effect is predicted to occur. Thus:
Similar calculations for a fractional incapacitating dose (FID) and fractional irritant
concentration (FIC) can be carried out. A FID or FIC =1 generally indicates a state of partial
incapacitation. Full incapacitation is predicted for a FID or FIC ~ 3-5.
The effects of many fire plume constituents are felt in the lung so the rate of breathing is
important. This is dependent on activity. Thus for an average man running or walking uphill as
might be expected in an escape situation the rate of breathing increases almost 6 fold.
Similarly some plume constituents, notably carbon dioxide produced in all fires, produces a
three fold increase in breathing rate at concentrations of about 5 %.
The effects of some of the different plume constituents are known to be additive. Thus those of
CO and HCN are and CO2 increases up take of these products in proportion to its effect on the
breathing rate. Similarly the effects of oxygen hypoxia are considered directly additive to the
combined effects of CO and HCN. However, the asphyxiant effect of CO2 acts independently
of other gases. The effects of irritants are considered additive.
Hydrogen cyanide: The effects of hydrogen cyanide depend partly on uptake and dose. The
effects increase from zero at about 80 ppm to loss of consciousness and full incapacitation in
a few minutes at 180 ppm.
Low oxygen hypoxia Again the effects of lack of oxygen are both concentration and does
related. The main effects are felt at concentrations below about 14%.Thus:
Carbon dioxide: The asphyxiant effects of carbon dioxide are only felt at high concentrations
above about 5 % and then follow a dose response relationship. Below this figure the main
effect is of hyperventilation which acts to increase the uptake of other gases. At concentrations
of 6-7 % individuals suffer severe respiratory distress and dizziness. Loss of consciousness
occurs at concentrations between 7 and 10 %
1. Sensory irritation pain to the eyes, respiratory tract and lungs to some extent.
The former is concentration dependent while acute damage only occurs above a threshold
concentration and then is dose dependent.
The main irritants are acid gases including HCl, SO2 and NOx and simple aldehydes such as
acrolein and formaldehyde. There is little data on irritants for humans. Some data for HCl and
acrolein indicate disturbing irritation to the eyes and upper respiratory tract occurs at
concentrations of 75 - 300 and < 5 ppm respectively. Acute pulmonary response may be
induced by exposures in excess of 12000 and 500 ppm for five minutes respectively.
Particulate smoke: Smoke can be either irritant or non-irritant. Smoke causes disorientation
and thus acts physically to reduce escape speed. They make way finding difficult and reduce
the visibility of escape signs. Studies have shown that walking speed is reduced from 1.2 to
0.3 m s-1 for non irritating smoke. There is also a psychological effect in that some individuals
will not try to evacuate through smoke at a density in excess of 0.33 m-1. The effects of
irritating smokes are even more pronounced. Such smokes with densities of only ~0.2 m-1
reduced walking speeds to 0.3 m s-1.
Radiation
A recent study has taken account of the special features of the offshore environment including
its isolation, the age profile and fitness of the population, state of dress etc and recommended
that the criteria given in Table 7.11 are the most appropriate.
Convected heat
The toleration of a hot environment depends on the level of activity, extent of clothing and level
of humidity. Temperatures above 120 °C will produce both skin and internal burn injuries. For
air with a humidity <10 %, the existing work suggests a relation for time to incapacitation in a
hot environment of
Thus temperatures of 100 and 60 °C would cause incapacitation in a matter of some 8 and 45
minutes respectively.
The time to incapacitation in air with higher water vapour contents is not well defined. It will be
significantly less that those obtained from Equation 7-11 but no data exist to allow its
determination with certainty. This is particularly important for fires offshore where there is likely
to be significant quantities of water both produced in the fire and used for fire fighting.
Asphyxiant gases
Existing knowledge suggest that the tenability limits given in Table 7.12 for asphyxiant gases
are appropriate for design purposes.
Some currently accepted 30 minute LC50 values for CO and HCN are 5700 and 165 ppm
respectively.
Irritants
Two irritant gases have been taken as examples, acrolein and HCl. Existing knowledge
suggests that the tenability limits given in Table 7.13 for these gases are appropriate for
design purposes.
Level a) is for unpleasant and severely disturbing eye and upper respiratory tract irritation,
Level b) represents severe eye and upper respiratory tract irritation with severe pain.
For death the levels represent concentrations at which there is a danger of death occurring
during or immediately after exposure. Concentrations are in ppm.
Table 7.13 - Tenability limits for sensory irritation or death from irritant substances.
Smoke
The ability to evacuate through smoke is dependent on a number of factors including
knowledge of the environment, levels of illumination (particularly of signage) and irritancy of
smoke. Suggested tenability limits based on ability to evacuate can be set in terms of optical
density and set at 0.2 and 0.08 m-1 for small and large spaces respectively.
For example water mist and deluge systems will produce copious amounts of steam which will
add to the obscuration provided by smoke and hinder escape. Also humid air enhances the
effects of hyperthermia and when inhaled can significantly increase the severity of internal
burns to the respiratory tract.
Many materials when treated with fire retardants are capable of resisting small ignition sources
but when faced with a large igniting fire can burn readily. The treatments themselves then add
significantly to the rate at which smoke is produced and the composition can be particularly
irritant and toxic.
Careful consideration must be given to the design and routeing of evacuation paths. Their
length must be kept to a minimum and they must be routed away from high hazard areas.
Should they be likely to be subject to fire attack they must be protected with fire walls suitable
for offshore duty or water protection systems? The evacuation routes should maintain their
integrity for a time sufficient to allow even injured personnel to reach a location of safety. If
likely to suffer from smoke logging consideration should be given to other methods of
way-finding. There are no particular guidelines for evacuation routes off shore. However CIA
guidance for onshore situations, suggests that evacuation routes should not suffer incident
radiant heat fluxes in excess of 6.3 kW m-2. There are also general requirements relating to
evacuation routes in public buildings and industrial premises.
Under UK legislation and as a matter of good practice, there is a need to provide temporary
refuges to serve as muster points prior to evacuation of the facility. There are no particular
guidelines for the design of such structures offshore. However, they are required to allow staff
to muster, assess the emergency and allow execution of the emergency plan. The requirement
is that the chance of loss of a TR, within the stated endurance time, will not exceed 1 in 1000
per year. Thus there is a need to design fire resistance into the structure. Those walls likely to
be exposed to fire must be protected in such a way, either by insulation or water deluge, as to
provide this resistance. The prevention of smoke ingress must be considered and any
ventilation system should include a means to close off relevant air intakes. Similarly a means
must be provided to seal doors and other openings such as cable routes and other services.
A key issue to consider in developing evacuation and mitigation strategies to protect personnel
is the provision of Personal Protection Equipment that can supplement the fire protection and
other mitigating measures discussed in Sections 3.2.8 and 10.3.
Dedicated fire-fighting teams will require specialist fire-fighting suits and will be trained to use
the full range of portable fire-fighting equipment on the installation. This equipment should
have been specified to be suitable for the range of hazards that the team are expected to
respond to, for example, rescue teams for helicopter crashes.
8 Response to explosions
8.1 Overview of explosion response
This Section deals with the methods of analysis of the response of structures, piping and
safety critical elements (SCEs) to explosion loads. The Section is based on a basis document
developed in an earlier phase of this project, [8.1].
Over the last ten years, many structures have been designed to resist uncertain explosion
loads by the calculation of the capacity of the structure and the SCEs and the demonstration of
robustness in the structure as reflected in an insensitivity of response to variations in load.
This approach is to an extent scenario independent and may give added protection against
unidentified scenarios and in particular combined fire and explosion scenarios.
The ‘robustness’ approach is valuable and should be considered in addition to the more
rigorous probabilistic methods described in this Guidance.
Due to the extreme nature of the ductility level blast (DLB) loads, it is essential to prevent
overall structural collapse but local failure may be tolerated as long as it does not lead to an
unacceptable escalation through progressive collapse, leakage of inventory or failure of SCEs.
This places considerable emphasis on the requirements for structural and equipment
robustness, i.e. ensuring that systems can absorb significant amounts of energy and be able
to redistribute internal forces via the provision of adequate alternative load paths.
One way of achieving structural robustness is to prevent premature failure by buckling and
shear failures which may produce brittle, as opposed to ductile response. Adequate
connections to adjoining members will ensure the ability to redistribute load and enable the
structure to mobilise its ultimate capacity. The goal of robustness ensures that the structure
has the ability to absorb some of the uncertainty in the loading to which it may be subjected.
A review of the research in the area of response to explosion loads since the generation of the
Interim Guidance Notes [8.2], or has been carried for this Guidance [[8.1].
• Identified strength level blast (SLB) and ductility level blast (DLB) load cases – these
should include special distributions of peak overpressure and overpressure time histories
at critical locations.
• Dynamic pressure exceedance curves for SCEs of criticality 1 for the DLB with time
histories of dynamic pressures at these locations.
• Dynamic pressure exceedance curves for SCEs of criticality 1 or 2 for the SLB with time
histories of dynamic pressures at these locations.
If exceedance curves are not generated then the probabilities associated with the design
explosion events should be available. If time histories are not supplied load durations and
general shape of the load time histories should be supplied.
Low and some medium risk installations will only require the information for the ductility level
blast explosion loads.
• High level and system specific performance standards for evaluation of the results of the
assessment.
• Layout drawings, including process, escape routes, muster areas, the TR, the SCEs and
their support structures
• Any structural drawings and the location of tall structures which may become a hazard
during escalation.
• Details of the assumptions for detection, control and mitigation systems, location and
required availability.
• For dynamic response analyses, the location and masses of all major items should be
supplied.
• Further exceedance curves will be required from the explosion specialists for dynamic
pressure loads, to enable the dynamic pressure loading on pipework to be developed.
In order to determine the loading on large items of equipment or vessels, the required items
can be identified to the explosion specialist for direct load extraction from the CFD model for
various explosion scenarios. Alternatively, a less accurate, but less time consuming method
for the explosion specialist, is to provide generalised pressure-time histories for the equipment
locations, together with the speed of travel of the pressure wave. The structural engineer then
determines the maximum pressure difference between locations of known separation, having
determined the time taken for the wave to travel that distance.
If the general level of dynamic pressure loads is not known then it is acceptable to take a load
equal to 1/3 of the smoothed peak overpressure at the location for loads on the relevant SCEs
and piping. The duration should be chosen so that the impulse is matched to the positive
phase of overpressure trace. This load must also be applied in the reverse direction. In open
areas, such as the decks of F(P)SOs, these loads should also be applied in the vertical plane.
The structural engineer should develop the idealised pressure-time histories for various pulse
durations in order to capture the range of dynamic response for the various components of the
system to be designed or assessed or preferably use a representative range of overpressure
time histories directly if they are available.
If a range of pressure time histories is not available then extrapolation of the range of
durations supplied should be investigated. The peak pressure/duration relationships [8.3]
given in Section 6.8 may be used to estimate the peak overpressure for shorter duration loads.
The peak averaged overpressure is plotted against impulse in Figure 5.6 of Chapter 5 from
work by Hoiset et al, [8.3].
The design overpressure of a panel will need to be greater than that for a section of a blast
wall which will in turn be less than that for a whole wall. The pressure disturbance is of finite
extent relative to the target and hence the averaged pressure will vary with target dimensions.
The explosion load specialist may supply a lower level of design load for an extended structure
(deck or wall) than for a blast wall; there are simple methods for deriving scale factors, [8.4].
The approach should be applied with care as the direction of travel of the overpressure pulse
relative to the target affects the way the pulse is reflected. The approach is suitable for large
deck areas or if sufficiently detailed information on the loading pattern is available.
In modelling the response of a structural frame, it is conservative not to model the cladding or
plate as the shear restraint from such surfaces may be overestimated. The overpressure load
on a plate may be applied directly to the bounding members of the plate using the ‘area
tributary method’. For example the loads on a square plate may be applied to the bounding
framing members with one quarter on each, for a rectangular plate the members on the long
edges would receive a load proportional to the triangular area joining the edges with the plate
centre.
The response of a structure to a dynamic load is commonly characterised by the ratio of the
load duration ‘td’ to the natural period ‘T’ of the structure. Depending on the value of this ratio,
three response regimes are defined, denoted as either:
• Impulsive
• Dynamic, or
• Quasi-static.
Peak Load Preserving the exact Preserve peak value – the response is sensitive to
peak value is not increases or decreases in peak load for a smooth
critical pressure pulse
Rise Time Preserving rise time is Preserving rise time is important; ignoring it can
not important. significantly affect response.
This table assumes that there is some identifiable natural period for the structure, which
indicates that a single degree of freedom (SDOF) idealisation of the structure is possible.
Multi-degree of freedom (MDOF) systems may have a large number of modal periods
associated with them, although it is often possible to identify a mode or shape of response with
each modal period.
If the loading is impulsive much higher peak loads can be tolerated than the static capacity of
the target.
The limits specified in Table 8.1 above have been changed to correspond to those in the
Norsok standard [8.6]. The impulse duration ratio at the impulse to dynamic boundary has
been reduced from the 0.4 and 2.0 values given in the IGN. The dynamic amplification factor
‘daf’ (dynamic/static response) does not approach unity for a triangular load pulse until a value
between 5 and 6 is attained. It is important to note that although the load duration may be
long, the rise time may be short and this can cause significant dynamic amplification as may
also be seen in Figure 8.1 from Clough and Penzien [8.9], (reproduced below) for the sharp
fronted pulse shape.
For determination of deck response to an explosion from below, it is important to represent the
negative phase of the loading to enable the calculation of rebound.
This form is not characteristic of far field blast waves outside a compartment. A typical trace
for this case is shown in Figure 6.4.
The single peak idealization shown in Figure 8.2 will not apply when external explosions are
involved or when there are two paths to the observation point or in some cases of explosions
in the moonpools of F(P)SOs. There are also concerns that the sharp changes in slope in the
idealization introduce spurious frequencies into the exciting force and that it is preferable to
use the original pressure traces from CFD or use some spectral approach. These topics
remain under investigation. Published guidance, [8.8], discusses the accuracy of various
methods of idealization of pressure pulses.
The use of Figure 8.1 is only applicable when elastic response is expected and the structure
does not yield locally. For plastic deformations the dynamic amplification factor has a restricted
meaning, as a static load which causes yielding would deform the structure without limit.
Lstatic = γ Lpeak
For single structural components γ may be as much as 2, for typical large structures such as
module and topside structures, the natural periods are likely to be longer with DAFs less than
one.
An equivalent static load may be obtained from consideration of the modes of response of a
MDOF structure and by choosing the mode (and modal period) corresponding closely to the
expected shape of the response if this is available. A DAF may then be calculated for this form
of response. Another technique is to perform a simplified dynamic analysis and find an
equivalent static load distribution which gives similar displacements to the peak dynamic
response. This only applies for elastic response but may enable code, utilisation or unity
checks to be performed using conventional software.
The DAF obtained for an extended structure and the appropriate design load may not be
applicable for member or local checks.
For plastic deformation a time history simulation may be used to estimate the DAF including
plastic response using Biggs’ method described later in Section 8.7.6.
For example consider an explosion overpressure of 1.5 barg with a duration of 150 ms as the
design load condition. A triangular profile may be appropriate as shown in Figure 8.2. This can
then be translated into transient dynamic response as shown in Figure 8.3.
0.0025
Static Response
0.0020 Dynamic Response
Displacement (m)
0.0015
0.0010
0.0005
0.0000
0.000 0.050 0.100 0.150 0.200 0.250 0.300 0.350 0.400
Time (second)
The example presented here indicates that a dynamic amplification factor of 1.125 for a
scenario with a duration of 150 ms and for an element with a natural period of 50 ms. For a
scenario with load duration 50 ms or for a member with natural period of 150 ms the
corresponding DAF would be about 1.9. The equivalent static load is that would cause similar
response to the blast impulse. This equates to static overpressure loads between 1.68 bar and
2.85 bar for the static design load conditions.
The method could be refined to take account of the variation of impulse and duration with peak
overpressure given in Section 6.8.
In a design or assessment project, if detailed and precise material data are available,
potentially a more economical design can be achieved. However in most design situations the
engineer will typically have to rely on generic data specified in the relevant standards. In the
special case of brown-field projects mill certificates for the employed steels should be
available. As a minimum these certificates will contain useful experimental results obtained
from tensile coupon tests on the yield strength, the tensile strength and the rupture elongation
of the steels.
It should be emphasised that when performing a structural analysis the materials are often
assumed to have a limiting strain well below their fracture strain. The reason for this is partly to
allow for deficiencies in the adopted analytical modelling tools, and partly to allow for variations
not explicitly covered in the geometric and physical description of the structure.
As an example the influence of specified tolerable variations in the dimension and mass of the
structural components as well their alignment are seldom incorporated into the analytical
model. Also local buckling of compression elements and localised necking of tension elements
are in general not automatically captured, except by the most sophisticated and detailed of the
analytical tools. According to the IGNs [8.2], the limiting strain can be set to 5 % for a member
in tension as well as for a member in bending or compression with a plastic cross-section.
The quasi-static stress-strain curve for a typical structural steel specimen tested in accordance
with standard tensile test procedures, such as those described in BS EN 10002-1:2001 [8.11]
is typically characterised by four distinct phases:
1. from the onset of loading, until reaching the upper yield stress, the stress-strain
behaviour of the specimen is nearly linear elastic with a modulus of elasticity of about
205,000 Nmm-2.
2. hereafter, it follows a rather sudden stress drop down to a lower yield stress,
With respect to the upper yield it is known that stress concentrations and welding both have a
tendency to reduce if not remove it. However, for the purpose of designing connections and
supports against dynamic loading, ignoring the upper yield stress could prove unsafe. In
contrast, when designing the individual structural members it is safe to ignore the upper yield
stress.
The yield plateau, which typically terminates at strains at least 10 times larger than the initial
yield strain, is followed by a phase of strain hardening at a continuously diminishing rate until
reaching the ultimate stress-strain point.
It is interesting that according to the guidelines given in the EC3 Part 1.2 draft code for
structural fire design the ultimate strain of structural steel can irrespective of the temperature
be set to 15 %.
Typical limiting values for some of the mechanical properties specified in EN 10225 for grade
S355, S420 and S460 steel are listed in Table 8.2.
Table 8.2 - Mechanical properties typically specified for structural offshore steels
Name Reh Rm Af
N/mm2 N/mm2 %
It should be noticed that the minimum yield strength Reh refers to the upper yield strength. The
requirements to the tensile strength Rm is given in terms of an upper and a lower limit, and the
ductility in terms of a minimum rupture strain Af. The rupture strain is measured over a gauge
length of 5.65 S0 , where S0 is the original cross-sectional area of the test piece. In situations
where the yield phenomenon is absent the yield strength should replace this parameter with
the 0.2 % proof strength Rp0.2.
It should be emphasised that the actual yield strength of steel frequently is significantly larger
than its guaranteed minimum value. In the case of the high quality offshore steels tested [8.13]
the upper yield strengths were measured to be up to 26 % larger than their guaranteed value,
with an average of about 13 %. Such differences between the guaranteed and the actual yield
strength need to be accounted when estimating the magnitude of the forces transferred
through the joint details into the supporting structure.
Compared to carbon steel the stress-strain curve for stainless steels are characterised by a
smooth rounded response with no definite yield point. Another major difference in the
mechanical performance at ambient temperature between the two types of steel is the
improved ductility of stainless steel.
Table 8.3 lists typical values for the mechanical properties of various stainless steels as
specified [8.14]. As is the case for carbon steels, the actual yield strength, here taken as the
0.2 % proof strength, is usually significantly larger than the minimum specified in the standard.
For the experimental test series described in [8.15] the measured proof strengths were in
average observed to be 28 % larger than the specified minima.
Furthermore the mechanical requirements given in the table refer to material in the annealed
condition. Thus in situations where the structural elements will be subjected to some degree of
cold forming without a following heat treatment, the yield strength in the work hardened zones
need to be adjusted upwards.
Strain hardening should always be accounted for when designing for the dynamic reaction
forces, whereas it safely can be ignored when designing section sizes.
Strain rate sensitivity is traditionally expressed in terms of the Dynamic Increase Factor (DIF).
For a given strain rate and a given material property the Dynamic Increase Factor is defined
as the ratio between the value of the material property measured under dynamic and quasi
static loading conditions, strain rates of 2.5x10-3 s-1 .As a consequence the tested value will
typically be about 8 % larger than the long term yield strength.
In general the dynamic testing of steel specimens has shown that the elastic modulus is
unaffected by strain rates, and that the strain rate sensitivity decreases with an increase in the
plastic strain. It is also generally accepted that the strain rate effects are the same whether the
material is loaded in tension or compression, and that the Dynamic Increase Factors are
isotropic in their nature.
Although an increase in the rate of straining reduces the fracture toughness of steel it is
unlikely that the strain rates associated with hydrocarbon explosions will significantly reduce
the fracture toughness of the high quality structural steels used for offshore installations.
One of the most used models to describe the rate effects on the yield strength is the Cowper
Symond’s model:
1/ q
f yd ⎛ ε& ⎞
= 1+ ⎜ ⎟
fy ⎝ D⎠
Table 8.4 [8.15, 8.2] lists the coefficients D and q recommended for calculating the dynamic
yield strength of various structural steels.
Material D q
s-1
Figure 8.4 compares various empirical models with experimental data; stainless steel
data [8.10], high quality carbon steels suitable for fixed offshore installations [8.2].
For typical steel structures the strain rates associated with hydrocarbon explosions will seldom
exceed 1 s-1. This compares with the strain rates of 103 s-1 frequently encountered in metal
working processes and hard impact situations. However the risk of employing the Cowper
Symond’s formulation to fit experimental strength data is the loss of some accuracy for the
strain rates which are most relevant to gas explosion scenarios. For strain rates less than
about 1 x 103 s-1, an essentially linear relationship exists between the stress and the
logarithmic strain.
It should be mentioned that the strain rates vary both spatially and temporarily within a
structure. Thus, when performing a non-linear finite element analysis it is necessary to know
the complete stress-strain behaviour at all encountered rates. Likewise it is assumed that all
conclusions regarding the uniaxial stress state can be generalised to the multi-axial stress
state.
1.3
1.2
1.1
1.0
0.9
0.8
1E-006 1E-005 0.0001 0.001 0.01 0.1 1 10 100 1000
strain rate s -1
Strain hardening may also be taken into account for tension members and plastic sections by
taking design strength to be the ultimate strength divided by 1.25 [8.2]. This effect should not
be considered when designing supports against reaction forces.
It is, however, necessary to demonstrate that the strains are high enough to mobilize the
benefits of the strain hardening. The following groups of structural members may sustain high
plastic strain without losing strength from local or overall buckling.
Members in axial compression or in bending and axial compression whose slenderness ratio
does not exceed 15 and the cross-sections comply with the criteria of compact section
Members in bending whose cross-sections comply with the criteria of compact section and
whose slenderness ratio (λ) does not exceed certain values.
In an explosion event, at least one escape route must be available after the event for all
survivors. For a manned platform a Temporary Refuge (TR) or Safe Mustering Area must be
available to protect those not in the immediate vicinity of an explosion and to survive the event
without injury.
For the ductility level blast (DLB), the primary structure should not collapse with escape
possible from safe areas after the event. Safety Critical Elements, defined as those elements
critical to safety [8.16, 8.17], should have fulfilled their function or remain operational. Plastic
deformation of the structure is acceptable provided collapse does not occur and barriers
remain in-place and are able to resist any subsequent fires. The ability of the structure to
satisfy these requirements will depend on its ability to respond in a ductile manner and the
ability of the barrier connection details to respond without rupture.
In the UKCS, the frequency with which accidental events, from all causes, will result in loss of
TR integrity within the required endurance time will not exceed 10-3 per year [8.18]. The
required endurance time is the estimated time for people to travel from their work stations to
the TR, then to the primary and secondary means of escape, allowing for the possibility of
helping injured colleagues.
In addition to the high level Performance Standards above it will be necessary to define
measurable performance standards for specific key items or systems relating to the systems’
functionality, availability and survivability. These are referred to in this document as ‘element
specific performance standards’ used in the evaluation stage of the explosion assessment.
These are sometimes referred to as low level performance standards.
Performance Standard – These items must not fail during the DLB or SLB, ductile
response of the support structure is allowed during the DLB.
Criticality 2 Items whose failure could lead to major hydrocarbon release and escalation
affecting more than one module or compartment.
Criticality 3 Items whose failure in an explosion may result in module wide escalation, with
potential for inventories outside the module contributing to a fire due to blowdown
and or pipework damage.
As is common in the design of structural systems under other forms of accidental loading, eg.
earthquakes, performance criteria for the DLB are set such that permanent deformations can
occur, but overall collapse is prevented. In addition, is the requirement that the explosion must
be contained, in order to prevent an escalation of the event. Consideration needs to be given
to limits of deformation, as determined by the location of pipes and equipment and to the
performance of these items. The limits specified for the structural elements should not exceed
those required for the supported or adjacent equipment to function adequately.
Performance levels for structural elements, that are normally considered, are:
• Strength
• Deformation limits
• Rupture
• Global collapse
This guidance document recommends two levels of structural assessment, strength level
analysis for the SLB and an ultimate capacity analysis or ductility level analysis for the DLB.
The performance standard relating to strength of members is more suitable for the strength
level analysis, as this is predominantly a stress based check using static design codes. For the
DLB, ultimate capacity check the yield stress limit will be exceeded and member stress is not
appropriate for judging member response. At the ductility level, deformation limits are normally
adopted.
For a class 1 section, Dowrick [8.19] allows a limiting support rotation of 2 degrees and a
ductility factor of 10 (whichever governs) as reasonable estimates for absolute values to
ensure safety for personnel and equipment and consistent with maintaining structural integrity
in the inelastic range. It should be noted that such levels of ductility will have design
implications for members containing plastic hinges to ensure the ductility levels can be
achieved. This is normally achieved by providing lateral restraint at hinge locations to the
unbraced compression flange.
Norsok standard Annex A, N-004 [8.20] gives the range of allowable values of μ depending on
the section classification assuming no axial restraint to the beam and the boundary conditions.
These are given in Table 8.5.
Cross-section category
Boundary Load
Conditions
Class 1 Class 2 Class 3
Concentrated 6 4 2
Cantilevered
Distributed 7 5 2
Concentrated 6 4 2
Pinned
Distributed 12 8 2
Concentrated 6 4 2
Fixed
Distributed 4 3 2
Consideration of attached fire protection may impose a lower limiting strain or deflection. The
displacement of the component must also be limited to prevent impacting SCEs and
equipment items.
8.5.4 Rupture
Structural integrity is often assessed using strain limits, which if exceeded would cause
rupture. Current guidance on allowable strain values are to set the critical percentage strain
limit at 5 % at weld locations and 15 % in the parent material away from welded details.
These values refer to average local strain values. However it is important to be aware that
strains at this level are quite sensitive to a number of parameters and tests show a significant
scatter of strains at fracture. The Norsok Standard [8.20] highlights a number of factors which
influence the strain values such as material toughness, presence of defects, strain rate and
presence of strain concentrations. Strains are normally adopted as a failure criterion when
using finite element models to judge response. It should be noted that variations in strain are
quite common depending on the modelling assumptions used and care in interpreting these
values at critical points is required.
Screening of various options for blast-walls or potential behaviour of walls and decks under a
number of explosion scenarios requires cost effective, reliable and accessible solutions. In
many cases this may mean that complex Non-Linear Finite Element Analysis (NLFEA) is
unlikely to be an option in the early stages of the design cycle unless planned well in advance.
Once the design has matured and safety critical elements of the structure have been
identified, NLFEA is likely to be required to verify the design.
For retrofit systems, it may be important to obtain the ultimate capacity at an early stage which
may require a more refined analysis at the outset. This will assist in determining the degree of
retrofit required although other factors such as shutdown period if hot work is required and
space available will also influence the options available. It is also important to bear in mind that
simple models may not give a satisfactory design for large overpressures as many of these
tend to rely on bending capacity from a static analysis with some form of load factor to account
for the dynamic response.
The extreme loading applied to a structure during an earthquake is often compared with an
explosion event on a topside due to the small probability of occurrence. Also, many of the
concepts used in design for earthquakes [8.19] such as attention to detail to connections and
ductility requirements apply equally to topside explosion response. For earthquake design it is
common to consider two load cases for the design of structures and equipment:
1. For a frequent earthquake with low seismic forces, the structure or equipment
should remain undamaged. For the structure this is essentially a serviceability
check and must remain elastic.
2. For a strong rare event, the structure can sustain damage but overall collapse
should not occur.
In blast mitigation applications the prime objective is often energy absorption and not static
strength, particularly for the extreme low probability scenarios, although limiting deformations
need to be set in some parts of the structure which may be influenced by plant, equipment and
piping. In general, increasing the stiffness of a structure can result in local stiff points which
attract high loads and lead to brittle failure modes which may compromise the integrity of the
whole system.
The SLB may be typically in the region of 0.5-0.6 bar. It should not be less than the 0.34 bar,
which is given in the building code [8.21] as a minimum lateral pressure to be resisted by walls
in order to achieve a minimum level of robustness in the connection details.
This is likely to involve simple numerical models such as the Bigg’s SDOF idealization [8.5] or
a static finite element analysis for the primary steelwork. The use of simple models will allow a
rapid assessment of the suitability of the layout of the primary steelwork and the screening of a
number of pressure time histories to establish the bounding case from the loading.
Performance standards based on design strength are adopted for assessment with this
loading level. It is important to be aware of limitations of this approach:
• Design codes are based on static design and not dynamic loads. This is particularly
important when checking members in compression as buckling is a time dependent
phenomenon which may invalidate some of the static code checks.
• It is essential to allow for the enhanced reaction forces at connection details due to
the enhanced yield stresses which may occur.
• Membrane forces may occur in some elements which may not have be accounted
for in some code checks
In some cases a maximum deflection limit may be specified to avoid compromising supports to
vital equipment or pipework, which may lead to an escalation of the event. The adequacy of
components is checked against performance criteria based on maximum deformation and
strain rather than strength.
Analysis of this level of deformation inevitably requires the use of more complex analytical
tools, such as non-linear finite element techniques which are capable of modelling large
deformation and strain. It is also important to capture the effects of interaction of the structural
elements as a system, in order to assess the possibility of a global collapse mechanism
occurring. Uncertainties still exist at such large strain values, which are inevitable in many
instances, and care needs to be taken when interpreting the results of non-linear analyses.
Joints, panels, barriers and connections still need to be checked against the DLB directly
preferably using a non-linear elastic plastic method of analysis.
It is, however, unlikely that the differing levels of response to dynamic loads at the same peak
level (as determined by the natural periods of the target structural elements) will be adequately
represented without undue conservatism. The variability of pressure in the explosion load
cases is also not represented in this method. The validity of this method will depend on the
severity of other load cases which have been used in the original design of the structure.
For the primary structure, which is crucial to the survivability of the structure under the extreme
load condition, it is necessary to ensure that it remains predominantly elastic in the overall
failure mode and parts of the structure that are allowed to yield are detailed for high ductility.
This will be predominantly the blastwalls and plating, which if allowed to deflect, will reduce the
loads transmitted to the primary framing. This places emphasis on the connection details,
which need to be assessed for large rotations in order to achieve a robust structure.
The general philosophy is to start with the simplest methods (ensuring a conservative
approach) and if failure is indicated, proceed to more sophisticated methods of analysis.
1. Screening analysis
Non load-bearing elements, typically panels, fire walls, and blast panels may be checked in
isolation.
The stresses in panels and cladding usually dominate the stresses due to frame movement.
Panels and some blast wall systems may be conservatively idealized as one way spans.
Resistance displacement curves may often be determined statically, dynamic response may
then be determined using a modified Biggs’ [8.5] method.
Dynamics of simple structures may be represented with knowledge of dominant natural period.
It is preferable to model the primary structure response to the SLB using an elastic frame
model as single member assessment does not take into account the transfer of loads between
connected loaded surfaces and any co-existent static loads. It is preferable not to include non-
structural cladding and plates in the model as their response is mainly in membrane action and
their shear strength may be overestimated.
Screening analysis for an existing installation consists of condition assessment which may
involve a survey followed by design basis checks.
The transfer of conclusions and load characteristics from the analysis of a similar platform is
acceptable for this and for Strength level and ductility level analyses.
Design basis checks consist of checking the basis of design for the installation and
determining if the methods used for the design are acceptable in the context of the fire and
explosion events considered.
If the structure and appurtenances have been checked for a Safety level or Ductility level
earthquake loads following API RP 2A [8.26] (9th Edition Section 2.3.6e.2 or later) then the
‘strong shock’ response to explosions need not be checked.
Component checks may be employed if the component is non-load bearing in the operational
condition or if the component does not form part of the main framing. Methods of dynamic
response assessment such as Biggs method [8.5] may be used. Where loads from connected
A major consideration in explosion response is that deflections of the structure must be limited
to allow escape. Typically the deflections into escape ways should be limited to about 150 mm.
The allowable deflection into equipment spaces will depend on the clearances to equipment.
The deflections of the Primary structure will normally be satisfactory if it passes the normal
strength or utilization checks. Blast and firewalls are however designed to deflect to exploit the
ductility of these items and so deflection checks for these items will be necessary.
Buckling checks must also be performed to ensure that the full plastic capacity of a member
can develop.
It is conservative not to include the restraint from the cladding or barriers in the primary frame
computer model. In some circumstances it is advisable not to include the cladding as plate
elements as the shear restraint from these elements will be overestimated in a small deflection
elastic model. This applies particularly if an external explosion load is considered which puts
the side walls with respect to the pressure into shear. In a dynamic analysis the masses and
their distribution should be included in the model.
In checking the primary structure it is conservative to include the loads from barriers but to
ignore their strength contribution.
The response of cladding panels and plates that form part of the primary structure may be
analyzed in detail using finite element analysis assuming the supporting beams are fixed at the
main nodes of the structure. The justification for this is that the stresses in the panel are
dominated by local response of the panel out of plane and that the stresses induced by the
deflection of the main framing are comparatively small. If necessary this assumption can be
checked by application of prescribed displacements to the edge of the panel corresponding to
the frame response.
Buckling checks must be performed to ensure that the full plastic capacity of a member can
develop. These checks should be made particularly for deck beams loaded from an explosion
below as flanges usually in tension may be in compression during the explosion. These
checks should ideally be performed using the loads for the DLB and SLB load cases. Deck
beams loaded by an explosion below should also be checked for re-bound effects.
The dead loads in the structure need to be combined with a realistic estimate of live or
operating loads to perform a strength level analysis treated as a design load case.
Environmental loads need not be included. API [8.26] recommends that 75 % of the live loads
are included in the combination for the earthquake analysis. It is recommended that the same
proportion of live loads is taken for the explosion load case. The loads from an existing fatigue
analysis load case may also be suitable.
A number of issues must be considered when applying code checks for Strength level
analyses. Blast resistant structures and their supports are designed to respond in a ductile
way to explosion loading mainly in bending. The shear behaviour of structures at their
supports and in the joints of the primary frame will also affect the utilization factors derived in
Additionally, for a dynamic situation these shear forces will be quite different from the values
obtained by static analysis as a result of the inertia forces acting on the structure. The benefits
of this effect are exploited in blast wall design, as the support or reaction loads may be less
than the applied overpressure load. Plastic deformation of a blast wall also has the effect of
limiting the reaction loads on the supports.
For a loading duration near the natural period of the member the shear forces could be higher.
Checks should be made where this is likely using a dynamic amplification factor based on the
ratio of load duration to natural period (see Figure 8.1).
Code checks may be re-interpreted to take account of the inherent reserves of strength, both
material and plastic reserves.
For most ductility level analyses code checking will either not be appropriate or the response
simulation software will not contain a code check module within the software. Checking of
members will be done explicitly with regard to performance standards, which may take the
following forms.
• Strength limit checks similar to code checks; failure is defined to occur when the design
load or load effects exceed the design strength. This criterion may be applied in the
plastic region.
• Buckling checks, which identify where plastic response may be limited by local buckling.
Members may be classified as plastic, compact or non-compact (BS5950) [8.27]. Plastic and
compact members will generally reach their full plastic capacity before buckling.
If the structural response software is capable of representing finite displacement effects, plates
may be included in the model to represent barriers and loaded surfaces. The inclusion of
plates with equivalent thickness to represent mid-point deflection will also help to represent the
tension and shear effects from these items.
The restraining effect of cladding can conservatively be omitted from the computer model so
long as the loads applied to them are applied to the bounding members according to the area
associated with each one. Some packages will not take account of the loss of shear restraint
from the cladding as it is deformed; in this case it is preferable not to include the cladding as
plates in the model.
Deformation limits have been discussed in Section 8.5.3. Additional Guidance is given below.
Compact sections may be designed using code checks without supplementary local buckling
checks up to first hinge formation.
Section 7.2 of FABIG Technical Note 4 [8.28] gives formulae for checking for local buckling of
beams working beyond the elastic limit.
Checking of columns under axial compression is dealt with by Kato [8.29]. In most situations
blast walls are arranged to span from floor to ceiling without direct support from the columns.
Isolated columns only receive load from dynamic pressures and could be in tension during an
explosion. Allowable ductility ratios based on earthquake design practice are available for
I-sections, box sections and circular sections from the literature [8.29].
Buckling checks must be performed to ensure that the full plastic capacity of a member can
develop. These checks should be made particularly for deck beams loaded from an explosion
below as flanges usually in tension may be in compression during the explosion. These
checks should be performed using the dimensioning explosion load level.
Table 1 of FABIG Technical Note 4 [8.28] gives criteria for the prevention of lateral torsional
buckling based on slenderness ratios for beams. Large deflection effects such as web
crushing and flange curling are dealt with Section 7.4 of the FABIG TN [8.28].
The principal ultimate failure mechanism for joints is rupture or brittle fracture unless the joint
is stronger than the members which are connected to it. The basic design principle is to design
them so that loading or imposed rotation causes ductile deformation of a connecting member.
This follows general practice in earthquake design. A more detailed appraisal is given in
Section 9.4 of the FABIG Technical Note 4 [8.28].
Components may be analysed in isolation as long as the interaction with the surrounding
structure through fixity and the applied loads are negligible or are represented in the
component model [8.25].
Single degree of freedom (SDOF) methods represent a structural system as a single mass
whose motion is resisted by a single linear or non-linear spring. The magnitude of the mass
and the stiffness of the spring are determined such that the displacements in the SDOF model
are the same as a characteristic displacement of the real system, usually taken to be a point at
mid-span.
The SDOF method is limited to structural systems, which can be easily simplified to a single
mass and spring. These are systems where the overall response may be represented by a
The SDOF method can easily be programmed onto a computer, which can calculate the
displacements at each time increment. The equations of motion can be modified during the
time-stepping process, to allow the modelling of changes in structural behaviour at certain
displacements. For example, the change in structural stiffness caused by plastic deformation
can be introduced when the yield displacement of a beam has been exceeded; hence
realistically modelling the increased displacements that occur after plasticity has been
reached. Explicit solutions of the equations of motion do not have to be found, and hence it is
relatively simple to use non-linear force and resistance inputs without significantly increasing
the complexity of the program. This is particularly useful in the analysis of blast panels, where
the resistance-displacement relationship is complex.
The Biggs method requires two basic inputs, the resistance displacement curve and an
idealized loading time history. Design charts are available [8.2, 8.5] for the calculation of the
peak response, x max , given the load duration to natural period ratio, t d T , and the ratio of
peak overpressure load to component ultimate plastic resistance, Fm R m . The charts are
based on simplified bi-linear resistance behaviour, which is inaccurate for fully or partially fixed
members as well as for members where tension effects are significant. This procedure is
illustrated in Figure 8.5.
The mass and stiffness of a structural member must be carefully represented in the SDOF
model to ensure that the model displacements accurately represent the displacements of the
actual member. The mass and stiffness of the member, as well as the loads applied to it, are
modified using transformation factors which are calculated taking into account the deflected
shape and the loading and mass distributions [8.2, 8.5].
The values of the transformation factors are dependent on the deflected shape of the member
under the blast load. If the deflected shape of a member changes as it is loaded (for example if
plastic deformation occurs) the transformation factors must be adjusted. Methods of
calculation of mass K M and stiffness K L transformation factors for beams and panels are
given in the literature [8.2, 8.5].
Me
T = 2π
ke
Typical member response is shown in Figure 8.3. Member damping is not usually modelled in
this analysis, and hence the member oscillates freely after the blast load has been released.
In practice, damping is not important, as it is generally small for structural members oscillating
Issue 1 May 2007 Page 324 of 493
FIRE AND EXPLOSION GUIDANCE
in air, and in any case it is the maximum displacement rather than subsequent oscillations,
which is important.
The degree of rotational and axial fixity at the ends of a structural member affects its elastic
stiffness and hence its natural period. The bi-linear resistance - displacement relationship used
in the Biggs’ design charts is only accurate for simply-supported members, where the member
reacts either purely elastically or purely plastically. For partially or fully fixed members,
elastic/plastic behavior occurs before the member reaches its ultimate plastic resistance.
The Biggs’ charts use an approximation of member stiffness to give a bi-linear resistance
curve for all fixity conditions. The stiffness used in the Biggs’ method is determined such that
the area under the ‘actual’ and ‘idealized’ curve are equal, and hence the energy or work done
to a given deflection is the same for the two curves.
A range of values of Fm Rm and t d T were used to generate the sets of curves shown in the
Biggs’ design chart Figure 8.6 for a simply supported member under a triangular load with a
rise time equal to half the load duration. Similar charts for differing rise times of triangular
loading are given in references [8.2, 8.5].
This chart enables the peak response of the member to be calculated. The vertical axis is in
terms of the ductility, which is the number of multiples of the yield displacement the member
will reach under the loading.
• Determine the peak resistance Rm, effective stiffness and yield displacement Xe for the
member,
• Determine the effective peak force Fm from the peak force Fpeak and the load factor Kl. (Fm
= Kl x Fpeak),
• Determine the natural period of the member from the effective mass and stiffness,
• Read off the ductility for the peak response corresponding to the td/T for the member,
• Calculate the peak response from the ductility indicated on the vertical axis.
The reaction loads at the ends of the member may also be estimated using this method
although the accuracy may be doubtful as detailed strain information is not represented in the
model. These formulae are not accurate for two way spanning panels but are reasonable for
the assessment of one way spanning panels or beams.
Similar charts may be constructed for partially fixed members by applying a rotational spring
stiffness, K s , to the ends of the member [8.25], K s tends to infinity for a fully fixed member
and to zero for a simply supported member. The degree of end fixity for a member is
determined from the flexural stiffness of the connecting structure.
At low values of fixity, a plastic hinge is initially formed in the middle of the member, with
additional deflection causing plastic hinges to occur at the ends until the ultimate plastic
resistance is reached. At high values of fixity, plastic hinges are initially formed at the ends of
the member. Increased deflection causes a plastic hinge to be formed in the middle of the
member. The transitional stiffness occurs at K s = 6EI L . This stiffness gives the greatest
elastic resistance for the member. Here I is the second moment of area, L is the length of the
member and E is the Young’s modulus for the material.
The degree of fixity significantly alters the natural period of the member. The natural period for
a fully fixed beam is less than half that of a pin-ended member. The ability of a member to
resist axial loads is reduced if its fixity is reduced. The buckling load for a pin-ended column is
4 times smaller than that of a perfectly fixed column.
Attached equipment alters the natural period of the member by increasing the mass, which
must be accelerated during blast loading. A one degree of freedom idealization may be
adopted to check the response of deck sections if a Screening Analysis is being performed.
The effect of static out of plane loads is to cause an initial deflection of the member. The
deflection will be positive in the case of a floor beam subjected to blast loading from above,
Issue 1 May 2007 Page 327 of 493
FIRE AND EXPLOSION GUIDANCE
and will be negative in the case of a ceiling beam subjected to blast loading from below. The
initial deflection due to the out of plane loading effectively changes the position of the origin on
the resistance/displacement graph.
The resistance function may be modified to take into account equipment loads. The same
Biggs’ chart may be used to estimate peak response so long as the natural period and
resistance function are modified to represent attached masses.
Whilst purpose designed blast walls will have no static loads applied to them, there is often a
need to assess the capacity of module walls and columns with in-plane loads present.
In-plane (i.e. axial) loads have 4 effects on the response of structural members:
1. Axial loads reduce the plastic moment capacity of a section. At the dead and live loads
normally applied to structural members the reduction in plastic moment capacity is
small.
2. Axial loads change the stiffness and hence the natural period of a member. The
stiffness of a member will reduce to zero at the Euler buckling load.
3. As an axially loaded member deflects under blast loading an additional moment will be
generated by the axial load about the original centre line of the member. This ‘P-delta’
effect is modelled by converting the moment caused by the axial load into a lateral
resistance, which is then subtracted from the original beam resistance.
4. An axial load may be applied eccentrically to the member, creating an initial central
deflection. The reduction of blast resistance due to eccentric axial loading is modelled
by reducing the resistance of the member at the initial deflection.
The dominant effect on response is the p-delta effect. As blast walls are usually arranged to
span from floor to ceiling the direct explosion loads on columns are small these effects may be
ignored in a Screening Analysis.
Blast walls are usually designed to deform plastically and act predominantly in bending to
minimize the reactions on the primary structural members of the platform. A great deal of effort
is usually expended in designing the edge connections of the blast wall so that the reaction
loads are transmitted to the supports without damage to the supporting steelwork. Because of
the inertia of the wall it is possible to design these connections such that the transmitted shear
forces and moments are much less than the peak overpressure force on the wall. Purpose-
built blast walls are usually free standing, spanning from floor to ceiling and are not an integral
part of the supporting structure.
The capacity of a blast or fire wall with stiffened plate construction may be estimated for
Screening Analysis purposes using yield line analysis for the plate sections [8.31]. Other
formulations for resistance estimation are given in the API Bulletin Reference [8.31]. Work by
Shell [8.32] indicates that the ultimate capacity of panels may be much larger than formerly
thought. In particular the finite deflection capacity of a simply supported plate is larger than the
classical estimates of the capacity of a clamped plate with the same dimensions and span.
The possible failure modes of the wall may include panel, stiffener and whole wall failure. Each
mode corresponds to a different plastic hinge, or yield line pattern. Local and torsional buckling
The calculated resistance will also depend critically on the edge support conditions assumed
which may in turn depend on the form of loading. High pressure loading on adjacent panels
may give rise to clamped edge conditions between panels even though the panels would not
otherwise merit this approach. Tension and membrane effects often indicate an increased
resistance but the restraint from the surrounding structure through inertia or stiffness may not
be sufficient for these effects to be fully mobilized.
Penetrations such as piping and cable runs should be arranged to pass through the wall at the
top or bottom of the wall to limit deflections and induced strains in the wall. The penetration
should be fire and gas proof. The penetrated section of the wall should be designed to have
the same stiffness and strength as those parts of the wall where no penetrations exist. The
dynamics of the wall and penetrations may need to be checked if large mass items are
attached to the wall.
Efforts have been made to include tension and membrane effects into Biggs’ method [8.25,
8.33, 8.34] with mixed success.
8.7.5.6 Rebound
Rebound must also be considered. This occurs when the load has subsided and the stored
elastic energy in the wall is released. This may be taken into account by assuming a reverse
load or suction at a level of 1/3 of the original overpressure with the same duration.
Biggs method may also be used to determine the rebound response if a suction phase is
included in the load time history. Other authors have developed a rebound dynamic
amplification factor which may be used to calculate rebound response [8.27].
• It is not an easy task to convert anything other than the simplest structures into
equivalent spring mass models. A great deal of engineering judgement is required in
determining meaningful models and interpreting the solutions. For example, modules
are normally framed for lifting and to give redundant load paths, making the overall
structure of the module difficult to describe as a one degree of freedom system.
• The deformation of structural components such as walls and decks is highly dependent
on the degree of restraint provided by the primary steelwork. Although some
membrane action can be incorporated into the model, it is difficult to accurately model
the stiffness of the boundary. This places severe limitations in trying to characterize the
resistance function of the SDOF model when modelling plated structural components.
• Ductility factors which are used are normally for idealised simple beam models. These
may not be appropriate for the actual MDOF structure where different patterns of
Issue 1 May 2007 Page 329 of 493
FIRE AND EXPLOSION GUIDANCE
yielding could give the same overall inelastic peak deflection but the local ductilities
may be significantly different.
• The Biggs method implicitly assumes that the deflected shape under blast loading is
normally the same as the static deflected shape. Many multi-degree of freedom
systems or systems with complex mass distributions do not respond in this way. This
also applies to some stiffened plate blast walls.
• The loads obtained from a CFD model may indicate that they vary significantly in both
space and time requiring some conservative idealisation to simplify them so they can
be used with the SDOF model.
• The method relies on the fact that the mass can be lumped, but deck type structures
are likely to have significant mass components from plant and equipment. This spatial
variation in the mass may well invalidate the assumed shape function and give non-
conservative results. Biggs [8.5] does address this problem but often the refinements of
his method are not implemented. If the rebound is more important, which may well be
the case if the ceiling of a module supporting plant is being considered, care needs to
be taken [8.35].
Although some of the limitations above seem severe, the technique has been successfully
used in design situations, particularly where the resistance function has been accurately
determined. FABIG Technical Note 4 [8.28] shows an example of a stiffened plate which
whose resistance function was determined via a static NLFEA and combined with the spring
mass model. The deflection time histories compared well with an explicit NLFEA up to
pressures of the order of 3 bar. Beyond this, the model was unable to give accurate deflection
values. This was thought to be due to the spread of plasticity which results in a change of the
shape function used in formulating the spring mass idealization.
For an impulsive load, the kinetic energy imparted to a structure or structural element by a
short duration pulse or external work for a long duration pulse is determined; the strain energy
is then equated to the strain energy developed while the structure is deforming.
A suitable shape function is required to describe the deformation under the loading and both
elastic and plastic behaviour can be accounted for. The resulting expressions for the two
loading regimes are then rearranged such that a non-dimensional plot of pressure against
impulse can be constructed. A number of curves are normally plotted for varying levels of
damage which may be defined in terms of the ductility parameter μ. This allows rapid
assessment of the damage or vulnerability to a number of different loading conditions. The
method is capable of representing membrane action in elements such as plate components.
The method can also be applied to certain systems which are also not easy to define using a
SDOF model.
Furthermore the impediments to the common use of this powerful modelling tool are
continuously being pushed back by advances in computer technology. However, though the
necessary computer speed and data handling capabilities may prove no longer to be a
problem, it is still very much a specialist’s tool because of its general-purpose characteristics,
and because the method inherently overestimates the resistance of structures. The successful
application of NLFEA requires a sequence of carefully considered modelling, and possibly
sub-modelling, decisions as well as a number of control checks before total confidence in the
predicted results can be achieved.
The numerical model should include sufficient parts of the supporting structure to ensure that
the end-restraints are modelled realistically. This is especially the case when determining the
membrane forces developing in structural components undergoing large displacements. The
membrane forces have the effect of increasing the resistance of a structural member by
delaying the onset of buckling, and can also significantly alter the reaction forces. In this
context it should be noted that when membrane forces develops in one part of the structure
they are usually counterbalanced by compressive forces in other parts. These compressive
forces may have an adverse effect on the stability of the structure.
Rather than opting for a high overall level of detailing in the modelling of structural assemblies
it is often possible, without loss of accuracy, to employ the output of one model to drive a
displacement controlled analysis of a sub-model. An example of sub-modelling is the
assessment of the containment pressure of a blast wall. Typically the stiffened or corrugated
plate is represented by shell elements. A sub-model of solid elements is employed in order to
assess whether or not the ultimate resistance of the welded connections has been exceeded.
The converse of displacement driven sub-modelling is to use the results from a few lower level
analyses, such as those carried out to find the deformation capacity of connections and welds,
to define member performance standards applicable to the higher level analysis.
In order not to overestimate the ductile capability of members, it is very important that the finite
element analysis takes due account for all the potential buckling modes. As a consequence
the mesh density need not only to be fine enough for apparent convergence, but need also to
be sufficiently fine to represent all the dominant local buckling modes. Sufficient fineness can
be obtained by dividing each structural element susceptible to buckling into at least 6-8
elements across the width. Furthermore the analyst may have to introduce imperfections or
destabilising loads in order to trigger numerical buckling.
For large assemblies it is not practical to make the mesh fine enough to pick up all the
buckling modes. Hence the individual structural components need to be checked until the
analyst is satisfied that all potential failure modes have been accounted for.
Regarding meshing it is also considered to be good practice to keep the aspect ratio of the
elements as close to unity as possible, and only to gradually change the sizes of the elements
in the mesh. Post processing tools can play an important role when investigating whether the
meshing is adequately fine.
The spatial and temporal distribution of strain rates and their adverse influence on the reaction
forces need always to be considered when performing a plastic analysis.
When analysing structural components it is usually assumed that the pressure time history is
uniformly distributed over the surface. However when carrying out a global structural analysis
the ability to describe non-uniform loading, which also varies in time, is often required. Blast
loading should at all times remain normal to the surface of components undergoing large
displacements.
The analyst should recognise and possibly need to include the fact the structure is in a state of
static equilibrium at the time of blast loading. Ignoring the service loads when calculating the
blast resistance will not necessarily be conservative. Permanent loads associated with heavy
equipment are best modelled by transferring the load through discrete fixing points, which can
be mutually constrained. Other service loads are included using a smeared approach.
In general the explicit method is best suited for the analysis of blast loaded structures, where
the transient responses are to be measured in tens of milliseconds, and large plastic
deformations develop. The primary reason being that the explicit algorithm requires relatively
little computational effort in each time step since no formal matrix factorisation is necessary.
Implicit methods on the other hand are essentially static codes running in time domain, and will
as such require much more memory and disk space. The degree of non-linearity of the
problem makes the larger time steps permitted in the implicit codes of little practical value.
Another advantage associated with the explicit codes is that they have an inherent ability to
initiate most of the local buckling modes.
The most severe limitation for non-linear finite element modelling is the dependence on low
level performance standards, which in general means that a significant amount of time may
need to be invested in setting up the models and interpreting the results. However in most
cases the reward is a more cost efficient design.
Isolated columns and beams will be loaded by drag or dynamic pressure loads which are only
important near vents and are often much less than the overpressures. The method of load
calculation is discussed in the context of piping and vessels in Section 8.10.
Issue 1 May 2007 Page 333 of 493
FIRE AND EXPLOSION GUIDANCE
Other mitigating effects including scale effects, the limitation of reaction loads by secondary
member capacity and the effects of dynamics and plasticity are discussed in this Section.
Finally these effects are discussed in the context of modified code checks in Section 8.9.5.
The simplest factor, which affects global primary structure response, is the scale factor or
coherence factor. The following cases are given only as an illustration of the scale effect. The
precise geometry of the target structure and the loading pattern will change these conclusions
and a detailed assessment of these factors should be made depending on the scenario
considered.
Considering the situation of a pressure disturbance travelling along a wall or for a ridge of
pressure travelling across a deck, the pressure disturbance is considered to be a pulse
travelling with a velocity of about 340 m/s (the speed of sound C0 in ambient conditions,
neglecting convection with the gas flow) giving a length scale of the disturbance ‘ld = td x C0 of
about 17 m for a 50 ms pulse. A typical bracing member or panel of length ‘l’ equal to 8 m will
hence see a peak averaged pressure of 0.75 of the peak. A module wall of length ‘L’ equal to
35 m will see a peak averaged pressure of 0.25 of the peak value.
This indicates a scale factor of 1/3 on the global load/member load for this situation. In
situations where a large deck is considered these conclusions may only apply locally as the
pressure loading pattern may be circular or irregular in shape.
Often the direction of the loading on the primary framing may be changed locally due to panel
membrane effects. These membrane loads may be balanced globally if panels of similar
dimensions are attached to either side of the columns.
If a member has a td/T ratio of 0.2 for example, and a ductility of unity is required (elastic
response) then the static resistance to load ratio is about 0.6 and the member will resist
(dynamically) a load of 1/0.6 = 1.6666 times the member resistance. For elastic response the
dynamic amplification factor for this case is 0.6.
Values above 4 may be reached for structures with long natural periods (large frame
structures or compliant structures). The allowed ductility will depend on the applicable
performance standards. A ductility level blast performance standard could well allow a ductility
level of 10 for decks and beams.
As an initial screening process, this approach can be used before further checks and analyses
are carried out, particularly if the overpressures are not high (say, less than 0.5-0.6 bar). The
checks can be carried out with some relaxation on the design yield strength which is normally
based on a guaranteed minimum value and an allowance for the increase in the yield strength
due to strain rate effects. Allowing for strain rate effects will extend the elastic range and this
needs to be considered in the buckling checks. Also, the forces at the connections will
increase, and their adequacy will need to be re-considered.
Checking primary structure against the SLB (in the case where the load is 1/3 of the DLB) will
often size the members for the DLB. Experience suggests that the Primary structure will not
experience the full overpressure loading as the loading acts first on secondary members,
barriers, cladding and plate [8.25, 8.4].
Unity or utilization checks to the appropriate standard (e.g. AISC) may be re-interpreted to
reflect the reserves of strength in the structure.
When compared with a Ductility Level Analysis this approach often results in a less efficient
and heavier structure. These methods will not be suitable for the analysis of a situation where
a fire has preceded the explosion unless allowance is made for material weakening and
geometric imperfections and permanent deformations resulting from the fire.
Blast resistant structures and their supports are designed to respond in a ductile way to
explosion loading mainly in bending. The shear behaviour of structures at their supports and in
the joints of the primary frame will also affect the utilization factors derived in the code checks.
The safety factors implicit in the code checks will be different from those associated with
bending. Shear strains at supports should generally be limited to the elastic limit.
Additionally, for a dynamic situation these shear forces will be quite different from the values
obtained by static analysis as a result of the inertia forces acting on the structure. The benefits
of this effect are exploited in blast wall design, as the support or reaction loads may be less
than the applied overpressure load. Plastic deformation of a blast wall also has the effect of
limiting the reaction loads on the supports.
For a loading duration near the natural period of the member the shear forces could be higher.
Checks should be made where this is likely using a dynamic amplification factor based on the
ratio of load duration to natural period (see Figure 8.1).
• The explosion event is an accidental event and hence the stress may be allowed to
approach yield. A factor of 1/0.66666 (1.5) is then appropriate on the allowable
utilization. Alternatively the yield stress may be enhanced by the same factor to allow
for non-linear relationships for some aspects of utilization factor calculation.
• The material strain rate effect will generally give an increase of yield stress of the order
of 20 %, this value is used in the nuclear industry [8.36]. This value may be higher
locally, in particular in high strain regions of a blast panel. A factor of 1.2 may be
applied to the acceptable utilization or to the yield stress.
• Strain hardening will occur around regions of local plasticity. Where it is appropriate
(for tension members, plastic sections in compression and/or bending) allowance may
be made for this by taking the design yield strength as the ultimate tensile strength
divided by 1.25 (Section 3.5.8 of the IGNs [8.2]).
• The occurrence of plastic hinging may be taken into account by factoring the
acceptable utilization factor by the ratio of the plastic ‘Zx’ to elastic section modulus
‘Sx’. This factor is generally greater than 1.12 and will be in the range 1.1 to 1.5. The
member must be able to sustain the formation of a plastic hinge before buckling, i.e. in
tension or be a ‘plastic’ section.
As discussed above shear checks should also be made using the correct dynamic reaction
loads with strains being limited to elastic limits.
Taking into account all the factors above gives a possible acceptable utilization factor of
1.5 x 1.20 x 1.25 x 1.1 (a factor of 2.5) for a tension member. Usually the benefit of both strain
hardening and strain rate yield strength enhancement is not taken into account.
The recommended acceptable utilization factor is hence 1.5 x 1.20 x 1.12 = 2.0 for primary
members acting in bending and/or compression under explosion loading so long as the
member does not buckle where local buckling is not acceptable. Discussions of buckling
checks for members working beyond the elastic limit can be found in the literature [8.28, 8.29].
It is stated in Kato [8.29] that semi-compact and compact sections may be designed using
code checks without supplementary local buckling analysis up to the formation of the first
hinge.
The above approach assumes a working stress approach is being used for primary framing
design. The limit state approach may also be used with the equivalent elastic load level for the
DLB (the dimensioning explosion load) derived from consideration of the differing partial safety
factors suitable for the ultimate limit state and elastic limit state. Further discussions of these
topics can be found in work by Walker et al [8.4, 8.25].
Non-linear and dynamic analyses became commercially viable for even small design houses
at component level using PC based software. Finite element packages enabled single degree
of freedom solutions to be improved, through consideration of support stiffnesses and axial
membrane resistance. Single component assessment could be expanded to the consideration
of panels or complete walls and decks. The influence of penetrations could be addressed and
the detrimental effect of local stiffening on global ductility became evident.
A common misunderstanding in the design of blast walls is the relationship between the
design overpressure and the strength of the wall, interpreted through its stiffness. In the
mitigation of explosion loads, the key consideration is the ability to absorb energy through
ductility, and the delay of peak response to a time where the load has dissipated or reversed.
The inclusion of penetrations and local reinforcement for the support of piping or equipment,
will introduce hot spots in terms of stiffness, which may reduce the explosion resisting capacity
of the wall. The deformation of the wall, when subjected to explosion loading, may also violate
the integrity of any attached pipework or equipment.
In brownfield reassessments of explosion resistance, simple linear elastic designs are often
reviewed using non-linear, dynamic techniques to identify additional capacity without the need
for reinforcement. The capacity of a blast wall or deck, in terms of explosion loading, is limited
by its weakest component. This could be the situation where the connection is made by means
of a weld with a 5 % strain limit, as compared to the 15 % strain limit of the parent material.
In some situations, making a wall more flexible may increase its ultimate capacity to resist
blast. Removing or revising over-stiff details, say by making a heavy column base pinned
rather than fixed, may allow the development of plastic hinges throughout a wall and through
greater overall deformation before key component failures. Later response may exploit the
benefit of the suction phase in the loading.
Many different blast simulations may be required in order to generate a realistic envelope of
responses for specific details. A balance has to be reached between the extent of the model
and the level of detail in order to be cost effective. Inclusion of small details, such as
penetrations and stiffeners, may not influence the global response and thus becomes
irrelevant for a global model. Application of point masses at deck level at primary model nodes
may also be sufficient to achieve an acceptable accuracy for vertical dynamic response.
Elevated masses may be required for significant items of equipment or vessels where
rotational effects may be important and local horizontal loads are present.
Major pipework may need to be modelled if it could influence the dynamic and explosion
response of the structure, particularly if it has been detailed in such a way as to provide an
explosion resistance load path between decks via pipe supports.
Rigid boundaries for panel assessments are not necessarily conservative if the operating
condition deformations are not considered. The sensitivity of the explosion capacity to
deadweight and operating load should be addressed, as should the sensitivity to residual
fabrication deformations and stresses. Welding residual stresses should also be considered in
connection assessment, especially if key components are limited in capacity by the 5 % weld
strain limit. The weld geometry needs to be addressed for ultimate capacity calculations,
especially in fillet welded details, as a considerable portion of the total capacity of a connection
may be absorbed by secondary loads generated by eccentric load paths.
An advantage of global models is the ability to visualise modes of mitigation, which may
otherwise not be apparent when focussing on individual components or panels. Tying long
span decks together to limit the deflection under heave is a means of limiting damage to
equipment and pipework, which would otherwise suffer consequentially from large
displacements. The loading required for design can be extracted from a global dynamic
analysis which incorporates the ties, the ties affecting the dynamics of the deck girders. Care
must be taken in detailing, however, in order to prevent operating loads being transmitted into
the ties.
• Differential pressure;
• Differential movement;
• Strong vibration;
Areas remote from, or physically separated from, the areas with the direct explosion risk
should also be assessed for these actions if there is a potential consequence to personnel
safety or integrity of safety critical systems, including personnel escape provision.
Issue 1 May 2007 Page 338 of 493
FIRE AND EXPLOSION GUIDANCE
Dynamic pressure loads are discussed in Section 6.11 and are potentially the most severe
design loadings on equipment, vessels, pipework and cable trays.
Differential movements may generate significant loadings where adjacent supports respond in
a differing manner to an explosion. For instance, a vessel will be supported from the deck of a
module, but pipework connected to the vessel may be supported from the roof of the module.
In an explosion, the deck and roof will deflect in opposite directions, imparting loads on the
vessel nozzle, potentially triggering a further hydrocarbon release, which could be catastrophic
in terms of escalation of the event. Similar effects could be seen with pipework connections to
equipment and with pipe branches; or where supports are positioned either side of stiff deck
elements leading to support rotations in opposing directions.
Loose items subjected to blast wind, components that break free of their supports as a
consequence of explosion loading effects, or fragments of equipment or vessels generated by
the break-up of those items in explosions all have the potential to become missiles which can
then impact other equipment, vessels, pipework or critical electrical and control systems. The
potential for loose items to become missiles needs to be controlled by good working practices;
the potential for items to break free and become missiles, or for vessels and pipework to break
apart and become missiles, needs to be controlled by design.
The dynamic response of the vessel or equipment on its support steelwork is fundamental to
the reactions that are generated. Very stiff supports will generate high reactions; flexible
supports will generate lower reactions, however, too flexible a support condition may not be
tolerable for operational reasons, or retaining continued integrity following an explosion event.
Too much allowable movement may also contribute to vibration modes of failure for
connecting pipework.
In most circumstances, the critical explosion loading effect on a vessel will be a lateral loading
or overturning effect on the supports. For “brown field” reassessment cases, this may be well
above the design loading magnitude, as the design explosion loading would have been on a
par with the accelerations allowed for in the transportation or earthquake scenarios. Under the
higher explosion loadings now prevalent, this may no longer be the case and modification of
the vessel supports may be required. As discussed above, support strengthening may lead to
an increase in the support reaction, so modifications should be carefully assessed. Often a
linear elastic design may be demonstrated to have adequate ultimate capacity if re-assessed
using non-linear dynamic techniques, with full use of material certificates.
The vessel should be considered rigid in order to develop support reactions, but the
uncoupling of loads onto the deck steelwork needs to be considered in conjunction with the
deck loading from explosion. A simple SDOF solution may not be appropriate, whereas simple
NLFEA would be.
For equipment supported on Anti-Vibration Mounts (AVMs), this could mean retention of lateral
stops or shear keys, which would otherwise be removed after the transport and installation
phase. The deck plating or under-deck bracing must be assessed for adequate resistance to
A similar approach to the large vessels discussed above can be taken for the support
reactions and the response of the under-deck steelwork.
Differential movement between adjacent supports, whether at a pipe branch, transition from
deck to roof support or between modules must be accounted for when considering explosion
loading. It may well be prudent to design the first support from a pipe branch as a structural
fuse, in order to prevent a line from breaching under explosion loading.
Explosion loading assessments should not be restricted solely to oil and gas lines, but must
also include deluge pipework, as these are Safety Critical Elements for potential fires following
explosions.
Pipe runs on F(P)SOs are designed to accommodate significant movement due to vessel
flexing. Safety critical pipework on fixed structures in regions of significant potential movement
due to explosion loading, should have the same considerations.
Given the problems associated with developing a time-domain loading for a complete pipe run,
an appropriate test for robustness would be to consider each pipe span as simply supported
and use either a Biggs’ SDOF approach or a static load solution in a standard design pipe
stress analysis.
The tension capacity of the piping dominates the response and a pure plastic resistance may
be assumed for the pipe span with the mid point deflection being the relevant response
variable. Plastic hinging soon occurs at each end of the pipe when the pipe may be assumed
to be simply supported.
If the pipe supports are attached to beams of similar section properties then the differential
movement of the deck under an explosion should not be a problem.
If the structure and SCE’s appurtenances have been checked for a safety level or Ductility
Level Earthquake loads following API RP 2A 9th Edition (Section 2.3.6e.2) [8.26] or a later
version, then the ‘strong shock’ response to explosions need not be checked.
In the Cullen document [8.38], it was reported that ‘a number of witnesses spoke of the severe
vibration associated with the initial explosion. People were thrown off chairs and knocked
over’.
Once the force is calculated it may be applied to a dynamic global platform structural model.
The displacements and accelerations at points on the topsides may then be calculated. These
accelerations are potentially damaging to essential safety systems such as:
One further consequence of shocks of this kind is that pipe runs between modules may be
stressed due to relative displacements between modules. This would be particularly important
in Safety Critical Elements, e.g. for the fire water main.
For a fixed platform the integrity of the substructure should be checked against out of balance
explosion loads.
For elastic response of the jacket, a dynamic amplification (or reduction) factor may be
calculated from the ratio of load duration td to the natural period T or extracted from the curve
given in Figure 8.2. A reduced equivalent static load may then be derived which can be
applied to the fixed platform computer model.
Typical dynamic reduction factors of the order of 0.05 may apply in which case problems with
the substructure are unlikely. This load case may then be eliminated from consideration, on
the basis that the equivalent static loads on the substructure are smaller than those induced by
waves and currents.
Floating, tethered and moored installations are unlikely to suffer serious response to this form
of loading because the natural period in the horizontal direction is much longer than the load
duration.
Awareness of strong vibration is therefore essential in the design and protection of safety
systems used for emergency shutdown, emergency power, communications, fire protection,
deluge pipework, fire and gas detection, HVAC, EER etc. Systems which some may consider
not to be “Safety Critical” also need to be assessed for strong vibration loading: e.g. grating on
escape routes, stair towers, module stools. Such systems are fundamental to the safe
evacuation of personnel from the facility and strong vibration or blast wind loading may be the
governing design load case.
Control and instrument cabinets in utilities areas, which are protected from the direct influence
of explosion loading, should be assessed for the risk of toppling by strong vibrations. Battery
racks should have a retaining bar across the front of each shelf. Even book shelves in critical
areas such as the Control Room should be assessed for the risk of displaced objects, which
may fall and damage control panels or cause injury to key personnel.
Walkdown is now a commonly used tool to perform a qualitative assessment of the risk of
damage from strong vibration [8.37].
• The assessment of fires and explosions should be used to determine the need for a
system.
• Systems should be resourced with regard to the risks from the particular hazardous
event being addressed and their role and importance in reducing that risk.
• Mitigation systems should be specified after taking into account the contribution
from the detection and control measures in reducing the extent and duration of the
hazardous event.
• Systems should be selected and specified after appropriate consultation with those
responsible for their use and operation.
• Systems which may introduce a new hazard, exacerbate an existing one or impair
the performance of another system should be avoided or the interaction should be
addressed. These drawbacks must not offset the risk reduction provided by the
system, i.e. there should be a significant overall benefit.
The provision of some systems may eliminate or modify the need for others and may affect the
quality of other related or supporting systems. The result of the joint effect of contributing
systems should dictate the selection and specification.
Systems should be chosen with a full understanding of the likely hazardous events, their
means of escalation and the realistic expectation of the capability of the systems when new
and after some time in operation.
The selection of an appropriate combination of measures in a new design will require the
interaction of both designers and the Operator/Owner so that the relative contribution from,
and dependence on, procedural measures and engineered systems is fully assessed and
understood by all involved.
In the case of existing installations, all the measures should already be in place but the relative
dependence on engineered systems and operational measures should be understood by
those responsible for the maintenance and operation of systems.
Factors to be taken into account in the selection and specification of systems include:
• the functional role of the system and the suitability of that system for the fulfilment
of that role;
• limitations that the systems may place on operations and vice versa;
• any adverse effect that the system may have on hazards or other safety systems.
In specifying a system, it may be appropriate to specify the type of fire or explosion, the
release and combustion conditions or particular characteristics such as:
For Fires:
• flame temperature;
• heat flux;
• flame velocity;
• type and concentration of products of combustion.
For Explosions:
• overpressure;
• pressure profile;
• drag force;
• missile velocity or energy.
Where practical, the system suitability should be verified by representative testing. Care
should be taken when extrapolating results or basing a design on a purely theoretical analysis.
The choice of a particular type of system should primarily be based on the list of parameters in
Section 9.2 for selecting the system. These parameters should be assessed for the full
lifecycle of the system taking into account the effects of the environment and site conditions. In
considering the applicability, the ability to operate, maintain and repair it should be given equal
consideration to the initial cost and ease of installation. Systems should, where possible, be
simple and robust to enhance their long term effectiveness.
These should be identified and, where necessary, either an alternative safety system selected
or measures put in place to address the interactions. Interactions include:
• increased numbers of leak points and breaches of containment due to the addition
and testing of process safety systems;
• corrosion caused by the system; for example due to deluge system testing or
increased by passive fire protection;
• corrosion due to increased saline exposure resulting from free ventilation and open
venting to reduce explosions;
Where a system has to detect, extinguish, suppress or protect against one or more particular
hazardous event, it should be specified so that it is effective for all these events.
The time taken to detect an event should also be taken into account in determining the
systems overall response time.
Once activated, the time during which a system is required to operate in order to fulfil its role
should be defined. This will normally be until the hazardous event is adequately reduced or
personnel have been moved to a place of greater safety.
9.3.3 Logic
The initiation and activation logic should be clear. There may be a range of escalation paths
and the sequential activation of parts of a system or other supporting systems should ensure
suitable operation in accordance with the defined protective role. As well as ensuring actions,
the controlling logic can also prevent actions until certain others have taken place.
Flow rates should include an allowance for losses during the application of the fluid, for
example, wind blowing the fluid away from the fire, loss of deluge water due to thermal effects,
or losses after application such as gaseous extinguishing agent leakage from an enclosure.
Concentrations should consider the sensitivity of the required percentage and whether mixing
would be effective. There should also be a specification of duration of the chemical additive.
For example, fire-fighting foams may have adequate additive for say, 30 minutes but the
systems would be expected to continue to deliver firewater after the additive had been used.
System components should be suitable for long term exposure to the environmental and
operating conditions either through their design, material qualities, their protective coatings or
enclosures.
9.3.8 Survivability
The exposure of parts of control or mitigation systems to a hazardous event is identified by the
assessment process. The need for that system to survive the event should be determined by
examining the likelihood of the system failing and the frequency and consequence of the
escalation without its contribution. Safety systems such as ballast control systems on a floating
installation should also be considered. Survival is particularly important where that system is
specifically needed to continue counteracting the hazard during and after the event.
2. by constructing the system so that it has sufficient inherent resistance to withstand the
event;
Issue 1 May 2007 Page 348 of 493
FIRE AND EXPLOSION GUIDANCE
3. by shielding the system with fire or explosion protection;
4. by providing redundant components which are widely separated so that sufficient parts
of the system remain operable.
Where protection is provided, the characteristics and severity of the event should be defined
and the system or enclosure designed to withstand it.
Systems provided to protect against those hazardous events which make the greatest
contribution to the total risk level will generally need a high reliability or availability to ensure
that they perform the necessary functions when required to do so. Where there is a heavy
dependence on a single safety system to reduce the risks from a particular major accident, it
may be appropriate to consider duplication of the system to reduce the likelihood of failure on
demand.
3. By applying a generic classification such that the systems are ranked in accordance
with industry practice, standards and codes or by internal company standards.
The ranking of systems may be variously described as Safety Integrity Levels, Criticality
Ratings or Safety System Categorisation. These ranking systems should ensure an expected
probability of success.
All system components should have a proven reliability which may be demonstrated by
appropriate representative inspection and testing during design and manufacture.
The design should integrate the components into an effective system which achieves its
functional performance standard throughout its life. There should be clear design responsibility
for the whole system where components and sub systems are sourced from different suppliers
and different parties carry out parts of the design. All parties involved in the design should be
competent and have a clear understanding of the purpose and functional requirement of the
whole system. Systems should not be over complex or enhanced with features which are not
essential to the fulfilment of the role. Adequate integrated operating and maintenance
information about the whole systems should be provided for the operator in order to overcome
failures due to lack of understanding.
The whole system should be commissioned and subject to full representative testing of the
functional parameters to verify that it fulfils its role and will continue to do so throughout its life
providing it is maintained and tested to a given schedule.
There should be clearly defined limits for the periods when a system may be out of
commission. In some cases, it may be appropriate to have duplicate systems, initiate a plant
shutdown or curtail hazardous operations whenever a system is not available. In others, it may
be appropriate to set a maximum continuous period when a system may be disabled or a
maximum cumulative downtime over a given period such as a year. It may be appropriate to
set controls on hazardous activities in areas covered by the safety systems which are not
available, or to provide contingency measures as alternative cover.
Issue 1 May 2007 Page 350 of 493
FIRE AND EXPLOSION GUIDANCE
Where the functional performance of the system may be impaired by activities in the area, the
limitations should be identified and assessed. Where necessary, controls on hazardous
activities or contingency measures should be considered.
With automatic systems, the probability will depend on the reliability of the detection and of the
interface logic and the connecting systems. Where practical, full functional actuation tests
should be carried out between detectors and the system. Where this is not practical,
representative tests of all the links and the logic of the system should be undertaken.
For manual action the probability will depend on; the availability and capability of personnel at
the time of the initial event, the reasonable expectation of their performance in an emergency,
other duties which they may have to perform and accessibility to the actuation point in the
emergency. Where such actions are critical, they should be documented in emergency
procedures, competent personnel should be specifically assigned to the task and the actions
and responses simulated in exercises.
9.5.2 Duplication
Duplication will need to be considered for those systems where it is unacceptable to continue
operations when a system is wholly or partially disabled. This may be as a result of planned or
unplanned maintenance/repair and may also result from other actions linked to the event. A
review of credible scenarios should be compiled to identify linked events and failures.
Duplication is likely to add significantly to the system cost and complexity but may also add to
the vulnerability of the system as well as increase the exposure of personnel due to increased
maintenance demands. It should only be used where the reliability and availability of a single
simple system is deemed inappropriate for the function and risk requirements.
In some cases, a system may have a variable demand, for example, firewater supply. With
multiple pumps, there may be effective duplication for smaller incidents but the total capacity
may be needed for larger events. In these cases, this should be fully documented and, where
necessary, analysed, to ensure that the systems can deliver the required functional
performance for the different events and provide adequate availability and reliability for the
frequency of the particular events.
9.5.3 Diversity
Diversity is the provision of different type components such that they are not vulnerable to
single similar failure mechanisms. This overcomes common mode failures associated with one
manufacturer, design or maintenance activities.
Diversity would normally only be considered if there was a total dependence on one system to
prevent a major accident and a very high reliability was required from that system.
This section seeks to compile guidance on existing best practice for a two-pronged approach
to fire protection i.e.
1. Designing the process systems to minimise both the occurrence and the severity of
fires.
2. Designing effective fire protection systems to detect, control and mitigate the residual
fire risk following all reasonable efforts to minimise fire hazards through good process
design.
Section 2 provided engineers with the under-pinning principles of designing out problems and
reducing risks early in design, where significant changes can be made relatively cheaply. This
assumes that sufficient time for creative thought and corrective action is allowed in the project
schedule. Failure to provide time and resource for this can result in the need for very
expensive fire-protection systems or failure to meet risk targets without extensive QRA input
and/or remedial design.
There is a legal obligation in the UK to base decision-making for health and safety on risk
assessment. Project managers need to understand that risk assessment is not a one-off
activity but a continuous process throughout the design process. Failure to do this courts a risk
of missing safety or financial targets and having difficulty demonstrating ALARP.
Risk assessments do not always have to be complicated, quantitative, or time consuming, but
should be appropriate to the problem being assessed. Targets for risk are set at the beginning
of a project, but the desired information for QRA (where justified) is generally not available
until later in the design. Thus early decisions on concept and layout have to be based on
‘quick estimate’ assessments.
It is important that design decisions are taken in the light of an understanding and assessment
of “the Cost” vs. “the Risk Reduction” in order that the justification can be recorded for the
ALARP demonstration. If this process is followed, it is far less likely that problems requiring
expensive solutions will arise when the final QRA results for the installation are produced.
There will always be a trade-off between cost and safety. Senior Management is responsible
for approving new projects or major modifications and may ultimately be called to account for
their decision.
1. Can this installation be built and operated to make a reasonable profit with an
acceptable level of safety?
2. Does the project documentation fully record the basis upon which the decision to
sanction the project was made?
Senior managers will look to their project managers, who will in turn look to their discipline
engineers for the detailed back-up to support the sanction decision. One of the aims of this
section is to highlight to both project and discipline engineers the extent to which they can
influence the type of fire hazards and well as the effectiveness of the fire management
measures within the design effort.
Each of the following stages of the design process should include scheduled safety reviews
appropriate to the information available at that particular stage of the project schedule.
At concept stage there will be only very basic well information, production flow rates, vessel
inventories, utility requirements and layout data, so that only very basic comparisons can be
made. In addition, it must be recognised that there is always a balance to be struck between
safety, cost and practicality. The discipline of recording the basis for the concept selection
forces project teams to ensure the balance of cost vs. safety is appropriate and in line with
Company Safety Policy. If the cost of the safety facilities necessary to maintain the safety of
any proposed concept within acceptable bounds makes the installation unprofitable, then that
concept should be rejected.
Key items to consider at concept selection stage are to ensure that the wells, risers and
process equipment are located such that;
• Potential escalation paths are minimised where possible within the confines of the
layout, and certainly concerning the TR and evacuation facilities?
• Future risers should be considered where at possible, for example, gas lift risers
can provide a considerable hazard in later years of operation as the reservoir
pressure declines, but may not have adequately considered in the original design.
• The flammable and toxic inventories should be minimised to reduce the duration of
release and fire scenarios.
• The balance between designing for fire hazards and explosion hazards (also see
the discussions in Section 4) is logical and consistent. For example, enclosed or
partially enclosed modules containing process equipment present serious fire risks
but are more readily managed through a mixture of ventilation control and fire
protection. Open module design facilitates better dispersion and dilution of released
gas or vapours and provides less containment for explosion overpressure
generation.
• The full range of fire hazards have been designed for, for example, considering
fires on the sea surface, external flaming effects and associated fire sources (e.g.
shuttle tanker fires during offloading from F(P)SOs).
• The range of supporting equipment that will be active over the installation lifetime,
for example identifying where cranes, boats and drilling rigs will be required to
operate and ensuring that pipelines, risers, wells etc. are located away from areas
of high activity.
• Where cranes, boats and drilling rigs will approach or operate in relation to
pipelines and risers?
The outcome of the review should be presented in a discussion meeting so that engineers and
managers can understand how the options were compared. In this way, the benefits of each
concept can be adopted to improve on the chosen selected concept. The less effort put into
control of fire at source at concept stage, the higher the likely cost of the fire protection
systems found necessary at a later stage in design.
As a general rule, large installations with complex process plant can expect higher leak
frequencies so an understanding of all the fire escalation issues should be a focus point right
from concept selection. These installations also tend to have a higher POB.
It is now known that heat build up from fires in confined modules is both more severe and
more rapid than was appreciated in the 1990s if a sufficient supply of air continues to be
available. A key finding of recent research work is that fires from even relatively small
hydrocarbon releases (around 1 to 3 kg s-1) in enclosed or partially enclosed modules can
generate a layer of very hot gases (temperatures in excess of 1000 °C) in the top few metres
of the module within a few minutes of ignition. Structural failure, damage to high level process
and safety equipment and smoke and flames reaching well beyond the module boundaries are
all realistic consequences to be considered.
• Avoiding placing process equipment capable of sustaining severe fires into partially
enclosed modules,
• In open modules, analysing where the heat, smoke and flame will go, and
designing in the light of this knowledge,
• Ensuring that all structure potentially exposed to high heat loads is analysed for fire
resistance,
• Ensuring that all vulnerable and critical structures are adequately protected by PFP
or the structural concept changed,
• Providing very high deluge application rates, very rapid activation systems,
extensive protection to high level support structure and blowdown facilities to
control escalation if managing fires within enclosed modules (noting that this my
lead to higher costs),
• Providing high deluge application rates and wider coverage in open module design
if several adjacent areas (vertically as well as horizontally) could be initiated at
once,
• Providing for the rapid removal of inventory and high levels of protection against the
high heat loads at ceiling level where enclosure of process plant is unavoidable.
On large installations, personnel can rapidly distance themselves from a major fire incident.
The TR and evacuation points can be far enough away to allow safe evacuation, provided the
decision to evacuate is made early in the escalation sequence. Evacuation risks on small,
open, gas installations can sometimes be acceptable because of low production rates, very
simple process or small inventories. Small, single jacket installations with complex process
plant however need extremely close attention. Where wells, risers, process and blowdown
facilities are all in close proximity to each other, to the TR and evacuation points, an
innovative, well-informed design is needed to make them safe. In such cases, separation of
personnel from the fire and explosion hazards via an accommodation jacket or mobile unit
should be seriously considered despite the increased costs.
Some normally unmanned very small gas satellite platforms in the Southern North Sea have
ended up with relatively high risk levels and ‘minimum facilities’, based on the philosophy that
the installation would only be manned for an absolute minimum time. The high risk stems from
the fact that these are small open installations with minimum safety features, and ignited gas
jet fires are large in comparison to the installation footprint. There is limited shelter for
personnel before or during evacuation. Such installations need to have lower risk targets to
take account of satellite team personnel who may spend their time visiting a succession of
similar facilities. The platform-specific risk becomes high, although not excessive if viewed in
isolation. However the cumulative individual risk for satellite team members becomes high.
Issue 1 May 2007 Page 356 of 493
FIRE AND EXPLOSION GUIDANCE
Once the design concept is selected, and a basic layout proposed, a layout review should be
undertaken. Optimising the layout with regard to fire potential can minimise the likelihood of
release, ignition, and the subsequent impact on exposed equipment, critical systems or
personnel.
The layout fire review should be a multi-discipline activity, as a minimum, addressing the
topics and associated considerations listed in the table below. Given that no two installations
are alike, there will be many variations on the list of issues to be covered. The table is
intended to highlight key considerations to be addressed. If such layout issues are not
addressed until late in design, improvements are far more costly to implement.
The table below covers the review of the platforms normal operational phase. The objective is
to explore whether the locations of key items which contribute to fire safety can be improved
without incurring disproportionate cost.
Separate, shorter layout reviews should be considered, with appropriate discipline attendance
for other stages of the installation lifecycle (e.g. installation, commissioning, major drilling/
workover programmes, decommissioning etc). This would ensure that key layout
considerations for other lifecycle phases are not missed.
• Raise alarms, shut down and isolate plant rapidly on fire or gas detection,
• Provide the facility to remove all significant hazardous inventories from the fire zone
quickly without local manual intervention,
• Optimise design of multiple escape routes and muster areas to ensure POB reach
a place of greater safety with minimised risk for the hazardous scenarios identified,
• Ensure full emergency evacuation can be achieved under all weather conditions
and wind directions before the incident escalates to a platform-threatening event.
Evaluation may be delayed, particularly on large installations, due to the need to
carry out search and rescue operations for personnel not appearing at muster.
Partial evacuation may be initiated. This may impact on TEMPSC numbers and
locations.
• Develop draft fire and gas detection and protection philosophy documents,
identifying the goals of the key SCEs for fire control i.e. how is each release or fire
scenario prevented, detected, stopped or controlled;
• Clarify the fire areas and location of fire walls with respect to plant and the TR;
• Decide what types of passive and active fire protection best suit the fire scenarios;
• Design egress routes including stairways, ladders etc. to the sea, TR and
muster/embarkation areas;
• Review the isolation and blowdown systems to minimise the fire impact and
escalation potential (a number of reiterations of the design may be needed);
• Carry out FEED stage HAZID and HAZOP reviews, identifying new fire related
issues as well as other safety issues.
European Standard EN ISO 13702:1999 [10.1] entitled ‘Petroleum and natural gas industries –
Control and mitigation of fires and explosions on offshore production installations –
Requirements and guidelines’ provides more guidance on layout, control systems, protection
and mitigation systems, EER arrangements and inspection, testing and maintenance issues
for the various systems.
NORSOK Standard S001, Rev 3 2000 [10.2] entitled ‘Technical Safety’ and its annexes, also
give the requirements for layout, structural and process design safety, fire and explosion
protection arrangements and communication systems.
• A range of fire scenarios and sizes – particularly from high pressure areas;
• The impact of operation or non-operation of ESD valves;
• The impact of operation or failure of the water deluge system;
• High risk areas - where escalation might result in a short time, near escape routes,
where impact on Safety Critical Systems may occur, where structural integrity might
be affected;
• Transition to other events – escalation to a larger fire or potential for an explosion.
If this assessment suggests that the risks are well understood and broadly acceptable, then it
is likely that the installation is falling into the Type “A” category of UKOOA Framework for Risk
Related Decision Support [10.3]. Otherwise, a more detailed analysis is warranted. This may
mean using mathematical models, (which should be validated against a wide range of large
scale experimental data), to predict spatial and time varying fire behaviour and thermal
loading. More sophisticated calculation techniques could also be used to predict the response
of vessels and structures impacted by these fires. Additional preventative and mitigation
measures may need to be considered and a detailed QRA undertaken.
This stage of design presents many conflicting issues to be resolved. Realistically, design
decisions affecting safety have to be made by balancing the risks, and this has to be done on
a project timescale. This is only possible where the risks are openly discussed between the
various disciplines affected and the project management. Some of the common fire-related
issues for each discipline area are outlined in the sections below.
Key structural supports (or vessel hulls in the case of floating installations) either need
protection against the remaining fire effects or the provision of redundancy in the design. The
effects on the structure of external, as well as internal flaming in confined but ventilation
controlled modules must be assessed. The escalating fire effects can lead to progressive
collapse of the topsides.
Structural redundancy, whilst costly in the short term, has other longer term benefits e.g. for
collision protection, reducing inspection or protection against long-term structural degradation.
Locating process pipework inside structural supports should always be considered carefully as
overpressure from releases or explosions, or heating by fire could cause rapid structural
failure.
An open design of platform with appropriately designed fire and blast walls to segregate
process and drilling areas from safer areas with higher occupancy is preferred. Wherever fire
scenarios within enclosed modules are identified, early failure of structural items in the roof of
the module is predicted unless passive protection and/or a very high rate of deluge application
is provided. The times to structural failure and the consequences in the absence of protection
should be investigated between the structural engineer and the safety engineer.
The structural design must provide for rapid egress and escape of personnel from the process
areas to sea or to the TR. Space allowance for a diversity of escape routes is essential.
Escape routes should be based on stairways not ladders. The routes must take into account
all the different fire scenarios.
Where large inventories are still retained in sections of the process train following ESD,
systems to remove hydrocarbon inventories such as blow-down, dump to flare, cold vent or
surge/storage vessels should be considered. These systems introduce other risks and these
need to be balanced for every design. The options considered and the basis for the provision
(or lack of) of safety facilities should be documented as proof that ALARP has been achieved.
Process items exposed to severe fires (defined as confined pool fires or fully engulfing jet
fires) should be designed and provided with protection in accordance with the Energy
Institute’s “Guidelines for the design and protection of pressure systems to withstand severe
fires” [10.4].
Fires fuelled by 2-phase releases are harder to control than simple pool fires; modelling
2-phase releases is not a precise science and the output from proprietary software codes
should be managed with great care. The designers of blowdown systems must recognise that
the biggest hazards are the liquid inventories which sustain high release pressures for more
than 5 or 10 minutes. This has little to do with existing design codes which require pressure
reduction to half design pressure or 7 barg within 15 minutes [10.5]. Identifying the transition
point at which spray releases change to liquid releases (resulting in simple pool fires as
opposed to pressurised oil-spray fires) and designing the blow-down system accordingly, is
key. Typically, this transition point occurs at around 7 barg for oil and 4 barg for condensate.
There is some evidence that in the presence of general area coverage (of at least
12 l min-1 m2 with medium velocity nozzles) the transition point pressure could be raised to
around 15 barg for oil and 10 barg for condensate, but at the time of writing, the published
research is inadequate to develop proper design methodologies.
Production chemicals can cause leaks and fires as well as adverse health effects during
handling. Chemical data sheets should always be reviewed for potential contribution to
platform fire risk.
• Locating key isolation, pressure relief and blowdown valves away from fire effects or
else adequately protecting them.
• Ensuring that where valves are quick acting and fail-safe, protection may not be
necessary, but the designer needs to examine the fail-safe mechanism (with input from
the instrument engineers) to ensure they are truly fail-safe under all fire scenarios.
Duplication of solenoids or steel enclosures for control cabinets may be necessary to
achieve the required reliability within the heat-up timeframe. This information should be
documented within performance standards for the equipment.
• Developing the protection options based on a clear understanding of the fire effects.
• Considering pipe and valve support arrangements at high levels within modules to
minimise potential escalation. The consequences of failure where rapid and severe
heating is a significant risk should dictate the protection requirements.
• Considering the balance between minimising sources of release and allowing safe
isolation and access for intrusive maintenance. Areas with a concentration of potential
release points in close proximity to high inventory process plant require close scrutiny
to see how the risks can be reduced through re-arrangement, use of high integrity
flanges, use of integral block and bleed valves, shielding, grating floors, etc. Areas
susceptible to vibration or sand erosion should be similarly considered.
• Ensuring that failures emanating from piping runs, piping and vessel connections, small
bore tappings etc. do not present jet or pool fire hazards to less-obvious targets, for
example, pipe flange joints in line with safety critical control panels or utility systems,
non-process flammable inventories etc.
• Checking the design of safety critical control systems for common mode failures which
cause releases, ignite releases or could occur as a result of fires.
• Considering the consequences of rapid heating causing simultaneous failure of all mid
to high level instrumentation in modules which may suffer from prolonged fire
engulfment. Where this will lead to catastrophic or extreme events, reducing risks to
ALARP may still be achieved through more rapid, higher rate water, failsafe design,
better redundancy, or managing the heat build-up by altering the module openings.
• Identifying and eliminating instrument tappings which can be prone to fatigue failure in
the presence of pipework vibration and unsupported instrument loads. The fatigue
damage and subsequent failure can occur very rapidly.
• Fuel gas lines should be designed to tolerate failures at the HP/LP interfaces in the
system.
• The design of the fuel gas system should minimise inventory in the system and
minimise routes through process areas or areas of high mechanical damage risk.
Provided proper maintenance and condition monitoring takes place, serious mechanical
failures of rotating equipment, leading to projectiles and serious fires are rare. The system
design should make system shut down as soon as it deviates from its safe operating envelope.
Early intervention allows the situation to be brought back under control.
Escalated fires inside any enclosures, given some air ingress, can be severe. Lube-oil or
diesel fire produce smoke which migrates to other areas. The layout should take into account
the possibility of sudden mechanical failure and smoke generation and locate enclosures
where such events are less likely to escalate to process fires.
Electrical equipment can provide a source of ignition in the event of a process hydrocarbon
release. Detailed design should minimise the risk of hydrocarbon releases coming into contact
with uncertified electrical equipment. However, the open design of process modules allows
migration of large gas releases.
The location of non-certified electrical equipment in open deck areas should be either avoided
or adequately justified, for example by gas dispersion modelling.
During a fire event, main power generation usually switches over to emergency arrangements.
Often initial emergency power is from diesel and then ultimately by battery power, shedding
non-essential loads at each stage. In a major fire event, UPS and dedicated batteries provide
power to communications and essential shutdown/process/F&G data, life support and
evacuation systems. Batteries can only supply power for a limited time. The design must be
compatible with the fire, emergency response and evacuation timescales. The power for each
fire pump is usually independently supplied. The location and redundancy arrangements need
to be designed to meet so far as is reasonably practicable the fire (and other) scenarios and
how they could be influenced by interaction with the weather.
The effect of power loss on the operation of all safety critical items should be reviewed very
early in detailed design.
It is important that the value of gas detection remaining functional following an incident is
realised in the design and the ER arrangements. To provide the response teams and
operating teams with adequate information to plan responses and ultimately to investigate
safely the pre-cursors to the accident are extremely valuable.
Generally, flammable gas detectors should be located throughout the process areas and
locations such as:
Plus the location of the gas detectors should take into account:
• Leakage sources within the area and areas for potential gas accumulation;
• Access for maintenance and calibration of the detectors (so that they retain their
performance standard);
The aim of the detection systems should be considered carefully, that they detect the events
postulated for the installation and act as a coherent component of an overall fire hazard
management strategy. An illustration of how this approach supports safety is in the increasing
use of improved smoke detection in accommodation areas. The traditional protection method
for accommodation units was to supply sprinkler systems, in line with onshore hotel practice,
however investigations have shown that there can be significant smoke generation without
much heat in small smouldering fires of nominally domestic material. The potential for injuries
arising from smoke inhalation is significant. An alternative strategy has been to improve the
sensitivity of smoke detectors and enforce a “no smoking” policy within the accommodation,
thus implementing a preventative strategy.
Newer technology applications such as acoustic gas detectors are available and these will
detect leaks regardless of whether ventilation systems or open modules disperse the leaked
material. Current acoustic detection equipment can be shielded against turbine, compressor
and air tool sourced ultra-sonic noise. In addition, there are also fibre optic laser devices
available that are calibration free and non-energetic.
• The maintenance load of the safety equipment adds risks to the maintenance
crews (as has been found in the UK Southern North Sea on NUIs).
Nevertheless, manual fire fighting facilities (e.g. hydrants, hose reels and fire extinguishers)
are often provided in all areas to permit rapid intervention on small fires or to support the
rescue of injured or trapped personnel.
Fixed active fire protection systems are based on firewater pumps feeding a firewater
distribution network, the network can be supplemented by foam-concentrate systems (tanks
and pumps feeding a foam-concentrate distribution network). Some areas, notably helidecks,
will also have monitors and hydrants to provide adequate coverage. In addition, where
appropriate, (in areas such as control rooms), total flood gaseous or water mist extinguishing
systems can be used.
The passive fire protection arrangements (PFP) will take the form of structural barriers,
insulation or fire retardant coatings and will be used to protect walls, decks and structural
members. They should be used to protect against defined credible fire hazards that are
capable of causing failure, and should take into account the fire size, duration, location and
intensity. Passive protection measures will often be used in critical areas where the assumed
100 % reliability of PFP is required. Refer to Section 4.4.2 for further details.
• Use of process pressure by operators to ‘blow down’ liquids to the closed drains
system should be forbidden unless the system is specifically designed for this
practice;
• Accommodation and sewage drains should be independent from any other drains;
• Drains capacities must take account of the vessel inventories in their specific areas
and the effects of bund systems.
10.2.5.11 HVAC
HVAC has a key function in dispersing and controlling gas and vapour releases, for example,
preventing gas clouds from coming into contact with ignition sources or diluting toxic releases
such that they pose a lesser hazard to personnel. There are key design features that enable
the HVAC systems to achieve these roles, some of these are listed below. It should be noted
that with such functions that the HVAC systems will be designated as Safety Critical Elements:
• Locate HVAC intakes optimally with respect to gas releases and fire scenarios.
• The continued operation of the HVAC system may be required to be safety critical
(for example, for a control room within a process module following a gas release).
Suitable safety measures to protect the system and ensure its continued function
and survivability will be required.
• Ensure that personnel installing safety systems (PFP application, valve installation etc)
are competent and properly supervised;
• Ensure installation personnel have easy access to the design engineers so they can
check out any reservations/problems they have during installation/commission;
• Use checklists, punch lists etc to ensure all items are finished, tested and properly
handed over to operations.
• Operational and maintenance staff and contractors based offshore will take over the
operation and maintenance of the safety systems. Supervisors must be given an
overview of the fire scenarios and the design intent of the safety systems. Offshore
supervisors are under considerable time pressures offshore. It is not reasonable to
expect them to absorb this information from the risk assessment documents and the
Safety Case is unlikely to provide the level of detail required. Without this essential
background, there will be a potential for work permit approvals or on-site risk
assessments to miss important issues.
• The fire and explosion scenarios and the escalation time-frames must be captured and
incorporated into the platform-specific emergency response plans. Scenario-based,
platform-specific emergency response exercises should be carried out periodically
throughout field life. The quality of these exercises will depend directly on the quality of
the engineering input.
Some changes can be properly planned as they are regular and predictable, change-outs of
OIMs and supervisors are frequent and it easy to track and enforce the maintenance of skill
levels (if not knowledge levels), by providing new personnel with the same (or better) level of
training as the original personnel.
The design philosophy for fire protection systems has changed over the last decade and a half
from being code-based to scenario-based. The design of a fire protection system for any area
of the installation must now be shown to be appropriate for the potential fire loads and
resultant consequences. This is a very different approach from the code-driven approach
where water deluge requirements were set for different parts of the installation. This ‘one size
fits all’ code-based approach is no longer acceptable. The design process must start with
understanding the type of fires, the period for which they may persist, the time-line for all the
potential fire escalation events, times to structural failure and effects on escape and
evacuation of personnel.
Once the fire and its interaction with the safety of personnel and the preservation of the asset
is understood, the most appropriate combination of active and passive fire systems to achieve
the necessary degree of protection can be considered. Generally, the use of passive
protection is preferred over active protection, due to its inherent reliability. On a typical
platform there may be several different active protection systems (including manual fire
fighting equipment) plus different types of passive protection. These measures are discussed
further in the next section.
The table demonstrates how the protection has to be specific to the requirements of a number
of differing fire scenarios. Recent research on deluge systems has emphasised the importance
of this approach. Potentially there are 3 main roles for deluge:
3. Cooling of the high hot zone through interaction with the combustion process
These approaches require totally different design philosophies and one “catch-all’ design for
deluge systems cannot achieve them all.
Firewalls
The design of firewalls is moderately well understood. They should be designed to a specific
fire rating compatible with the fire scenario for which they offer protection. Due consideration is
needed for any deflection of flame by the firewall, plus the movement of the smoke and hot
gases that accompany the flame. Products of combustion do not disappear when they
encounter a firewall but build up or migrate. All firewall ratings and the extent of the firewall
whether jet fire rated or only A0 rated, should be indicated on the appropriate drawings. The
design basis must be clearly recorded for future reference; otherwise justification of worthwhile
future changes becomes difficult. Penetrations and doors must be designed to the same rating
as the firewall itself.
Firewalls are often provided for area segregation. On many installations combined fire and
blast rated walls divide the process areas from the wellbay and the wellbay from the utilities
and accommodation areas giving multi-barrier protection across the platform from the high
hazard process end to the low hazard accommodation end. This strategy is simple and
effective when designed in at concept stage. Blast walls with superimposed PFP must be
assessed for the integrity of the PFP following deflections of the wall during an explosion.
TRs, accommodation and control room wall are usually fire-rated. The rating must be defined
by the potential fire exposure. On NUI platforms where TRs are often very small, they may be
located behind a firewall segregating the open process areas from the enclosed units such as
the control/electrical room and TR/day room. It needs to be large enough to provide real
protection. Smoke and radiant heat effects around the edges of the wall and the effect on
people leaving the TR to evacuate the installation must be considered in the design.
Firewalls are usually composite items consisting of a structural part and an insulating part,
both parts need to retain their integrity for the life of the installation. Discussions of firewalls
and other PFP can be found in Section 3.2.8.
Mesh screens
These reduce heat radiation on escape routes by approximately 50 %, provided the flame is
not actually impinging on the route. They are frequently used to protect open stairways. They
are cheaper than firewalls and offer less protection but have their place for gas jet scenarios
provided good diversity of escape routes is available.
Whatever the design basis, the redundancy in the structure and the consequences of failure
during a fire should be explored in discussions between the structural or marine engineers, the
safety engineer and the designer of the passive fire protection system. Derivation of fire
loadings and response of steelwork to fire attack is covered in Sections 5 and 7 respectively.
Attachment systems for the PFP must be given detailed consideration in view of the cycles of
expansion, contraction and flexure experienced by steelwork in offshore applications.
Disintegration and separation of heavy PFP cladding materials from walls or other structural
supports is still causing problems on existing older installations. Likewise retrofitting of PFP
offshore e.g. externally to the underside of TRs on small gas platforms has proved both costly
and temporary.
High pressure gas jet fire impingement on PFP, particularly of the early intumescent epoxy
type has been found to cause rapid degradation of the material. PFP systems are now
available which are resistant to jet fire attack. Where jet fire impingement is likely, and could
be sustained for more than a one or two minutes, type-testing of the selected PFP system
should always be specified. A jet fire test standard has been developed in the last few years
based on industry research and at time of writing is becoming available as a draft ISO
standard (22899-1) [10.8]. A jet fire rating equivalent to an A or H rating has been proposed in
the latest draft version of the ISO, (based on the jet fire test criteria proposed in ISO 13702
[10.1]) that is, type of application / critical temperature rise (ºC) / type of fire / period of
resistance (minutes).
Floating structures have a different structural design basis (widespread use of integrated,
stressed skin designs) to that for a fixed steel jacket with modular topsides construction.
Where fire or explosion in these areas is catastrophic the possibility of occurrence should be
designed out, rather than reliance placed on protection systems. For this reason pipework
containing process hydrocarbons should be avoided inside support columns or pontoons
unless they can withstand the predicted fires/explosion overpressures.
All PFP applications must take account of the need for periodic inspection of key parts of the
underlying structure. This can be catered for by providing inspection hatches. However, it must
be emphasised that PFP integrity must be sufficient to prevent the ingress of water and
subsequent corrosion under the insulation and that the application of inspection or access
points must not degrade the “water-tightness” of the PFP.
The main concern with PFP on vessels is that it makes NDT of the vessel difficult. Given that
ongoing corrosion monitoring is an essential feature of most asset integrity programmes this
has been seen as a major drawback. Removable PFP is sometimes used, but this is
susceptible to water ingress under the cladding and can lead to external corrosion. Also it can
become custom and practice to leave large parts of the vessel bare of cladding for long
periods for ease of inspection (especially where the vessel is already known to suffer corrosion
problems), thus reducing the availability of the protection.
Where the primary concern is BLEVE protection, and given that it is the gas space of the
vessel that needs protection rather than the liquid space, recent ideas are that cladding may
not need to be provided to the base of the vessel, to obtain the BLEVE protection. This is
because the liquid inside the vessel provides protection against rapid heat-up of the vessel
walls. This should be subject to careful analysis and understanding of liquid levels under all
process conditions.
As noted above, the integrity of “water-tightness” of PFP is a key issue and loss of water-tight
integrity has been found to generate problems of accelerated corrosion on ageing installations.
There is an added issue with piping and vessels where there is the possibility of temperature
cycling, condensation may accumulate under the insulation. Inspection points will be required
to monitor such systems.
Water tightness of risers is a key issue when the PFP goes down to the “splash zone”, issues
of water ingress are added to potential damage by wave action.
• High costs because they usually have to be have to be custom designed to suit the
duty, the size and the location;
• Additional loads, they have to be designed to resist explosion overpressures for the
particular area and on some installations the potential for wave-slam has also to be
considered;
• In-situ installation may be complicated by access problems, although for new build
projects this can be done early, before access problems are created;
• They have to be removable or otherwise designed to allow entry for essential repair
and maintenance.
• The design also has to take into account that after repair/maintenance the unit will
have to be restored to its original design specification. The costs of proper re-
instatement offshore throughout field life need to be considered from the outset of
design.
Such systems tend to be rated for short-term protection e.g. 5 or 10 minutes. Thus, they can
give useful protection where inventories are small, or rapidly blown-down. With respect to
enclosures, they must be re-instated after every disturbance for maintenance/repair/inspection
by personnel who have been suitably trained for the task. It should be noted that offshore
inspections indicate that they are easily damaged and repeated removal and re-wrapping
tends to damage their fastenings but that their use is successful if trouble is taken to ensure
proper fixing and re-fixing. The key issue is to ensure that the wrap is securely and properly
fastened, otherwise it may come off or be damaged in an explosion and hence not be able to
provide the required fire protection during any subsequent escalation.
Drain design must take into account the interaction and disposal of both the fuel and the
deluge release. Where drains are critical for fire hazard management, they must be designed
for easy inspection, maintenance and testing so that their performance standard is always
met. Offshore drains are susceptible to blockage and the design should aim to minimise this.
The deluge application rates recommended in view of the findings of both the above research
and earlier Norwegian research into the characteristics of confined hydrocarbon fires, are
summarised in the following table.
Reference should also be made to Section 5.2 for further discussion on the issues of deluge
rates with respect to different fire types.
For fires giving free flame volumes in the order of 25 % to 35 % of module volume, there will
be widespread and simultaneous heat input to the top half of the module. This has implications
for safety systems, structural supports and process equipment (especially the tops of process
vessel which could suffer a BLEVE) located at high levels in most process modules.
Hydrocarbon fires generate a very hot layer, of partially burnt gases a few metres deep at
ceiling level from releases of a relatively small size (with a burn rate from around 1 to 3 kg s-1)
in enclosed modules, whether partially or fully ventilated. This occurs for any hydrocarbon fire
whether all gas or all liquid. However non-pressurised liquid releases burning as pool fires are
much easier to control by deluge than fires fuelled by 2-phase pressurised releases.
The layer of hot gases can reach 1000 ºC within a few minutes if the fire is sustained for that
period. Tests have shown that dry deluge systems can be destroyed by the heat prior to their
operation; designers should consider some of the following issues in their design
requirements.
• Safety control components and systems should not be vulnerable to damage from heat
build-up effects while they are in operation;
• The risk of structural failure at ceiling levels should be taken into account;
• The design of deluge systems should recognise and mitigate the consequences of
these scenarios, that is;
• Provide systems that deliver the necessary deluge rates as fast as possible;
• Provide mechanical support systems that will not fail before the deluge brings the fire
under control;
• Consider installing fine spray deluge specifically to cool the top few metres of ceiling
space.
Once the flame volume in the module exceeds around 25 % of the module volume, it is very
likely that flame and smoke will occur beyond the confines of the module such as at the
locations of any openings in the module walls. When the flame volume reaches 100 %, most
of the combustion will be taking place beyond the confines of the module as the partially
combusted hot gases reach a source of oxygen. This effect exposes other areas to fire and
can also set off the other areas’ deluge systems, thus potentially reducing the fire protection to
the source module. The design of the deluge system and the structural protection must
consider these escalation scenarios.
In general, with the exception of riser inventories, it is the liquid inventories that are capable of
producing and sustaining these high flame volumes after ESD and blowdown. Temperatures
close to the flame can be around 1350 °C, with heat fluxes in excess of 350 kW m-2. The
overall platform process design should remove the potential for large, sustained, pressurised
hydrocarbon fires, however, the combined design of deluge and PFP systems, to mitigate
against the remaining scenarios, may be expensive in view of the need to control the
consequences of such fires.
In unpublished reports of tests, it has been found that a deluge rate of 12 l min-1 m-2 for a
pressurised jet fire had little impact on hydrocarbon gas jet or spray fires, but did reduce the
heat fluxes at ceiling levels from around 300 kW m-2 to 200 kW m-2. Increasing the deluge rate
to 24 l min-1 m-2 reduced peak ceiling fluxes from 350 to 60 kW m-2, suppressed the flaming
considerably and changed the smoke from dense black to a grey mixture of steam and
entrained carbon particles. It is not clear whether these benefits arose because the water
droplets at the higher deluge rate were smaller, or because the water rate doubled.
In the same reports, the heat imparted to process vessels and pipework by an impinging sonic
gas jet flame was found to be little reduced by general area coverage of 24 l min-1 m-2. This
rate did however reduce the rate of heat input from an impinging simulated live crude
pressurised spray release. It was not possible to confirm whether this reduction was sufficient
to prevent eventual failure. Specific deluge at 10 l min-1 m-2 directed to the vessel using a
conventional array of nozzles, in conjunction with 24 l min-1 m-22 general area coverage
appeared to halt the rate of rise of the vessel surface.
Again, unpublished reports of tests have indicated that for vessels exposed to pool fires,
specific deluge coverage as per NFPA 15 [10.12] (10 l min-1 m-2) provided effective heat
exposure protection.
Fire pumps
Modern designs are based on an absolute minimum of 2 x 100 % fire-pumps, each capable of
supplying the entire system needs. On open design installations, especially where the deluge
is activated on gas detection, more than one or two areas may be set off simultaneously. The
redundancy within the pump configuration enables the platform to continue operating when
one pump is out for maintenance. A variety of alternative fire pump configurations
(e.g. 4 x 50 % pumps), are possible, based on analysis of vulnerability to fire scenarios, cost,
operating characteristics, maintainability, flexibility and system start-up reliability. ‘Cross-over’
valves allowing service water to be diverted for fire-fighting use can be useful, with appropriate
safeguards against reverse flow and over- pressure.
Fire pumps and their power units should be located diversely, in safe locations, in order to
reduce the possibility of a major accident event rendering the entire system inoperable.
Materials of construction must be suitable for the marine operating environment and the life of
the installation. Parts that may fail early should be identified in advance and spares held or
ensured readily available.
The pumps need to be independently powered as the platform main power generation system
is generally designed to shut down in serious fire and gas release situations. Modern pumps
are often electric submersible pumps, located in firewater caissons and powered by topsides
diesel-generator sets. Older pumps tend to be traditional diesel fire-pumps, taking suction from
pipes run inside firewater caissons, terminating below wave action depth. Start-up reliability is
crucial and can be a deciding factor in determining the number of pumps in the systems.
Although design is always for automatic start-up, back-up manual starting arrangements are
generally required and should be tested regularly.
Experience shows that fire pumps slowly deteriorate (i.e. they exhibit a gradual drop-off in
peak delivery capability) over the years, regardless of the fact they spend only a fraction of
their life in actual operation. They are started and discharged to hydrants or overboard dump
lines at regular intervals to prove their continued readiness for service.
One of the most important considerations for an offshore firewater system is speed of
initiation. To keep delays to a minimum, ring mains are filled with seawater and held at
pressure ready for immediate use; any significant drop in pressure, caused by a demand on
the firewater system initiates automatic start-up of the fire-pumps. To prevent pressure
fluctuations in the system causing frequent starts and stops of the main firewater pumps, the
pressure is held at around 8 to 12 barg, by a small pump (usually called a jockey pump)
supplied from the service water system.
Firewater ring mains are usually large-bore and contain seawater, therefore, they are not
lagged or heat traced. However in extreme winter conditions freezing is not unknown. As an
added precaution, many systems provide for a continuous slight circulation within the system
by dumping a small flow back to sea. The smaller pipework rising off the ring main is usually
lagged and heat traced.
In smaller firewater systems, dry ring mains are often used if the time taken for fire water to
reach deluge or monitor nozzles is acceptable. The use of dry ring mains eliminates corrosion
and freezing issues.
Ring-main and riser pipework corrosion is a major issue, thus Cunifer is the usual material of
choice for the wet parts of the system. Older platforms with carbon steel ring mains run the
two-fold risk of wall thickness loss and build-up of corrosion products throughout the system.
Designers choosing steel over Cunifer in the past for cost saving have passed the cost of
replacing or maintaining such systems onto operational staff working on a diminishing budget
ten or so years later. Linings or surface treatments for carbon steel ring-main pipework have
been used with mixed success. Corrosion inhibition can be used, but consideration must be
given to treating the dead-legs in the systems, such as the wet riser pipe sections between the
ring main and the deluge valves.
Composite materials such as GRP or specially developed fireproof elastomers have also been
used for firewater piping. These can possess significant corrosion, weight, flexibility and price
advantages. Key concerns for such alternative materials remain.
• Can they be properly installed, maintained and repaired in-situ (some need specialist
installation)?
• Will they melt in the event of serious fire attack, either before of after deluge water
reaches the distribution pipework and nozzles?
Hydraulic shock within the system can result either when main firewater pumps kick in, or
when deluge valves suddenly open. The shock can cause damage to the small-bore end-
piping in the system and its supports. It is important to consider and quantify this problem as
part of the design. Pneumatic dampers may need to be used. Slowing down the opening of the
valves is not a good idea if it means a delay in getting water through to the dry pipework.
Minimising the delay time is critical for 2 reasons:
1. The faster a fire is cooled the easier it is to bring under control and the chance of rapid
heat (and smoke) build-up is reduced.
2. The dry pipework and its pipe supports are mostly located high in the module and are
vulnerable to high temperatures. Small bore dry Cunifer or GRP pipe (depending on
the exact specification) may melt rapidly in a jet fire thus stainless steel or titanium
alloys would be preferred. Once water flow is established the pipework is provided with
internal cooling.
Firewater pipework supports are also vulnerable to heat and may be unprotected by deluge
application, thus they require careful design attention.
The time between detection and getting water to the region of the fire should be minimised.
Many new designs are capable of getting water to the fire within 30 or 40 seconds of detection.
NFPA 15 [10.12] sets a target of 40 seconds for response time. Research has shown that for
large fires severe heat build-up can occur within one or two minutes of ignition.
Some systems in current operation have to rely on regular flushing either with firewater or
potable water in order to control build-up of corrosion products, salts, powder deposits (in
some drilling storage areas), scales etc. This is expensive and time consuming, especially
where the requirement was never envisaged or provided for, without flushing, the system can
clog up but sometimes the regular flushing accelerates the rate of corrosion. Modern designs
now tend to use larger ‘self-cleaning’ nozzles, less susceptible to blockage. These bring
benefits in terms of higher water application rates but also imply larger pumps and bigger
supplies of expensive AFFF.
The grid of firewater nozzles covering a module or an area is designed to produce a specific
range of water droplet sizes The nozzles generally used for deluge are high or medium
velocity nozzles. The smaller the droplet the more likely it is to be evaporated or blown away
between emerging from the nozzle and reaching the fire. This is a particular issue for droplets
under 0.5 mm diameter and an important factor in more modern, open platform designs. The
larger the droplet the less affected by wind and the more water provided to the fire for cooling,
but the bigger the pump required. High velocity nozzles produce droplets over 1 mm diameter.
A large module may require a few hundred such nozzles for adequate coverage. The pipe
sizes may range from around 10” at pump discharge to 1” and 2” at the nozzles. A full
hydraulic analysis of the system is necessary to ensure the necessary water distribution
throughout the module will be achieved.
Periodic testing of active fire protection systems to ensure initial suitability and continued
compliance with the stated performance standards is mandatory in the UK.
Where firewater in a number of different zones could be activated almost simultaneously the
pumps need to able to meet that demand. The alternative is to attempt to manage the supply
so that it targets the right place by remote manual operation of valves or inhibition of a second
fire zone on activation of the first. Remote manual operation of valves in a fire situation is
problematic since it requires accurate feedback on the fire development to allow for decision
making plus the availability of a suitably trained emergency response and/or fire team. On
some platforms, neither may be available.
Reliance on local manual intervention to supplement the automatic fire system response has
to be realistically evaluated and only used where it does not expose the person(s) operating
the valve to danger from the fire/smoke. Huge firewater demands can be more easily avoided
with proper attention to:
AFFF, and other types of foam, work by creating a layer on the surface of the burning
hydrocarbon pool, cutting off contact with the air. This reduces the fire and smoke generation
significantly and may extinguish the fire altogether in some situations (e.g. bunded fires).
Foams, (sometimes) in combination with dry power applications are important for fighting
aviation fuel fires. The design of foam systems should take into account the effect of high
winds during application plus application must be possible from at least opposite quadrants.
Foams are expensive, especially in the quantities needed offshore. Good design of storage
facilities will avoid costly early degradation. Stored foam should be sampled and tested
regularly.
Foam are injected either just downstream of fire pumps or at deluge valve locations or directly
at the hydrant. Proportioning equipment of various designs, for injecting foam at the right
concentrations into the firewater supply, have proved unreliable in the past. The vendors of
such equipment should be asked to provide evidence of reliability and maintainability for their
systems and show they have a good track record in operation.
Water curtains
Water curtains have been used as a solution to reducing heat exposure of people on escape
routes, or critical plant items. Their advantage is that they do not exacerbate explosion
overpressure problems, but they have several disadvantages:
• The delay in activation means they are of limited use for immediate ignition
situations but could be useful in delayed escape situations;
• There is limited research, but water application rates for effective operation were
found in tests to be high, in the region of 25 to 40 l min-1 m-2;
• The attenuation of heat radiation by general area deluge is noted from research
work to be considerable. However at the time of publication there are no design
methods for calculating the personnel protection effect.
Ceiling cooling
Where there remains a possibility of heat build-up at the roof level within an enclosed or
partially enclosed module, which could still be the case on some existing installations, new
systems are becoming available specifically to reduce heat at high levels within the module.
These systems are based on heat-resistant rubber-type tubing that can be easily site- laid and
fixed to the structural beams. Being flexible they will withstand considerable deflection without
loss of function during an explosion event, and they do not suffer from the same corrosion
problems as steel-based systems. They generate fine water sprays which provide cooling
through evaporation of the water droplets. The steam generated also retards the combustion
process.
Manual systems on newer installations should be provided only where a legitimate specific
need has been identified (for example to cover temporary well test equipment on a top deck).
The protection will be suitable for the specific scenario and a team of trained and competent
fire or emergency response personnel are available to operate the equipment. The prime
example is provision of helideck fire-fighting equipment and personnel.
Hydrants and hoses or fixed monitors (often fitted with an automatic oscillating mechanism as
well as manual control) are still provided where overhead deluge systems are not practical e.g.
on drilling rigs to target water onto escape routes and well fires from a safe distance or for
protection of equipment on exposed upped decks where strong winds could prevent proper
deluge coverage. Manual hose facilities can also be useful in securing large unignited spills
with an application of aspirated foam
Manual fire fighting equipment – hose reels, trolleys and hand extinguishers
Manual fire fighting equipment such as fire extinguishers, fire hose-reels and fire trolleys are
still provided offshore for use by personnel in the event that someone discovers a small fire
which can be safely bought under control by manual means. The main change in provision of
such equipment in recent years is that:
• Small fires are less likely to be found and dealt with by a passing member of the
workforce, especially at night;
All of the above must be considered when deciding the appropriate level of manual equipment
to be provided.
The aims for detail design have been identified to enable co-ordinated best practice, such that
significant changes can be avoided late in the design process.
Conflicts between the requirements for different engineering disciplines will be identified, as
will the conflicts between explosion and fire hazard management or mitigation. Some areas
will be covered on a phase by phase basis, others on a discipline by discipline basis. The
readership is intended to be broad and the issues understood by all disciplines (engineering,
management, verification and compliance) through all phases of project development,
execution and operation.
• New build or modification – a new build project essentially starts with a clean sheet of
paper and thus has little or no constraints in terms of layout, materials or structural
form. An existing facility modification, by contrast, will have constraints in terms of
viable location, weight, layout, interfaces with existing plant, power, spares, materials,
accessibility and impact upon the existing Safety Case and HAZOP assessments for
the facility.
• Separation of process, drilling, utilities and accommodation – The process area usually
has the highest risk on the facility, in terms of explosion hazard, due to the high
pressures and the number of potential leak sources in the pipework, pressure
containing vessels and machinery. It is normal to distance the gas compression plant
from the separation vessels, where possible, to reduce the escalation risk for any
single event.
• Wellbay and drilling facilities – These also pose a high explosion risk, due to the
amount of flanged pipework required to connect the trees to the manifold and the
tendency of this pipework to move in concert with the conductors. The utilities area is
much less vulnerable to serious explosion hazards, but a risk is still present, for
example with fuel gas for power generation.
• Export route – The availability of a convenient nearby pipeline, with available capacity,
may determine whether export of oil is by tanker or pipeline. Gas is often flared,
exported by pipeline, re-injected into the formation for later export or increasingly
liquefied for transport. Excessive flaring is no longer considered to be an option in
many parts of the world, due to environmental considerations. The required pipeline
entry pressure will contribute to the compression requirements for the platform. The
degree of gas compression has a significant influence in the potential for leaks and the
resulting gas cloud sizes in the process area.
• Gas lift - The other factor in determining compression requirements is whether gas or
electrical submersible pumps are used for artificial lift of the oil. The gas lift lines are a
major potential hazard due to them being small bore, high pressure and subject to
vibration due to tree movement. A major hazard is also presented in the loss of
containment of the gas in the well annulus. Switching from gas lift to electrical
submersible pumps is generally not an option on existing installations, due to the
compressor design requiring a minimum throughput to maintain efficiency, for new
installations the electrical submersible pump option is much safer.
• Regulatory regime – Regulations vary in different parts of the world and cognisance is
therefore required of the relevant governing regulations for the installation location,
irrespective of where the design is executed.
• pipe-in-pipe risers;
• in-field pipelines;
• sub-sea storage.
Several of these elements affect topsides risks by impacting vulnerability to dropped object
hazards causing sub-sea leaks. The pipe-in-pipe solution requires the use of vents to control
leaks, in which the construction arrangement inhibits in-service inspection and repair. This
arrangement may be preferable to single skin risers for reasons of insulation to maintain oil
temperature.
• separation;
• cooling/heating;
• compression;
• sand entrainment;
• metering;
Water injection is included here as being associated with aquifer water and the pipework
contributing to process area congestion. Sand is primarily a source of vessel and pipework
erosion; water is the primary source of corrosion.
Vessel size is a consideration in terms of the quantity of the topsides inventory and the
potential for fueling a fire in case of rupture. Vessel size is also crucial in terms of reducing
pressures during blowdown. Smaller vessels may thus be more controllable in emergency
situations, but may be less efficient in operating terms.
The layout stage is important in the provision of adequate inspection and maintenance access,
selection of laydown and storage areas and mechanical handling routes between the laydown
areas and the relevant equipment.
11.2.5 Pipework
The initial pipework sizing and routing follows the layout process. Operational considerations
included here are: provision of fixed and spring supports; valve locations; flange locations to
facilitate installation and maintenance; material selection for robustness (wear control and
corrosion resistance). The key areas for explosion hazard potential are leak sources and the
magnitude of release, generally through mechanical connections but also associated with
corrosion, fatigue, erosion and human error.
• area congestion;
Local or remote control is significant in terms of manning levels within hazardous areas. The
Control Room layout is critical in terms of the potential for human error in crisis management;
information overload is now recognised as a cause of delay in response times.
Cabinets in hazardous areas need to be robust to withstand explosion loading and prevent
missile penetration. Instruments and their controls (valve wheels, handles, switches etc) need
to be accessible to minimise or eliminate the need for scaffolding or other temporary access,
hence reducing congestion, vent paths and potential missile material. A review of potential
standardisation of components is likely to lead to reduced human error.
The durability of components and software should be an important design consideration, along
with the potential for upgrade or expansion to accommodate future platform modifications.
The mixing of system types or overloading of components can lead to increased explosion
risk.
The same influences and design requirements apply to general pipework, but both the
blowdown and isolation systems require a very high integrity, reliability and survivability in
order to function safely. These systems can involve a large number of flanged connections
and isolation systems are associated with components that are regularly subjected to manual
intervention.
Reviews of blowdown system efficiency are also now considering sequenced blowdown as a
means of improving overall response time. Such reviews need to assess manual versus
automatic or semi-automatic shutdown of systems on high-level gas detection.
Considerations for reliability and robustness of systems include the use of double isolation
valves, high integrity seals, the attachment of small bore bleed pipework in double block and
bleed isolations and the selection of appropriate pressure relief valve devices.
Some operators have experienced a number of failures of bellows in balanced bellows type
relief valves [11.4]. An impaired pressure relief valve may fail to prevent an explosion or lead
to a sudden large toxic gas release in the event of rapid escalation of fire. Bellows failure may
be caused by valve chattering, incorrect material specification or pressure rating, incorrect
installation, incorrectly specified fatigue life or incorrect dimensional tolerances on the valve
seat and bellows manufacture.
Utility systems include: firewater deluge; seawater cooling; diesel and potable water tankage;
chemical storage; HVAC.
The design and routing of deluge mains is of primary importance in ensuring a robust system
capable of withstanding the Strength Level Blast and providing continued deluge coverage
outside the affected area in a Ductility Level Blast.
11.2.10 Layout
The equipment layout is usually based on good past experience and an awareness of design
details that can lead to problems with poor ventilation, congested explosion venting, blast wind
turbulence and high explosion overpressures. The finished layout may then be validated by
CFD modelling.
The other main layout considerations are: process economics; accessibility; pipework
protection; ventilation; congestion; escape routes; trip hazards; mechanical handling provision;
storage; maintenance access; growth provision; HVAC; cable trays; pipe racks; lighting;
communications.
The primary structural steelwork will often have been sized for other load considerations
(operating loads, installation or environmental) but blast walls will be sized for these blast
loads.
In the design of architectural features such as doors and windows in the LQ, whose failure
could lead to TR impairment, it is important to consider the negative pressure impulse
immediately following the initial high positive pressure impulse. The ability of doors and
windows to resist outward loading is generally much lower than that of inward loading due to
the construction details and assembly method.
• Spars
• TLPs
Some fixed steel platforms have diesel tanks in the legs close to the topsides; F(P)SOs have
storage tanks beneath the process modules; jack-up production facilities will have diesel tanks
in the side double skin or crane pedestal. Subsea oil storage is not considered to be an
explosion risk, however, such tanks will require vent pipework to control gas build-up and allow
tank purging.
Conductor and riser support is important in the control of flowline vibration topsides. Such
vibration can have a significant impact on attached small bore pipework fatigue, particularly
with gas and chemical injection pipework. The provision of pre-installed risers and J-tubes for
future satellite development can significantly reduce the explosion hazard associated with
construction activities on the topsides.
A robust sub-structure design will significantly reduce the explosion risk associated with strong
lateral vibration resulting from major boat impact hazards. Structural redundancy will ensure
adequate support to the topsides in the case of a surface pool fire, ensuring that gross
deformation of the topsides does not result, leading to secondary releases and explosion risk.
A comparative exercise is required to document the benefits and disadvantages of the options,
equating cost, risk savings, timescale, practicability etc. On brown field projects factors such
as lack of bed space and production downtime for modifications are significant factors in the
calculation.
The balance is thus drawn between the cost of lost production and the increased hazard
presented by more pipe flanges. If high integrity flanges are utilised, where the flange class
ratings are higher than required for the design pressure rating of the pipe, then the system
ductility will be tolerant of explosion loading and brittle modes of failure and flange leakage will
not result. With all piping systems the location of flanged joints must be considered in
conjunction with the selection of support locations, to avoid joints being placed at locations
where high ductility is required.
Nitrogen leak testing is recommended for all hydrocarbon pipework following new construction
and maintenance. Leaks can often be detected in existing pipework following a shutdown,
even where no intervention had occurred, as a consequence of joint relaxation upon cooling or
accidental mechanical impact.
The need for detailed dimensional surveys for pipework tie-ins at the hook-up stage is
demonstrated time after time. Reliance on “as-built” drawings has caused many project delays,
whereas a single visit offshore to confirm the accuracy of the recorded data would have
ensured a better fit-up and eliminated clashes with items not included on the referenced
drawing. The use of PDMS (Plant Design Management System), which integrates data from all
disciplines in a 3-D model, has vastly improved clash control, but as-built models are still rare.
The consequences of being ill-prepared at hook-up, in terms of explosion hazard, are that
piping joints are cold-stressed and on-site fit-up rectification is required for pipework or
structures that may involve hot work.
This section outlines the considerations used to arrive at a best practice design. These
considerations constantly change as new technologies, explosion behaviour or response
information becomes available.
Design has a big influence on the prevention of ignition. Hot surfaces, electrical equipment,
lights, and equipment earths are all fixed ignition sources that need to be designed or selected
with recognition of the potential explosion hazard. Selection of a higher specification, different
location or gas tight enclosure will reduce the ignition risk. Temporary ignition sources, such as
hot work or poorly earthed scaffolding or equipment, need to be eliminated or controlled, by
design and operating procedures. The need for a calm weather policy should be considered.
External ignition sources, such as ship exhausts, helicopters and lifeboat engines, also need
to be considered in the design process.
The subject matter in this category is very broad and needs to be addressed by simple,
generic guidance. Several of the measures are procedural, especially in the area of missile
limitation. The design based issues, whether green field or brown field, can involve
multi-discipline aspects, not just structural. Blast wall performance can be compromised by the
need for pipe transits, cable conduits and access manways. Blast wall capacity is not
necessarily related to stiffness but to ductility.
Equally important, the initial failure in the system may not represent the ultimate capacity, as
the failed component may be redundant. The consequence of component failures within the
collapse sequence must be appreciated. A weld failure along the edge of a blast wall may
enable release of gas or flame into a previous safe area, with a potential tunnelling failure
resulting. In other instances, say within a double skin wall, there may be no significant
consequence from first failure.
Corrugated profiles are commonly constructed from stainless steel due to its high energy
absorption characteristics and good corrosion resistance. Typical failure strains for ASTM 316
stainless steel are in excess of 50 % with ultimate capacities in the region of 600 N mm-2.
Pre-Piper Alpha, firewalls were used in situations where explosions were a possibility.
However these were not initially designed for the blast loads and many were constructed from
mild steel. Blast walls typically span from floor to ceiling and are normally provided by
specialist suppliers.
The behaviour of the wall is very much controlled by the web and flange slenderness limits,
the column slenderness of the wall, the flange to web ratio, corrugation angle and the end
connection details. It is important to be aware of the interdependence of some of the
controlling parameters such as the angle of corrugation which will control the degree of
restraint to the flange. Also the web/flange ratio plays a crucial role in controlling buckling of
the section. Previous research [11.5] on profiled flooring systems suggests a maximum value
of 1.5, although limited profiles were given which may not be appropriate for blast walls.
FABIG Technical Note 5 [11.6] provides guidance for web and flange slenderness limits based
on stub girder tests in order to classify the section. In traditional static design of typical
universal beam members in bending, codes give slenderness limits for web and flange
elements independently despite the fact that one provides restraint to the other. Extensive
validation work has been carried out to ensure designs based on this specification are
conservative with an effective width concept adopted to account for the actual stress state.
With profiled sections under blast loads there are little published data to provide the same
extent of validation for using these results. Also the web in this case is loaded by the pressure
providing a destabilising load. Technical Note 5 [11.6] also provides guidance on the selection
and design of profiled barriers, however, this reference deals with design criteria for
predominantly elastic wall profiles and recommends the use of NLFEA to provide performance
standards for ductility factors greater than 1.5 for plastic sections.
Double skin profiled systems have also been adopted recently where the skins were separated
by an air gap with the same profile used for both layers to allow for a blast occurring from
either side. One of the skins becomes sacrificial while the gap increases the standoff from the
explosion and impacts the second skin. The wall is designed to be flexible to allow much of the
energy to be dissipated in bending.
Stiffened panel blast walls consist of a flat plate stiffened by a series of vertical and horizontal
stiffeners and is supported by the main steel structure. For integrated decks the stiffeners are
continuous and are required to carry large service loading. As a result, they are likely to be
closed hat type sections. Although plates can resist high loads through membrane action, this
will be transferred to the main structure as an axial force and requires careful consideration,
particularly if the deck is carrying high service loading. Many stiffened panel walls have
connection details which minimise the transfer of high axial forces to the main structure for this
reason.
Where there is a need to assess the capacity of module walls and columns with in-plane loads
the effects of static loads need to be considered on the response of structural members:
Support details for any blast barrier are crucial to ensure that the integrity of the wall is not
breached during an explosion and must be detailed such that they are not the weak link. Walls
are normally attached at their top edge to the flanges of primary beams, normally allowing
rotations to occur such that large membrane forces are not developed. It is important to ensure
that any stress concentrations, which may not always be avoided, occur in the components of
the connection rather than the weld itself. The connection must be sized to transfer the
computed reactions and to assure that any plastic hinges can be maintained in the assumed
locations. They should be designed for a capacity that is greater than its supported member.
The bottom of the wall is commonly welded to a channel or angle section attached to the top of
the deck in order to allow for rotation to occur. In some cases the wall is welded directly onto
the deck which has no rotational flexibility, relying totally on the top connection for this.
Results from a JIP, which investigated tests on firewalls carried out at the Spadeadam test
site, together with numerical studies, have shown that flexible angle connections arranged in a
dog-leg configuration performed well in terms of energy absorption capability [11.6].
In situations where walls have limited clearance strengthening schemes which considerably
stiffen the wall have been adopted. Yasseri [11.7] has discussed a number of these, including
adding a facing plate (flat or corrugated) to the wall or the addition of an X-bracing or stiffening
in the form of a light grillage welded to the wall. However limiting the deflection of the wall
means less energy of the blast will be absorbed in bending which will attract high shear forces
at the connections. Stiffer walls also tend to exhibit more brittle failure modes.
Ideally no penetrations should be allowed in the wall as these are likely to reduce the available
ductility under blast loading. However, if they are required they should be located at the top or
bottom of the wall, or other locations where deflections will be a minimum.
For existing installations the problem is likely to be more complex, as there are likely to be
many penetrations including doors in some instances. These need special attention
particularly in relation to any likely stiffening which can introduce undesirable stiffer areas
which will attract high loads.
It is also necessary to define whether the service (the subject of the penetration) moves with
the wall or not. For instance, a large pipe can be regarded as a fixed object and the wall must
move relative to it. However, a cable has a degree of flexibility, and providing adequate
extension is available, can be anchored to the wall.
It has been suggested that internal ties, which restrict the differential movements between the
floor and the ceiling, may be incorporated into the design to enhance its blast resistance. The
ties must be designed so that do not carry any compressive loading occurring as a result of
operational loading or the explosion rebound of the deck structures. In order reduce local
loading effects the ties should preferably link the stiffer members of the deck structures.
In brown field modifications, the designer can assist with the continuation of existing safe
working practices and safety records by utilising, where appropriate, the same equipment and
material specifications as are already in use. In addition, the application of consistent sparing
philosophies and tool sizes as are in use for that installation will also aid operator use and
reduce the potential for accidents.
Inspection and maintenance procedures should be regularly reviewed to ensure that best
current practices are considered, whilst retaining the intended operating philosophy and
design intent. Inspection methods should recognise the function and defined performance
standards of safety systems and ensure that they are not compromised by their removal or
disabling during critical operations in order to repair or gain inspection access.
A UKOOA guideline [11.12] is in preparation that covers the lifecycle activities of bolted pipe
joints, including the critical aspects of system design, construction, maintenance and
operation. It will set out the principles of joint integrity management and provide examples of
best practice to assist operators in develop their own management systems. Training and
competency are significant contributors to successful safe operating practices and
demonstrate that good design alone is not sufficient where manual intervention is required with
hydrocarbon systems.
The recently published “Guidelines for the Management, Design, Installation and Maintenance
of Small Bore Tubing Systems” [11.13] records that "small bore tubing systems are the single
largest contributor to the incidence of process containment rupture in potentially hazardous
plants". As such, the adoption of these guidelines go some way to assuring the integrity of
tubing systems under operational loading, such as vibration, and should be adopted as a basis
for good practice for resistance to accidental loads, such as mechanical impact, which are a
further cause of releases.
At the time of writing, a joint UKOOA/HSE workgroup is to be set up to review general industry
best practice on flexible hose management. Shell’s flexible hose management system has
been offered as a starting point. This system utilises a risk matrix to categorise the
consequence of hose failure in terms of human injury, environmental impact and production or
equipment losses. An inspection and hose replacement frequency is determined by the hose
classification and performance standards for hose condition and competency standards for
operators have been established. All Shell installations have been reviewed for compliance
with this strategy.
Annex A References
A1 - References – Chapter 1
1.1 Selby C A, Burgan B A, ‘Blast and Fire Engineering for Topside Structures – Phase 2, Final
Summary Report’, Steel Construction Institute, ISBN 1 85942 078 8, 1998
1.2 ‘Offshore Installations (Prevention of Fire and Explosion and Emergency Response)
Regulations’ (PFEER), HMSO, 1995
1.4 ‘Offshore Installations and Wells (Design and Construction, etc.) Regulations’ (DCR), HMSO
1996.
1.5 ‘Petroleum and natural gas industries – Control and mitigation of fires and explosions on
offshore production installations – Requirements and guidelines’, 1st Edn. 1999, ISO 13702.
1.6 NORSOK, Guideline for Risk and Emergency Preparedness Analysis, Z-013.
1.7 ‘JIP - Gas build up from high pressure natural gas releases in naturally ventilated offshore
modules – Workbook on gas accumulation in a confined and congested area’, BP Amoco,
CERC, BG Technology, May 2000.
1.8 BS EN 1127-1: 1998 “Explosive atmospheres. Explosion prevention and protection”, BSI,
1998
1.9 HSE OTI 92-596: Oil and Gas Fires: Characteristics and impacts
1.10 HSE OTI 92-597: Behaviour of oil and gas fires in the presence of confinement and
obstacles
1.11 HSE OTI 92-598: Current fire research, experimental, theoretical and predictive modelling
resources
1.12. ‘Area Classification Code for Petroleum Installations’, Institute of Petroleum. March 1990.
(IP 15)
1.13 BS EN 60079-10: 2004 “Electrical apparatus for explosive gas atmospheres Part 10.
Classification of hazardous areas”, BSI 2004
1.14 Bennet JF, Cotgreave T, Cowley L T and Shirvill L C, Shell Offshore Flame Impingement
Protection Programme (SOFIPP): Parts 1, 2 and 3, Shell Research Limited, 1990
1.15 Review of the Response of Pressurised Process Vessels and Equipment to Fire Attack, OTO
2000 051, HSE Books, 2000
1.16 BS 5958: 1991: “Code of practice for control of undesirable static electricity”, BSI 1991
1.17 ‘Explosion assessment guidelines’, Genesis oil and gas consultants, report J6838 for the
HSE June 2001.
1.19 UKOOA Publication,EHS08 Industry Guidelines on a Framework for Risk Related Decision
Support, 1999
1.20 Wishart J. et. Al., ‘White paper – working group 2 – Safe design practice’, International
workshop ‘Fire and blast considerations in the future design of offshore facilities’, June 2002,
Houston Texas. http://www.fireandblast2002.com
1.21 ‘Hydrocarbon release reduction campaign’, HSE books, HSE OSD report OTO 2001 055,
HMSO 2001.
1.22 Successful health and safety management HSG65, ISBN 0 7176 1276 7, HSE Books 1997
1.23 Bleach R., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and
mitigation of explosions, CTR 104, Management of explosion hazards’, Genesis Oil and Gas
Consultants, August 2002.
1.24 API RP 75: Development of a Safety and Environmental Management Program for Outer
Continental Shelf Operations and Facilities, 3rd Edition, Product Number: G07503, May 2004
1.25 ISO 14001: 2004, “Environmental management systems -- Requirements with guidance for
use”, International Standards Organisation, 2004
2.2 FABIG, Technical note 3, ‘Use of ultimate strength techniques for fire resistant design of
offshore structures’, 1995
2.3 NORSOK, ‘Guideline for Risk and Emergency preparedness Analysis, Z-013, 2001
2.4 ISO 19901-3: 2003 Petroleum and natural gas industries – Specific requirements for offshore
structures – Part 3: Topsides Structure, International Standards Organisation, 2003
2.5 Offshore Technology Report 2001/055; OSD hydrocarbon release reduction campaign;
Report on the hydrocarbon release incident investigation project -1/4/2000 to 31/3/2001,
2001 ISBN 0 7176 2142 1
2.8 ‘Offshore Accident and Incident Statistics Report 1998’, OTO 98: 952, HSE, HMSO, 1998.
2.9 ‘Accident statistics for fixed offshore units on the UK continental shelf 1991–1999’, DnV for
the HSE, OTO 2002 012, HMSO 2002.
2.11 Offshore Hydrocarbon Releases Statistics And Analysis, 2002 - HID Statistics Report HSR
2002 002 – February 2003
2.13 “Handbook for fire calculations and fire risk assessment in the process industry”, available
from Sintef and Scandpower, (see www.scandpower.com)
2.14 Selby C A, Burgan B A, ‘Blast and Fire Engineering for Topside Structures – Phase 2, Final
Summary Report’, Steel Construction Institute, ISBN 1 85942 078 8, 1998
2.15 Cullen, The Public Enquiry into the Piper Alpha Disaster, Department of Energy, Report
Cm1310, Her Majesty's Stationery Office, London, 1990
2.16 Oil and Gas Fires: Characteristics and impact, OTI 92-596:, ISBN 011 882034 6, HSE
Books, 1992
2.17 Dalzell, G., FABIG Technical meeting – ‘Inherently Safer design’, January 1997
2.18 Alderman J.A., Carter D., ‘White paper – working group 1 – Philosophy and management
strategy’, International workshop ‘Fire and blast considerations in the future design of
offshore facilities’, June 2002, Houston Texas. http://www.fireandblast2002.com
2.19 ‘A Review of Potential Ignition Sources on Offshore Platforms’, HSL Report, FS 99/09.
2.20 UKOOA Publication EHS13, “Guidelines for Quantitative Risk Assessment Uncertainty” -
(Issue No. 1), March 2000
2.21 API RP75, "Recommended Practice for Development of a Safety and Environmental
Management Program (SEMP) for Outer Continental Shelf Operations and Facilities.",
American Petroleum Institute, 1993
2.23 Wishart J. et. Al., ‘White paper – working group 2 – Safe design practice’, International
workshop ‘Fire and blast considerations in the future design of offshore facilities’, June 2002,
Houston Texas. http://www.fireandblast2002.com
2.24 ‘JIP - Gas build up from high pressure natural gas releases in naturally ventilated offshore
modules – Workbook on gas accumulation in a confined and congested area’, BP Amoco,
CERC, BG Technology, May 2000
2.25 ‘Explosion assessment guidelines’, Genesis oil and gas consultants, report J6838 for the
HSE June 2001
3.2 IEC 61511; “Functional safety - Safety instrumented systems for the process industry sector”;
Parts 1 to 3, International Electro Technical Commission, 2003-2004
3.3 ISO 23251:2006 “Petroleum, petrochemical and natural gas industries -- Pressure-relieving
and depressuring systems”, International Standards Organisation, 2006
3.4 International Convention for the Safety of Life at Sea (SOLAS), 1974, International Maritime
Organization, Adoption: 1 November 1974, Entry into force: 25 May 1980
3.5 Walker S and Tahan N., FABIG (Fire and Blast Information Group) Article R139 - 'A Rational
Approach to Fire Consequence Assessment', Issue 9, June 1994
3.6 Recommended Practice for the planning, Designing and Construction Fixed Offshore
Platforms – Working Stress Design, API RP 2A-WSD, 21st Edition. API (American Petroleum
Institute), 2000
3.7 Bob Bruce, ‘The online offshore hydrocarbon releases (HCR) system’, Paper 11, ERA
Conference, ‘Major hazards offshore’, London, December 2003.
3.8 OTO 55 2001 Hydrocarbon release reduction campaign - Report on the hydrocarbon release
incident investigation project -1/4/2000 to 31/3/2001, ISBN 0 7176 2142 1, HSE Books, 2001
3.10 OTO 98: 952, Offshore Accident and Incident Statistics Report 1998, (Provisional Data), HSE
Books 1998
3.12 OTO 2002 012; Accident statistics for fixed offshore units on the UK Continental Shelf 1991-
1999, , ISBN 0 7176 2339 4, HSE Books 2002
3.13 ISO DIS (22899-1) “Determination of the resistance to jet fires of passive fire protection
materials -- Part 1: General requirements”, International Standards Organisation, 2006
3.15 Natabelle Technology Ltd, ‘Explosion Loading on Topsides Equipment: Part 1 - Treatment of
Explosion Loads, Response, Analysis and Design’, Health and Safety Executive Report OTO
1999 046, March 2000
3.16 Natabelle Technology Ltd, ‘Explosion Loading on Topsides Equipment: Part 2 - Treatment of
Explosion Loads, Response, Analysis and Design’, Health and Safety Executive Report OTO
1999 047, March 2000
3.17 BS EN 60079-10: 2004 “Electrical apparatus for explosive gas atmospheres Part 10.
Classification of hazardous areas”, BSI 2004
3.18 ‘Control of risks at gas turbines used for power generation’, HSE Guidance note PM84.
3.19 Bleach R., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and
mitigation of explosions, CTR 104, Management of explosion hazards’, Genesis Oil and Gas
Consultants, August 2002
3.20 Tahan, N., Nicholson, R.W, Walker S. and Tandberg, D. ‘The Design and Testing of a
Louvered Blast Relief System’, 3rd Intl. Conference and Exhibition - Offshore Structures
Design - Hazards and Safety Engineering, London, 15 - 16 November 1994
3.22 Walker S and Klair M, 'The Escalation Consequences of Accidental Shock Loads', 3rd Intl.
Conference and Exhibition - Offshore Structures Design - Hazards and Safety Engineering,
London, 15 - 16 November 1994
3.23 Morrison G., ‘Strong Vibration and Design for Robustness’ HSE - ERA Conference Offshore
Structural Design – Hazards, Safety and Engineering, November 1994
3.24 Evans J.A., Johnson D.M. and Lowesmith B., ‘Explosions in full scale offshore module
geometries – Main report’, (Phase 3A) HSE books OTO 1999 043, 1999
3.25 ‘Electrostatic hazards associated with water deluge and explosion suppression systems
offshore’, HSE books, OTO 95 026, 1995
3.26 ISO 13702: 1999, “Petroleum and natural gas industries – Control and mitigation of fires and
explosions on offshore production installations – Requirements and guidelines”, 1st Edn.
International Standards Organisation 1999
3.27 Tam, V.H.Y. ‘Barrier Methods for Gas Explosion Control, Safety on Offshore Installations’,
ERA Report, 99-0808, December 1999
3.28 FPSO Design Guidance Notes, Report no. VES06, UKOOA, March 2002
3.29 OGP F(P)SO Design Guidance for Marine Hazards, (under review prior to issue)
3.30 International Safety Guide for Oil Tankers and Terminals (ISGOTT), 4th Edition, Oil
Companies International Marine Forum (OCIMF)/International Chamber of Shipping
(ICS)/International association of Ports & Harbors (IAPH), 1996
3.31 “Offshore Loading Safety Guidelines: with special relevance to harsh weather zones”, 1st
Edition, Oil Companies International Marine Forum, 1999
3.32 UKOOA FPSO COMMITTEE Tandem Loading Guidelines Volume 1- FPSO / Tanker Risk
Control During Offtake, and Volume 2 - The Use of Towing Assistance for Tandem Offtake,
2002
3.33 International Convention for the Prevention of Pollution from Ships, 1973, as modified by the
Protocol of 1978 relating thereto (MARPOL 73/78), 1973, amendments 1984 to 2006
3.34 International Convention on Load Lines, 1966, International Maritime Organization, Adoption:
5 April 1966, Entry into force: 21 July 1968
3.35 Standards of Training, Certification and Watch-keeping Convention 1978 amended 1995,
(see http://www.stcw.org)
3.36 Convention on the International Regulations for Preventing Collisions at Sea, 1972
(COLREGs); International Maritime Organization, Adoption: 20 October 1972, Entry into
force: 15 July 1977
3.38 The Code for the Construction and Equipment of Mobile Offshore Drilling Units, 1989 (1989
MODU Code), International Maritime Organization, Adopted by Assembly resolution A.649
(16)
The 1989 MODU Code superseded the 1979 MODU Code adopted by Assembly resolution
A.414(XI)
3.39 The Offshore Installations (Prevention of Fire and Explosion, and Emergency Response)
Regulations 1995, Office of Public Sector Information, Statutory Instrument 1995 No. 743
3.41 “The offshore installations and pipeline works (Management and Administration)
Regulations”, HMSO, (SI 1995/738), (MAR)
3.42 “Policy and Guidance on reducing risks to ALARP in Design”, HSE web site
http://www.hse.gov.uk/dst/alarp1.htm
3.43 Selby C A, Burgan B A, ‘Blast and Fire Engineering for Topside Structures – Phase 2, Final
Summary Report’, Steel Construction Institute, ISBN 1 85942 078 8, 1998
3.44 Johnson D.M., Cleaver R.P., ‘Gas explosions in offshore modules following realistic releases
(Phase 3B) - Final summary report’, Advantica report R4853, February 2002
3.45 BS EN 1991:2003 “Eurocode 1: Basis of design and actions on structures Part 1: Basis of
design”, and Part 1-2: 2002 “Actions on structures exposed to fire”, BSI 2002-3
3.46 BS 476:1987: “Fire tests on building materials and structures”, BSI 1987
4.2 American Petroleum Institute (API), Sizing, selection and installation of pressure-relieving
devices in refineries, Part 1 – Sizing and selection, Recommended Practice RP 520 Part 1,
7th Edition, 2003
4.3 A.J. Gosse and G. Hankinson, Use of water deluge to minimise hazards of oil and gas fires
offshore, Proceedings of the IGRC, Amsterdam 2001
4.4 D.M. Johnson, R.P. Cleaver, Advantica Technology Inc., J.S. Puttock, Shell Global Solutions,
C.J.M. Van Wingerden, GexCon, Investigation of gas dispersion and explosions in offshore
modules, OTC Paper 14134, May 2002
4.5 C.A.J. Gregory and D.M Johnson, Explosions in Offshore Modules: Assessment and
Research, Offshore Structural Design Against Extreme Loads, 2nd International Conference
and Exhibition (ERA Technology), UK, 3-4th November 1993
4.6 NFPA 15: Standard for Water Spray Fixed Systems for Fire Protection, National Fire
Protection Association, 2001 (next revision cycle 2006)
4.7 G. Hankinson, B.J. Lowesmith, J.A. Evans and L.C. Shirvill, Jet fires involving releases of
crude oil, gas and water. Forthcoming article in Trans IchemE Process Safety and
Environmental Protection
5.2 NORSOK, ‘Guideline for Risk and Emergency preparedness Analysis, Z-013, 2001
5.3 Incropera F P, De Witt D P, Fundamentals of heat and mass transfer, John Wiley and Sons,
ISBN 0-471-38650-2, 2002
5.4 Energy Institute (formerly The Institute of Petroleum), Guidelines for the design and
protection of pressure systems to withstand severe fires, ISBN 0 85293 279 0, 2003
5.5 McGuire J H, Heat transfer by radiation, Fire Research Special Report No. 2, HMSO, 1953
5.6 Weast R C, Edited by Lide D R, Beyer W H and Astle M J, “CRC Handbook of Chemistry and
Physics”, ISBN: 0849304709, 1989
5.7 Roberts T A, Gosse A and Hawksworth S, 2000, Thermal radiation from fireballs on failure of
liquefied petroleum gas storage vessels, Trans IChemE. Vol. 78 Part B, pp. 184-192, 2000
5.8 Committee for the Prevention of Disasters, Methods for the calculation of physical effects
(“Yellow Book”), CPR 14E, 3rd Edition, ISBN 9012084970, 1997
5.9 Society of Fire Protection Engineers (SFPE), Handbook of fire protection engineering, NFPA,
ISBN 0-87765-451-4, 2002
5.10 Lees' Loss prevention in the process industries, edited by Sam Mannan, Mary Kay O’Connor,
Imprint: Butterworth Heinemann, ISBN: 0-7506-7555-1,2005
5.11 Carsley A J., A model for predicting the probability of impingement of jet fires, IChemE Symp.
Series 139, pp. 177-193, ISBN 0 85295 366 6, 1995
5.12 Cracknell R F, Davenport J N and Carsley A J, A model for heat flux on a cylindrical target
due to the impingement of a large-scale natural gas jet fire, IChemE Symp. Series 139, pp.
161-175, ISBN 0 85295 366 6, 1995
5.13 Chamberlain, G., The hazards posed by large-scale pool fires in offshore platforms, IChemE
Symp. Series 139, pp. 16213-226, ISBN 0 85295 366 6 , 1995
5.14 FABIG Technical note 1, ‘Fire resistant design of offshore structures’ 1993.
5.15 Association for Specialist Fire Protection (ASFP), Fire protection for structural steel in
buildings, 3rd edition, ASFP ISBN 1 870409 20 5, 2002
5.16 DD ENV 13381-4:2002; Test methods for determining the contribution to the fire resistance
of structural members. Applied protection to steel members, 2002
5.18 BSEN 1994-1-2:2005 (Eurocode 4) “Design of composite steel and concrete structures.
General rules. Structural fire design”, BSI 2005
5.19 ‘Interim Guidance Notes for the Design and Protection of Topside Structures Against
Explosion and Fire’, Various Authors, Joint Industry Project on Blast and Fire Engineering for
Topside Structures, November 1992.
5.20 ISO 23251: 2006, “Petroleum, petrochemical and natural gas industries – pressure relieving
and depressuring systems”, International Standards Organisation 2006
5.22 Roberts T A, Medonos S and Shirvill L C, Review of the response of pressurised process
vessels and equipment to fire attack, Offshore Technology Report OTO 2000 051, HSE
Books
5.23 “Handbook for fire calculations and fire risk assessment in the process industry”, available
from Sintef and Scandpower, (see www.scandpower.com)
5.24 Persaud M A, Butler C J, Roberts T A, Shirvill L C and Wright S, Heat-up and failure of
liquefied petroleum gas storage vessels exposed to a jet fire, Loss Prevention and Safety
Promotion in the Process Industries, 10th Int. Symp. Proceedings 2, Elsevier ISBN 0 444
50699 3, 2001
5.25 Roberts T A, Gosse A and Hawksworth S, 2000, Thermal radiation from fireballs on failure of
liquefied petroleum gas storage vessels, Trans IChemE. Vol. 78 Part B, May 2000, pp. 184-
192
5.26 Gayton, P.W. and Murphy, S.N. Depressurisation Systems Design. IChemE Workshop: The
Safe Disposal of Unwanted Hydrocarbons, Aberdeen 1995
5.27 Hekkelstrand B and Skulstad P, Guidelines for the protection of pressurised systems
exposed to fire, Scandpower report no. 27.207.291/R1 Version 2, 2004
(www.scandpower.com)
5.28 NFPA 15: Standard for Water Spray Fixed Systems for Fire Protection, National Fire
Protection Association, 2001 (next revision cycle 2006)
5.29 Fire Offices' Committee, 1979, “Tentative rules for medium and high velocity water spray
systems”, 1979
5.30 Shirvill L C and White G C, Effectiveness of deluge systems in protecting plant and
equipment impacted by high-velocity natural gas jet fires, ICHMT Int. Symp. on heat and
mass transfer in Chemical Process Industry Accidents, , Rome, Italy, Sept. 15-16 1994
5.31 Lev Y, Water protection of surfaces exposed to impinging LPG jet fires, J. Loss Prev.
Process Ind., 4(7), pp. 252-259, 1991
5.32 Shirvill L C, Efficacy of water spray protection against propane and butane jet fires impinging
on LPG storage tanks, J. Loss Prevent. Process Ind., 17 pp. 111-118, 2004
5.33 Hankinson G and Lowesmith B J, Effectiveness of area and dedicated water deluge in
protecting objects impacted by crude oil/gas jet fires on offshore installations, J. Loss
Prevention in the Process Industries, 17 (2004) pp. 119-125
5.34 Special edition of the Journal of Loss Prevention in the Process Industries, March, 2003
5.35 Roberts T A, Directed deluge system designs and determination of the effectiveness of the
currently recommended minimum deluge rate for the protection of LPG tanks, J. Loss
Prevent. Process Ind., 17 (2004) pp. 103-109, 2004
5.36 Roberts T A, 2004, Effectiveness of an enhanced deluge system to protect LPG tanks and
sensitivity to blocked nozzles and delayed deluge initiation, J. Loss Prevent. Process Ind., 17
(2004) pp. 151-158.
5.37 Roberts T A, 2004, Linkage of a known level of LPG tank surface water coverage to the
degree of jet-fire protection provided, J. Loss Prevent. Process Ind., 17 (2004) pp. 169-178.
5.38 Roberts A F and Moodie K, J. oil & Colour Chemistry, pp. 192-195, 1989
5.39 Jet Fire Resistance Test of Passive Fire Protection Materials, Jet Fire Test Working Group,
OTI 95 634, HSE Books, 1995
5.41 Hymes I, Boydell W and Prescott B, Thermal radiation: Physiological and pathological
effects, IChemE. ISBN 0 85295 328 3, 1996
5.42 Lees' Loss prevention in the process industries, edited by Sam Mannan, Mary Kay O’Connor,
Imprint: Butterworth Heinemann, ISBN: 0-7506-7555-1,2005
6.2 Warwick A., ‘Updated Guidance for fire and explosion hazards – Part 1 Avoidance and
mitigation of explosions, CTR 105, Preparation of updated guidance for fire and explosion
hazards - Derivation of explosion loadings’, W.S. Atkins Inc., August 2002
6.3 Gregory J., ‘Early design blast analysis’, RISX Ltd. report RISX/12-01-01/01, November 1998
6.4 Lea C. J., Ledin H. S., ‘A Review of the State-of-the-art in Gas Explosion Modelling’, Health
and Safety Laboratory Report CM/00/04, 19 February 2002
6.5 Marsano S, Bowen P.J., O’Doherty T. ‘Modelling the Internal/External Interaction from
Vented Explosions, 13th Australasian Fluid Mechanics Conference, Melbourne, Australia,
13-18 December, 1998
6.6 ‘Structural Analysis and Design of Nuclear Plant Facilities’, ASCE 58, 1980
6.7 Structures to Resist the Effects of Accidental Explosions - Department of Army, Washington,
D. C - TM5-1300, November 1990
6.8 NORSOK, Guideline for Risk and Emergency Preparedness Analysis, Z-013
6.9 ‘Hydrocarbon release reduction campaign’, HSE books, HSE OSD report OTO 2001 055,
HMSO 2001
6.11 ‘Offshore Accident and Incident Statistics Report 1998’, OTO 98: 952, HSE, HMSO, 1998
6.13 ‘Accident statistics for fixed offshore units on the UK continental shelf 1991–1999’, DNV for
the HSE, OTO 2002 012, HMSO 2002
6.15 HSE, SRD, ‘Discharge Rate Calculation Methods for Use in Plant Safety Assessments’
SRD/HSE/R352.
6.16 ‘Area Classification Code for Petroleum Installations’, Institute of Petroleum. March 1990.
(IP 15)
6.17 Gregory J., ‘Early design blast analysis’, RISX Ltd. report RISX/12-01-01/01, November 1998
6.18 ‘JIP - Gas build up from high pressure natural gas releases in naturally ventilated offshore
modules – Workbook on gas accumulation in a confined and congested area’, BP Amoco,
CERC, BG Technology, May 2000
6.19 Design of Offshore Facilities to Resist Gas Explosion Hazard, Engineering Handbook, Ed.
Czujko J., Corrocean 2001
6.20 Cleaver R P, Humphreys C. E., Robinson C. G., ‘Accidental generation of gas clouds on
offshore process installations’, J. Loss Prev. Process Ind., 7, pp 273-280, 1994
6.22 Pappas J., The NORSOK Procedure on Probabilistic Explosion Simulation, Paper 5.5.1, ERA
Conference, ‘Major Hazards Offshore’, London 27-28 November 2001, ERA Report 2001-
0575
6.23 Cleaver R P, Halford A R, ‘Gas Explosions in Offshore Modules Following Realistic Releases
(Phase 3B): Final Summary Report, Appendix H An Analysis of the Phase-3B Large-Scale
Gas Explosion Experiments’, Advantica Report Numbers R4853 and R5107, 2001
6.24 Johnson D.M., Cleaver R.P., ‘Gas explosions in offshore modules following realistic releases
(Phase 3B) - Final summary report’, Advantica report R4853, February 2002
6.26 “Ignition modelling – Time dependent ignition probability model”, Technical report no. 96-
3629, rev 04, DNV 1998
6.27 “Development of a method for the determination of on-site ignition probabilities”, WS Atkins,
HSE Research Report 226, HSE Books, ISBN 0 7176 1657 6, 1998
6.28 Cox A W , Lees and Ang , ‘Classification of Hazardous Locations’, IChemE Books
6.29 OGP (formerly E&P Forum), ‘Hydrocarbon Leak and Ignition Database’, May 1992
6.31 Selby C A, Burgan B A, ‘Blast and Fire Engineering for Topside Structures – Phase 2, Final
Summary Report’, Steel Construction Institute, ISBN 1 85942 078 8, 1998
6.32 Bray K.N.C., ‘Studies of the turbulent burning velocity’, Proc. Roy. Soc. London. A 1990 431,
pp315-335
6.33 Harris R.J., ‘The investigation and control of gas explosions in building and heating plant’,
ISBN 0 419 13220 1, E&FN Spon Ltd., 1983
6.34 Walker S., Corr R. B., Tam V.H.Y., ‘Guidance for the protection of Offshore Structures
against Fires and Explosions’, BP Corporation, Document Reference CH152R002 API Draft
0, September 2001
6.35 Wishart J. et. Al., ‘White paper – working group 2 – Safe design practice’, International
workshop ‘Fire and blast considerations in the future design of offshore facilities’, June 2002,
Houston Texas. http://www.fireandblast2002.com
6.36 Shearer M J, Tam V Y H, Corr R.B, ’ Analysis of results from large scale hydrocarbon gas
explosions’, J. Loss Prev. Process Ind. 13, 167-173, 2000
6.38 Det Norske Veritas, ‘Offshore Standard DNV-OS-A101, Safety Principles and Arrangements’,
January 2001
6.42 ‘Acts, Regulations and Provisions for the Petroleum Activity’, Volume 2, NPD, December
1992
6.44 Yasseri S.F., An Approximate Method for Blast Resistant Design, Paper R429, FABIG
Newsletter January 2002, SCI publication
6.45 Walker S., Corr R.B.., Tam V.H.Y., Bucknell J. and O’Connor P., Simplified Approaches to
Fire and Explosion Engineering, Paper 3.3.1, ERA Conference, ‘Major Hazards Offshore’,
London 27-28 November 2001, ERA Report 2001-0575
6.46 Yasseri S.F., ‘Target explosion loads for offshore installations – strength level and ductility
level events’, FABIG newsletter, October 2002
6.47 Lund J K, ‘COSAC, The Tool for Efficient Hazard Identification and Risk Assessment in the
early phase of a field development’, ERA Major Hazards Offshore Conference, London,
November 2000
6.48 Puttock J S, ‘Improvements in guidelines for prediction of vapour cloud explosions’, Int. Conf.
and Workshop on Modelling the Consequences of Accidental Releases of Hazardous
Materials, San Francisco, September 1999
6.49 Bruce R L, ‘Blast Overpressure Prediction - Modelling the Uncertainties’, Offshore Structural
Design – ERA conference, Hazards, Safety and Engineering London November 1994,
ISBN 0 7008 0587 7
6.50 Mood, M.A., Graybill, R.A., Boes, D.C. ‘Introduction to the theory of statistics’, 3rd Edn,
McGraw-Hill, 1974
6.51 Vinnem J.E., ‘Blast load frequency distribution assessment of historical frequencies in the
North Sea’, Preventor report 19816-04, November 1998
6.52 ‘A Review of Potential Ignition Sources on Offshore Platforms’, HSL Report, FS 99/09
6.53 Natabelle Technology Ltd, ‘Explosion Loading on Topsides Equipment: Part 1 - Treatment of
Explosion Loads, Response, Analysis and Design’, Health and Safety Executive Report OTO
1999 046, March 2000
6.54 Corr R B, Tam V Y H, Snell R O, Frieze P A, ‘Development of the limit state approach for the
design of offshore platforms’ ERA Conference, London, 1999
6.55 Corr R.B. and Tam V.H.Y., ‘Gas explosion drag loads in offshore installations’, Journal of
Loss Prevention in the process industries, 11 (1998) 43-48
6.56 Walker S and Haworth M.W.,’ Sensitivity of response of topside structures to fires and
explosions’, HSE OTO 97 043, 1996
6.57 ‘A Guide to the offshore installations (Safety Case) regulations 1992’, HSE L39, HMSO 1992.
(ACOP)
6.58 Bowerman H., Owens G W, Rumley J H, Tolloczko J.J.A., ‘Interim Guidance Notes for the
Design and Protection of Topside Structures Against Explosion and Fire’, Steel Construction
Institute Document SCI-P-112/487, January 1992
6.60 Natabelle Technology Ltd, ‘Explosion Loading on Topsides Equipment: Part 2 - Treatment of
Explosion Loads, Response, Analysis and Design’, Health and Safety Executive Report OTO
1999 047, March 2000
7.2 DD ENV 1994: Eurocode 4: Design of composite steel and concrete structures Part 1.2
Structural fire design (including UK NAD) British Standards Institution , 1998
7.5 ISO/DIS 22899-1, Determination of the resistance to jet fires of passive fire protection
materials -- Part 1: General requirements, International Standards Organisation, 2005
7.6 BRITISH STEEL PLC (CORUS) The behaviour of multi-storey steel framed buildings in fire
Report of a joint European joint research programme Corus, Swindon Technology Centre,
1999
7.7 Statutory Instrument 1996 No. 913 “The Offshore Installations and Wells (Design and
Construction, etc.) Regulations 1996,”
7.8 BS 476:1987: “Fire tests on building materials and structures”, BSI 1987
7.9 ISO 834, Parts 1 to 9, Fire-resistance tests -- Elements of building construction, International
Standards Organisation, 1999-2003
7.10 BS EN: 1363 Parts 1 and 2: 1999 “Fire resistance tests”, BSI 1999
7.11 EN ISO 13702:1999, Petroleum and natural gas industries – Control and Mitigation of fires
and explosions on offshore production installations – Requirements and Guidelines,
International Standards Organisation, 1999
7.12 BS 5950: 2005 “The structural use of steelwork in buildings”, BSI 2005
7.14 ECCS Model code on fire engineering, ECCS Publication 111, 2001
7.15 Rules for the determination of coat-back requirements, Steel Construction Institute Joint
industry Project, SCT report RT543, March 1996
7.16 Parry C F, 1994, Relief systems handbook, IChemE, ISBN 0 85295 267 8, 1994
7.17 Design Institute for Emergency Relief Systems (DIERS), Emergency relief system design
using DIERS technology, AIChemE, ISBN 0-8169-0568-1, 1992
7.18 Guidelines for Fire Protection in Chemical, Petrochemical, and Hydrocarbon Processing
Facilities, Center for Chemical Process Safety/AIChE, 2003
7.19 Energy Institute (formerly The Institute of Petroleum), Guidelines for the safe and optimum
design of hydrocarbon pressure relief and blowdown systems, ISBN 0 85293 287 1, 2001
7.20 OTO 2000 051, Review of the response of pressurised process vessels and equipment to
fire attack, HSE Books, 2000
7.21 ‘Interim Guidance Notes for the Design and Protection of Topside Structures Against
Explosion and Fire’, Various Authors, Joint Industry Project on Blast and Fire Engineering for
Topside Structures, November 1992
7.23 American Petroleum Institute, Petroleum, petrochemical and natural gas industries –
pressure relieving and depressuring systems, Recommended Practice RP 521, 5th edition,
Draft ISO 23251, 2005
7.24 Energy Institute (formerly The Institute of Petroleum), Guidelines for the design and
protection of pressure systems to withstand severe fires, ISBN 0 85293 279 0, 2003
7.25 NFPA 30: Flammable and Combustible Liquids Code, National Fire Protection Association,
2003
7.26 NFPA 58: Liquefied Petroleum Gas Code, National Fire Protection Association, 2004
7.27 ISO 4126, Parts 1 to 10, 2003 to 2006, “Safety devices for protection against excessive
pressure”, Parts 9 & 10 still under development, 2003-2006
7.29 Gayton, P.W. and Murphy, S.N. Depressurisation Systems Design. IChemE Workshop: The
Safe Disposal of Unwanted Hydrocarbons, Aberdeen 1995
7.30 Moodie K, Cowley L T, Denny R B, Small L M and Williams I, Fire engulfment tests on a 5
tonne LPG tank, J. Haz. Mats, 20 (1988) pp. 55-71
7.31 Roberts T and Beckett H, Hazard consequences of jet-fire interactions with vessels
containing pressurised liquids: Project final report, HSL Internal Report PS/96/03 (to be
published on the HSE/HSL website), 1996
7.32 Hekkelstrand B and Skulstad P, Guidelines for the protection of pressurised systems
exposed to fire, Scandpower report no. 27.207.291/R1 Version 2, 2004 (downloadable from
www.scandpower.com)
7.34 BS 7910: 1999 “Guide on methods for assessing the acceptability of flaws in metallic
structures”, BSI 1999
7.35 Burgan B, Elevated temperature and high strain rate properties of offshore steels, Offshore
Technology Report 2001/020, HSE Books ISBN 0 7176 2023 9, 2001
7.36 Billingham J, Sharp J V, Spurrier J and Kilgallon, 2003, Review of the performance of high
strength steels used offshore, HSE Books, ISBN 0 7176 2205 3, 2003
7.37 Hymes I, Boydell W and Prescott B, Thermal radiation: Physiological and pathological
effects, I.ChemE. ISBN 0 85295 328 3, 1996
8.2 Bowerman H., Owens G W, Rumley J H, Tolloczko J.J.A., ‘Interim Guidance Notes for the
Design and Protection of Topside Structures Against Explosion and Fire’, Steel Construction
Institute Document SCI-P-112/487, January 1992
8.4 Walker S., Corr R.B.., Tam V.H.Y.., Bucknell J. and O’Connor P., Simplified Approaches to
Fire and Explosion Engineering, Paper 3.3.1, ERA Conference, ‘Major Hazards Offshore’,
London 27-28 November 2001, ERA Report 2001-0575
8.8 ‘Blast and fire engineering project for topside structures’, BRI, ‘The effects of simplications of
the explosion pressure-time history. Second impression’, 1991
8.9 ‘Blast and fire engineering project for topside structures’, Report BR4, OTI:602 ‘The effects of
high strain rates on material properties’, 1991
8.10 FABIG Technical note 6, ‘Design Guide for Steel at Elevated Temperatures and High Strain
Rates’, SCI 2001
8.11 BS EN 10002-1: 2001 “Tensile testing of metallic materials. Method of test at ambient
temperature”, Edition: 01, ISBN: 0580384594, BSI 2001
8.12 BS EN 10225: 2001 “Weldable structural steel for fixed offshore structures – Technical
delivery conditions” BSI 2001
8.13 Jones, N. and Birch, R.S. ‘Elevated Temperature and High Strain Rate Properties of
Offshore Steels’, The Steel Construction Institute. OTO Report 2001/020
8.17 ‘Offshore Installations and Wells (Design and Construction, etc.) Regulations’ (DCR), HMSO
1996
8.18 ‘Assessment principles for offshore safety cases’ (APOSC), HSE Books, HSG181, ISBN 0
7176 1238 4, HMSO 1998
8.20 Norsok Standard N-004 “Design of steel structures” Annex A, Norsok 2004
8.21 BS 6399 – Part 1: 1996 “Loading for Buildings – Code of Practice for Dead and Imposed
Loads”, BSI 1996
8.22 The Management of Integrity of Bolted Pipe Joints, Draft Issue 1, Jan 2000, UKOOA
8.23 Walker S, Corr BR, Tam VHY, O’Connor PA, Bucknell J, ‘New guidance on fire and
explosion engineering’, paper OMAE02-28623, OMAE 2002, June 23-28, Oslo, Norway
8.24 Yasseri S.F., ‘Fire and Blast Information Group Newsletter, Retrofitting of Blast walls for
Offshore Structures’. Issue No.15, 1996
8.25 Walker S and Haworth M.W.,’ Sensitivity of response of topside structures to fires and
explosions’, HSE OTO 97 043, 1996
8.26 ‘Recommended Practice for the planning, Designing and Construction Fixed Offshore
Platforms – Working Stress Design’, API RP 2A-WSD, 21st Edition. API (American
Petroleum Institute)
8.27 BS 5950: 2005 “The structural use of steelwork in buildings”, BSI 2005
8.29 Kato B., ‘Rotation capacity of steel members subject to local buckling’, Proc. 9th World
Conference on Earthquake Engineering, Japan 1989
8.30 Explosion Hazards and Evaluation - Baker, W. E. et al - Elsevier Science Publishers, 1988
8.31 ‘Bulletin on design of flat plate structures’, API Bulletin 2V (BUL 2V) 1st Edn., May 1 1987
8.32 Taylor P.H., Stewart G., Harwood R.G., ‘Blast wall strength estimated using finite
displacement theory’, OMAE98-1423, 17th conference on Offshore Mechanics and Arctic
Engineering, 1998
8.33 Izzuddin, B., ‘Simplified Methods for Dynamic Response Analysis’. - FABIG Technical
Meeting, January, 2002
8.34 FABIG Technical note 7, ‘Simplified methods for analysis of response to dynamic loading’,
2002
8.35 Louca, L. A., Punjani, M. and Harding, J. E., ‘Non-Linear Analysis of Blast walls and Stiffened
Panels Subjected to Hydrocarbon Explosions’ - J. Constructional Res. Vol. 37, No.2, pp. 93-
113, 1996
8.36 ‘Structural Analysis and Design of Nuclear Plant Facilities’, ASCE 58, 1980
8.37 Morrison G., ‘Strong Vibration and Design for Robustness’ HSE - ERA Conference Offshore
Structural Design – Hazards, Safety and Engineering, November 1994
8.38 ‘The Public Enquiry into the Piper Alpha Disaster’, Cullen The Honourable Lord, HMSO,
London, 1990
10.3 UKOOA Publication,EHS08 Industry Guidelines on a Framework for Risk Related Decision
Support, 1999
10.4 Energy Institute (formerly The Institute of Petroleum), Guidelines for the design and
protection of pressure systems to withstand severe fires, ISBN 0 85293 279 0, 2003
10.5 American Petroleum Institute (API), Sizing, selection and installation of pressure-relieving
devices in refineries, Part 1 – Sizing and selection, Recommended Practice RP 520 Part 1,
7th Edition, 2000
10.7 IEC 61511; “Functional safety - Safety instrumented systems for the process industry sector”;
Parts 1 to 3, International Electro Technical Commission, 2003-2004
10.8 ISO 22899-1:2006, Determination of the resistance to jet fires of passive fire protection
materials -- Part 1: General requirements, International Standards Organisation, 2006
10.10 ISO 23251:2006, Petroleum, petrochemical and natural gas industries -- Pressure-relieving
and depressuring systems, International Standards Organisation, 2006
10.11 Fire Offices' Committee, 1979, “Tentative rules for medium and high velocity water spray
systems”, 1979
10.12 NFPA 15: Standard for Water Spray Fixed Systems for Fire Protection, National Fire
Protection Association, 2001 (next revision cycle 2006)
11.2 API Recommended Practice 521, ‘Guide for Pressure-Relieving and Depressuring Systems’,
4th Edition, March 1997
11.3 Medonos S. and Berge Dr. G., ‘Why API Recommended Practice may Lead to Unsafe
Design of Pressurised Systems’. ERA Major Hazards Offshore Conference Nov. 2001
11.4 HSE Offshore Division Safety Notice 2/2002 May 2002 “Balanced bellows pressure relief
valves – problems arising from modification of the bonnet vent”, HSE 2002
11.5 Rockey, K.C. and Evans, H.R., ‘The Behaviour of Corrugated Flooring Systems, Thin Walled
Structures’, Crosby Lockwood, 1967
11.6 FABIG Technical note 5, ‘Design guide for stainless steel blast walls’, June 1999
11.7 Yasseri, S.F., ‘Fire and Blast Information Group Newsletter, Retrofitting of Blast walls for
Offshore Structures’. Issue No.15, 1996
11.8 “Equipment intended for use in Potentially Explosive Atmospheres (ATEX)”, Directive
94/9/EC of the European Parliament and the Council, CEC 1994
11.9 “Minimum requirements for improving the safety and health protection of workers potentially
at risk from explosive atmospheres”, Directive 1999/92/EC of the European Parliament and
the Council, CEC 1999
11.10 PD 5500: 2006 “Specification for unfired fusion welded pressure vessels”, BSI, 2006
11.11 ASME BPV Code: Section VIII, Division 1 – “Design and Fabrication of Pressure Vessels”
and Section VIII Division 2 “Alternative Rules”, ASME International, 2004
11.12 The Management of Integrity of Bolted Pipe Joints, Draft Issue 1, Jan 2000, UKOOA
11.13 Guidelines for the Management, Design, Installation and Maintenance of Small Bore Tubing
Systems, Institute of Petroleum, June 2000
Term Description
Acceptance criteria Stated limits, thresholds or boundaries of performance and/or
behaviour within which performance is deemed to be acceptable to the
various stakeholders.
Accidental event (AE) Event or chain of events that may cause loss of life, or damage to
health, the environment or assets
NOTE - The events that are considered in a risk analysis are acute,
unwanted and unplanned. For instance; planned operational exposure
that may be hazardous to health or to the environment, are usually not
included in a risk analysis.
Active Fire Protection A fire protection method that requires activation – switching on,
directing, injection or expulsion – in order to combat smoke, flames or
thermal loadings.
Artificial ventilation That ventilation which is not supplied from the action of the
environmental wind alone.
As low as reasonably ALARP expresses that the risk level is reduced (through a documented
practicable (ALARP) and systematic process) so far that no further cost effective measure is
identified. The requirement to establish a cost effective solution implies
that risk reduction is implemented until the cost of further risk reduction
is grossly disproportional to the risk reducing effect.
Term Description
Auto-Ignition Temperature The minimum temperature of a vapour and air mixture at which it is
marginally self igniting.
Availability The probability of the system being available to perform the function
when required.
Average Individual Risk (AIR) The average chance of any individual in a defined population
sustaining a given level of harm from incidents which are considered to
be limited to that population. (Sometimes called Individual Risk – IR)
Blast Relief Panel Parts of a module wall, ceiling or roof which are designed to increase
the area of venting in an explosion by being opened or removed by the
force of the explosion.
Blast Wall A structural division which has been designed expressly for the
purpose of resisting blast loads.
Blockage Factor The fraction of an area which does not provide open venting or free
passage for a flame.
Blow-out (ignited) A form of jet resulting from ignition of a high pressure flow of oil and/or
gas issuing from an uncontrolled well, possibly with substantial fallout
of heavy fractions which may also ignite on or around the platform as
pool fires.
Boiling liquid expanding vapour The sudden rupture due to fire impingement of a vessel system
explosion (BLEVE) containing liquefied flammable gas under pressure. The pressure burst
and the flashing of the liquid to vapour creates - a blast wave and
potential missile damage, and immediate ignition of the expanding fuel-
air mixture leads to intense combustion creating a fireball
Burning Velocity The rate at which the flame consumes the unburnt gas/vapour. Also
the velocity of the flame relative to the unburnt gas/vapour.
Caisson A vertically aligned pipe, running from the module deck to a sub sea
level, forming a service line for seawater suction or sewage/drilling
disposal.
Term Description
Can Verbal form used for statements of possibility and capability, whether
material, physical or causal
Cellulosic Fire A fire with a fuel source predominantly of cellulose (e.g. timber, paper,
cotton). A fire involving these materials is relatively slow growing,
although its intensity may ultimately reach or exceed that of a
hydrocarbon fire.
Common Mode Failure The failure of components from the same cause.
Compartment fires A fire that starts and continues within a confined volume on the
installation, such as a contained process area, equipment enclosure or
designated room (e.g. control room).
Computational Fluid Dynamics A mathematical model in which the region of the flow is subdivided by
(CFD) a grid into a large number of control volumes.
Term Description
Convection (Heat) Heat transfer associated with fluid movement around a heated body;
warmer, less dense fluid rises and is replaced by cooler, more dense
fluid.
Convective heat flux The measured or calculated heat flux crossing a boundary or surface
due to convection heat transfer only.
Cost Benefit Analysis (CBA) A quantitative technique to assess the overall value of a proposal
taking into account likely benefits and detriments.
Criticality (of SCEs) Defined by the criticality classes 1 (highest) to 3 (lowest) with respect
to the explosion hazard and the consequences of failure. In particular
the impact on the TR, EER systems and associated supporting
structure.
Decision Basis/Bases The basis/bases for assessing the performance of decision options.
These range from technical codes and standards based ways of
assessing options to values based assessments based on company or
wider societal values and stakeholder expectations and perceptions.
Decision Factors Aspects of performance or influencing factors that can have a bearing
on the decision, either because they directly affect option performance
or because they determine the context in which the decision needs to
be made.
Decision Framework The decision framework consists of the model and accompanying
guidance on the decision context and means of calibration. It provides
the practical tool to aid decision making.
Decision Option(s) The different options or solutions which are to be considered as means
to resolve the problem.
Term Description
Design accidental event An accidental event for which SCEs on the installation should perform
their function as designed.
Design basis checks Design basis checks consist of checking the basis of the existing
design for the installation and determining if the methods used for the
design are acceptable in the context of the explosion hazard.
Design explosion loads Explosion loads used for design. SCEs must be designed to resist
these load levels within the constraints of the associated element
specific performance standards.
Detonation Limits The range of fuel-air ratios through which detonations can propagate.
Diffracted Wave That component of the blast wave which propagates into the sheltered
region behind the structure.
Dimensioning accidental event Accidental Events (AEs) that serve as the basis for layout,
(DAE) dimensioning and use of installations and the activity at large, in order
Ito meet the defined RAC.
Design accidental load (DAL) Load (action) that is sufficient in order to meet the risk acceptance
criteria.
Dimensioning explosion loads Explosion loads which are of such a magnitude that when applied to a
simple elastic analysis model, the code check results in members
dimensioned to resist the ductility level explosion.
Drag Coefficient An empirical multiplying constant used to relate the drag load on a
structure to the stagnation overpressure.
Term Description
Drag force The drag load on a small obstacle due to the movement of gas past a
small obstacle less than 0.3 m in the direction of flow, form drag –
Presented Area x Pdrag.
Ductility level blast (DLB) Representative peak overpressure used in design (10-4 to 10-5 p.a.
probability level) – Pduct.
Ductility Ratio The ratio of the peak deflection to the deflection at first effective yield.
Ductility ratio μ The ratio of the maximum displacement of the element to the deflection
required to cause first yield at the extreme fibres.
Duty Holder The organisation or company responsible for the safety of the
installation or its design under UK legislation.
Dynamic pressure Representative peak out of balance loads over target area, includes
drag, pressure difference and gas acceleration effects. Used for
calculation of loads on equipment and piping – Pdyn, sometimes
referred to as dynamic overpressure.
Effectiveness analysis Analysis which documents the fulfilment of performance standards for
safety and emergency preparedness.
Element specific performance Measurable performance standard for specific key items or systems
standard relating to systems’ functionality, availability and survivability.
(Sometimes referred to as low level performance standard).
Emergency preparedness Technical, operational and organisational measures that are planned
to be implemented under the management of the emergency
organisation in case hazardous or accidental situations occur, in order
to protect human and environmental resources and assets.
Emergency preparedness Analysis which includes establishment of OSHA, including major AEs,
analysis (EPA) establishment of Performance Standards for emergency preparedness
and their fulfilment and identification of emergency preparedness
measures.
Emergency Shutdown System A safety shutdown system comprising detection, signalling and logical
control, valves and actuators, which can, in tandem with alarm and
direct control mechanisms, enable the safe and effective shutdown of
plant and machinery in a controlled manner.
Term Description
Emergency Shutdown Valve A valve mounted in a pipeline, pipe or marine riser specifically for the
(ESDV) purpose of cutting of the supply of its normal contents in an
emergency.
Entrainment The process by which surrounding fluid is drawn into a jet to cause its
dilution.
Environmental effect A direct or indirect impingement of the activities, products and services
of the company upon the environment, whether adverse or beneficial.
Equivalent static overpressure An overpressure derived from an overpressure trace with respect to a
target which gives the same peak deflection when applied as a static
load as the original trace.
Essential safety system System which has a major role in the control and mitigation of
accidents and in any subsequent EER activities.
Exceedance curve A plot of the value of a variable against the plot of the probability or
frequency of exceedance of that variable.
Expansion Ratio The ratio of burnt to unburnt gas volumes of a given mass of gas.
Explosion risk risk from the initiating event and possible subsequent escalation.
Extreme (residual) events Events for which design is not reasonably practicable may result in
loss of functionality of SCEs.
Term Description
F Factor The fraction of the net combustion energy of a flame transmitted as
radiation.
Fail-Safe Valve An actuated valve which automatically assumes a safe position (open
or closed depending on the needs of the system) in the event of loss of
power to the actuator.
Finite element (analysis) FEA consists of a computer model of a material or design that is
stressed and analyzed for specific results.
Fire and explosion risk analysis The analytical study of the likelihood and severity of both defined fire
hazard and explosion hazard scenarios.
Fire Ball This phenomenon, which may occur as the result of a deflagration of a
vapour cloud that does not result in a blast wave. Alternatively, a fire,
burning sufficiently rapidly for the burning mass to rise into the air as a
cloud or ball.
Fire Curve A temperature/time curve devised for a fire tests that is intended to
represent (but not necessarily reproduce) the temperature
development of a ‘real’ fire, either cellulosic or hydrocarbon.
Fire Endurance The length of time that an element can resist fire either up to the point
of collapse or alternatively to the point when the deflection reaches a
limiting value.
Fire hazard analysis The application of hazard analysis techniques solely to fire hazards.
Fire Point The temperature at which a liquid fuel flashes and then marginally
sustains a flame.
Fire Prevention Measures taken to prevent the outbreak of fire at a given location.
Fire Protection Measures taken to minimize effects of damage from fire should it
occur.
Fire Protection System An integrated detection, signalling and automated fire control system.
Fire risk analysis The analytical study of the likelihood and severity of defined fire hazard
scenarios.
Term Description
Fire Wall A designated partition, which by nature of its construction and
certification status, is warranted to resist a standard or hydrocarbon fire
test for a particular time period. The term can apply to a floor or roof
panel.
Fire Water Pump A submersible electric or diesel pump, mounted in or capable of being
lowered into a fire water pump caisson, which feeds into the firewater
ring main.
Flammability Limits The range of fuel-air ratios which can support non-detonative
combustion such as laminar and turbulent flames.
Flash Fire The combustion of a flammable vapour and air mixture in which flame
passes through that mixture and negligible damaging overpressure is
generated.
Flash Point The flash point of a liquid is the temperature at which the vapour and
air mixture lying just above its vaporizing surface is capable of just
supporting a momentary flashing propagation of a flame prompted by a
quick sweep of a small gas pilot flame near the surface.
Flashing The rapid evaporation of a volatile liquid when suddenly released from
pressurized storage.
Free flame release The flame resulting from a gas or liquid release but that subsequently
has no impingement on any other bodies (such as equipment or
structure).
Fuel Controlled Fire A fire in which the rate of fuel consumption is controlled by the rate of
supply of fuel to the fire, rather than the availability of oxygen for
combustion.
Fundamental Burning Velocity The burning velocity of a laminar (non-turbulent) flame under stated
conditions of composition, temperature and pressure of the unburnt
gas.
Term Description
Gas explosion Gas explosions can be defined as the combustion of a premixed gas
cloud containing fuel and an oxidiser that can result in a rapid rise in
pressure.
Gas oil ratio The ratio of gas to oil within the hydrocarbon fluid, a high GOR
indicates a high gas content which has implications for the potential for
gas fires from a depressurisation and release.
General platform alarm A platform wide alarm indicating the onset of an emergency.
Hazard The potential to cause harm, including ill health or injury; damage to
property, plant, products or the environment; production losses or
increased liabilities.
Hazard analysis The identification of undesired events that lead to the realisation of a
hazard, the analysis of the mechanisms by which these undesired
events could occur and usually the estimation of the extent, magnitude
and likelihood of any harmful effects.
Health, safety and A description of the means of achieving health, safety and
environmental (HSE) environmental objectives.
management plan
Health, safety and The formal review by senior management of the status and adequacy
environmental (HSE) of the health, safety and environmental management system and its
management review implementation, in relation to health, safety and environmental issues,
policy, regulations and new objectives resulting from changing
circumstances.
Term Description
Health, safety and A public statement of the intentions and principles of action of the
environmental (HSE) policy company regarding its health, safety and environmental effects, giving
rise to its strategic and detailed objectives.
Health, safety and The broad goals, arising from the HSE policy, that a company sets
environmental (HSE) strategic itself to achieve, and which should be quantified wherever practicable.
objectives
Heat Flux (heat density) The rate of heat transfer per unit area normal to the direction of heat
flow. A convenient unit is kW m-2 s-1 (1 kW m-2 s-1 = 317 BTU ft-2 h-1).
It is a total of heat transmitted by radiation, conduction and convection.
Heating Rate The rate (normally measured in degrees C per minute) that a sample is
heated.
High (Higher) risk methodology Methodology of assessment appropriate for High Risk installations or
compartments as defined in this Guidance.
Homogeneous In two-phase flow the vapour and liquid phases are assumed to be
travelling at the same speeds and to be mixed uniformly throughout.
Human factors The study and assessment of the impact of systems, equipment and
hazards on human beings. Includes, ergonomic issues, human
reliability and human error assessment.
Hydrocarbon Fire Test A furnace fire test using a time/ temperature curve which supposedly
represents a hydrocarbon fire and which results in an ‘H’ rating for
successful specimens.
Term Description
Incident An event or chain of events which has caused or could have caused
injury, illness and/or damage (loss) to assets, the environment or third
parties.
Incident heat flux The total heat flux from within the flame on an exposed pipe,
equipment, vessel or structure to heat transferred by all heat transfer
mechanisms.
Incident Wave The blast wave as it approaches a structure just before it impacts on its
surface.
Individual Risk (IR) The frequency at which an individual may be expected to sustain a
given level of harm from the realization of specified hazards.
Inventory The quantity and type of fuel stored. A platform inventory lists the fuel
types and total volumes stored on board an installation. The term
inventory is also used to describe the quantity and type of fuel stored in
vessels and pipe assemblies.
IR flame detectors Flame detectors functioning in the infrared region of emitted light from
a flame.
Jet Fire or Jet Flame The combustion of material emerging with significant momentum from
an orifice.
Term Description
Jetting Length The length of a jet flow over which the effects of its initial momentum
are dominant.
Large Deflection Analysis A type of non-linear structural analysis based on the final deflected
shape of the structure rather than the initial, undisplaced shape.
Lift-off That region of a jet flame where the jet discharge has not adequately
mixed with air to combust.
Lift off distance The distance from the discharge point (hole) to where flaming starts.
Liquid spray release High pressure release of a liquid hydrocarbon which gives rise to a
suspension of the fuel in the air similar to a gas cloud which is capable
of deflagration on ignition.
Loss Prevention The general term used to describe a range of activities carried out to
minimize any form of accidental loss, such as damage to people,
property or the environment or purely financial loss due to plant
outage.
Lower flammability limit (LFL) The lower level of gas concentration which will result in combustion of
the gas. This is the same as Lower explosive limit (LEL).
Low risk An installation or compartment identified as being low risk by the risk
installation/compartment matrix and screening method described in this Guidance.
Major Hazard An imprecise term for a large-scale chemical hazard, especially one
that may be released through an acute event. A popular term for an
installation that has on its premises a more than prescribed quantity of
a dangerous substance.
Man machine interface The interaction of human beings with equipment and control systems,
covering issues of ergonomics but also information and alarm
management.
Mass Burning Rate The mass burning rate of a pool fire is the mass of fuel supplied to the
flame per unit time, per unit area of the pool, typically in kg m-2 s-1.
Term Description
may Verbal form used to indicate a course of action permissible within the
limits of a standard.
Medium risk An installation or compartment identified as being low risk by the risk
installation/compartment matrix and screening method described in this Guidance.
Monitoring activities All inspection, test and monitoring work related to health, safety and
environmental management.
Muster area The area (notionally safe) where the crew congregate whilst awaiting
instructions whether to return to the main areas of the installation (i.e.
when safe) or whether to effect an evacuation.
Natural Period The time required for a freely vibrating structure to complete one cycle
of motion.
Natural Ventilation The ventilation of an enclosure by natural means, either through the
action of an external wind or gravitational forces.
Nominal explosion frequency The frequency of occurrence of a release which is ignited and results
in detectable overpressure (>50 mbars). This is used as the top point
in the simplified generation of an exceedance curve - Prexp
Non-Linear Analysis A type of structural analysis that allows the geometry and/or the
material properties to be non-linear.
Offtake The process by which tankers or other mechanisms unload the stored
hydrocarbon from a floating production installation.
Term Description
Overpressure In a pressure pulse (blast wave), the pressure developed above
atmospheric pressure at any stage or location is called the
overpressure. Overpressure is also sometimes used to describe
exposure of equipment to internal pressure in excess of its design
pressure, but the term over-pressurisation is preferred.
Passive Fire Protection (PFP) A coating, cladding or free-standing system that provides thermal
protection in the event of fire and which requires no manual,
mechanical or other means of initiation, replenishment or other
intervention.
Passive Mitigation Mitigation technique that is ‘non-triggered’ and generally utilized the
kinetic energy of an explosion to disperse an extinguishing agent or
suppressant.
Penetration Seal Purpose-made seals or seals formed in-situ to ensure that penetrations
to firewalls do not impair fire resistance.
Phenomenological models Simplified physical models, which seek to represent only the essential
physics of explosions.
Term Description
Plastic Regime That region of structural behaviour dominated by plastic response
rather than elastic response. It is associated with plastic strain and
large plastic deformations.
Pool Fire The combustion of material evaporating from a layer of liquid at the
base of the fire.
Potential loss of life (PLL) The (fractional) number of individuals predicted to become fatalities
over a specified period of time, usually one year.
Preparedness analyses The analysis has to be traceable and will normally, though not
necessarily, be quantitative.
Pressure Burst The rupture of a system under internal pressure, resulting in the
formation of missiles which may have the potential to cause damage,
and perhaps a blast wave.
Pressure difference The pressure difference across an obstacle greater than 0.3 m in the
direction of flow, calculated from the pressure time histories at the front
and back of the obstacle. - Pdiff
Primary means of escape The means of escape which was assumed during design.
Primary Structure The structural components whose failure would seriously endanger the
safety of a significant part of the installation.
Probit equation or model A probit model is a model in which the dependent variable yi can be
only one or zero, and the continuous independent variable xi are
estimated in Pr(yi=1)=F(xi'b). Where b is a parameter to be estimated
and F is the normal cumulative distribution function.
The logit model is the same but with a different cumulative distribution
function for F.
Term Description
Proof Stress The stress at which the plastic strain of a material reaches a particular
value, for example 0.2 %. Proof stress, is a valuable concept in
materials which do not exhibit a sharp yield point.
Quantified risk analysis The quantitative evaluation of the likelihood of undesired events and
the likelihood of harm or damage being caused, together with the value
judgements made concerning the significance of the results.
Quality Assurance All systematic actions that are necessary to ensure that quality is
planned, obtained and maintained.
Quality Control That part of the Quality Assurance which, through measurements,
tests or inspections, ascertains whether a product, service or activity is
in accordance with specified requirements.
Radiative heat flux The measured or calculated heat flux crossing a boundary or surface
due to radiation heat transfer only.
Redundancy analysis The structural analysis indicating which members can be removed
without the collapse of the structure.
Release The type and quantity of fuel which can possibly be ignited.
Reliability The probability that an item is able to perform a required function under
stated conditions for a stated period of time.
Reliability The probability that an item is able to perform a required function under
stated conditions for a stated period of time or for a stated demand.
Representative peak Time averaged over 1.5 ms and space averaged over explosion
overpressure affected area, Prep.
Required endurance time The estimated time for people to travel from their work stations to the
TR, then to the primary or secondary means of escape, allowing for the
possibility of helping injured colleagues.
Term Description
Rise Time The time taken for the overpressure to increase from zero to the peak
overpressure.
Risk The product of the chance that a specified undesired event will occur
and the severity of the consequences of the event.
Risk acceptance criteria (RAC) Criteria that are used to express a risk level that is considered tolerable
for the activity in question.
NOTE - RAC are used in relation to risk analysis and express the level
of risk which will be tolerable for the 9 activity, and is the starting point
for further risk reduction according to the ALARP-principle. Risk
acceptance criteria may be qualitative or quantitative.
Risk analysis The quantified calculation of probabilities and risks without making any
judgements about their relevance.
Risk analysis Use of available information to identify hazards and to estimate the
risk.
NOTE 1 - The risk analysis term covers several types of analyses that
will all assess causes for and consequences of AEs, with respect to
risk to personnel, environment and assets. Examples of the simpler
analyses are SJA, FMEA, preliminary hazard analysis, HAZOP, etc.
Term Description
Risk assessment The quantitative evaluation of the likelihood of undesired events and
the likelihood of harm or damage being caused together with the value
judgments made concerning the significance of the results.
Risk Evaluation The evaluation of the likelihood of undesired events and the likelihood
of harm or damage being caused, together with the value judgements
made concerning the significance of the results and their tolerability,
including issues of risk perception where appropriate.
Risk Issues Issues that impact on the nature and perception of safety related risks
and the role of risk based analysis techniques.
Safety critical element (SCE) Any structure, plant, equipment, system (including computer software)
or component part whose failure could cause or contribute
substantially to a major accident is safety-critical, as is any which is
intended to prevent or limit the effect of a major accident.
Safety objective Objective for the safety of personnel, environment and assets towards
which the management of the activity will be aimed.
Safety Plan All documented policies, standards and practices which the Operator
shall initiate to ensure the activity is planned, organized, executed and
maintained to achieve safety and protect the environment in
accordance with the acts or regulations.
Safety-critical elements (SCEs) As for SCE, those elements of the installation which are critical to
safety.
Sauter mean diameter Defined as the diameter of a drop having the same volume/surface
area ratio as the entire spray.
Screening criteria The values or standards against which the significance of the identified
hazard or effect can be judged. They should be based on sound
scientific and technical information and may be developed by the
company and industry bodies, or provided by the regulators.
Secondary means of escape Means of escape which should be available if the primary means of
escape is not available.
Section Factor The ratio of heated perimeter (Hp) to cross-sectional area (A).
Serviceability Limit A design limit beyond which the structure may become unserviceable,
for example, a specified maximum deflection.
Term Description
Shock Load The load imparted to a structure by a passing shock wave.
Should Verbal form used to indicate that among several possibilities one is
recommended as particularly suitable, J without mentioning or
excluding others, or that a certain course of action is preferred but not
necessarily required.
Shuttle tankers The tankers undertaking the offloading of the stored oil from a floating
installation.
Significant Overpressure An overpressure > 50 mbars, this is the pressure at which pressure
relief panels should operate.
Skin Friction The frictional force caused by the passing fluid flow which acts
tangentially to the surface of the body.
Societal Risk The relationship between frequency and the number of people
suffering from a specified level of ham1 in a given population from the
realization of specified hazards.
Smoothed overpressure Overpressure trace which has been smoothed by using a moving
average over a period of 1.5 milliseconds (1 millisecond or ms equals
one thousandth of a second).
Source terms The characteristics (prior to ignition) of a fluid which affect its
combustion, i.e. the composition, pressure, temperature.
Specific Heat The amount of heat, measured in Joules, required to raise one
kilogram of a substance by one degree C, units are J kg-1 ºC-1.
Stagnation Overpressure The excess pressure above that in the approach flow which occurs on
the front face of a surface where the gas velocity is brought to rest.
Standard Fire Test A furnace fire test using a time temperature curve which simulates a
standard fire and which results in an ‘A’ or ‘H’ rating for successful
specimens.
Term Description
Stoichiometric mix (mixture) Air/fuel mixture is such that it contains exactly the required amount of
oxygen to completely consume the fuel.
Strength level analysis An explosion response assessment where the SCEs including
structure and supports are required to remain elastic. An elastic
method is used for structural response with code/utilization checks as
the performance standard.
Strength level blast (SLB) Representative peak overpressure used to test robustness of
equipment and structure. Elastic structural analysis is appropriate.
Surface emissive power The heat flux emitted from the surface of the flame by thermal
radiation.
System audit Planned and systematic examination of systems to ensure that these
have been established, followed and maintained as specified.
Thermal Analysis A calculation in which the results are temperature distributions for a
given heat input. The heating may be described in terms of either
temperatures or radiation levels.
Thermal Conduction Heat transfer through a medium via random molecular motion.
Threshold overpressure Peak overpressure below which explosion assessment need not be
performed.
Time Domain A solution technique for structural dynamics in which results are
obtained at regular time intervals when a time variable force or other
load is applied.
Term Description
Transmissivity The fraction of the radiated heat that transmits through a medium
(usually the atmosphere).
Turbulent Burning Velocity The burning velocity of the flame when turbulence is present in the
flammable mixture.
Two-Phase Flow A flow in which both the liquid and vapour phases co-exist within close
proximity.
Ultimate tensile stress The ultimate tensile stress of a material is the limit stress at which the
material actually breaks, with sudden release of the stored elastic
energy (released as noise and/or heat and/or more cracks e.g. for
brittle materials).
Unconfined Vapour Cloud Defined as for VCE and is an imprecise term (see Vapour Cloud
Explosion Explosion (VCE) below).
Upper flammability limit (UFL) The fuel concentration above which combustion will not occur. Same
as upper explosive limit (UEL).
UV flame detectors Flame detectors functioning in the ultra-violet region of emitted light
from a flame.
Vapour Cloud Explosion (VCE) The preferred term for an explosion of a cloud made up of a mixture of
a flammable vapour or gas with air in open or semi-confined
conditions.
Term Description
Ventilation Controlled Fire A fire in which the combustion rate is controlled by the availability of
oxygen rather than the supply of fuel.
Venting The escape of gas through openings (vents) in the confining enclosure.
View Factor The proportion of the field of view of a receiving surface that is filled by
a flame.
Volume blockage ratio The ratio of the volume occupied by the obstacles to the total volume.
Volume Production The overall rate of increase in volume caused by the combustion
process.
Water Deluge System A network of small bore pipe work nozzles connected to the firewater
main which is capable of delivering the design water spray to the
protected area.
Water Screen A series of wide angle and/or mist spray nozzles connected to the
firewater main that protect a specific area in the module from the
passage of heat, smoke and billowing flames.
Worst case (explosion) scenario CFD or phenomenological simulation where it is assumed that the
explosion area or compartment is filled with a stoichiometric gas cloud
ignited at the worst position and time.
Written scheme of examination The detailed, formally submitted and monitored scheme of verification
(or verification) required in the UK.
Yield Point The stress at which a steel sample departs from linear elastic
behaviour to plastic deformation in a standard tensile test.
Yield, Dynamic The apparent yield stress exhibited by metals such as steel when they
are strained at a rate which is significantly faster than the normal
testing rate.
Yield, Effective For materials which exhibit no clear yield point, such as mild steels at
elevated temperatures, the stress corresponding to a particular plastic
strain, often 0.2 % (see also Proof Stress).
Annex C Acronyms
Acronym Description
ABS American Bureau of Shipping
ach Air Changes per Hour
AE Accidental event
AFFF Aqueous film forming foam
AIR Average individual risk
ALARP As low as reasonably practicable
ALS Accidental collapse limit state
API American Petroleum Institute
APOSC Assessment Principles for Offshore Safety Cases
ASFP Association for Specialist Fire Protection
ATEX Potentially Explosive Atmospheres (EU Directive)
BDV Blowdown valve
BLEVE Boiling Liquid Expanding Vapour Explosion
BOP Blowout preventor
BRE Building Research Establishment
BS British Standards
BSI British Standards Institution
CAD Computer Aided Design
CAM Congestion Assessment Method
CAP Civil Aviation Publication
CBA Cost benefit analysis
CCPS Center for Chemical Process Safety
CCTV Closed Circuit Television
CEC Commission of the European Community
CEN Comité Européen de Normalisation
CFD Computational fluid dynamics
CIA Chemical Industries Association
CMC Conditional Moment Closure
COLREG Collision Regulations
CoP Code of Practice
D1 - Introduction
This section describes the ways in which operators and maintenance personnel implement
and maintain the systems and practices put in place to manage fire hazards. The following
areas will be reviewed:
• Ergonomics;
• Working conditions;
• Working environment;
• Information presentation and availability;
• Organizational factors including culture.
The designers of fire hazard management systems should optimise the allocation of system
tasks and functions between humans and technology. However, taking tasks away from
personnel is not always the best solution as a number of considerations are involved, for
example:
• The potential consequences of human failure;
• The flexibility that the human can bring to the situation;
• The long-term well-being of the human, the feeling of “being of value and needed”;
• Interest levels and boredom thresholds (leading to enthusiastic engagement to the task
or potentially dangerous disengagement);
• Design to minimise fatigue;
• Clarity and consistency of instrumentation;
• Layout of man/machine interface; and
• Clarity of emergency procedures.
In all areas where the performance of safety critical elements is at stake, operational tasks
must be set within the limits of human operators. Physical stress levels must be acceptable,
for example for turning, lifting, reaching etc. The presentation of information and the issuing of
instructions must be prioritised and unambiguous. Personnel response must be planned in the
context of the hazard.
The two specific Human Factors analysis techniques (items 1. and 2.) are discussed in more
detail below.
Task analyses are the premier technique to confirm that operational and maintenance tasks on
fire hazard management tools and systems were achievable. Task analyses confirm that the
implementation of the emergency response plans can happen within the time scale of an
escalating incident and identifies preferred steps to be taken to intervene to control escalation.
Hierarchical Task Analysis (HTA) and Tabular Task Analysis (TTA) are the two variants of task
analysis techniques that may be applied.
Hierarchical Task Analysis describes the relevant task or operation from its overall objective
down to individual operations.
Tabular Task Analysis identifies the context in which important task steps take place and the
aspects which may be improved. The TTA format concentrates on:
• Cues; which indicate to the operator that a task step can/should be initiated;
• Feedback; which indicates the effects of carrying out a task step;
• Traces; which indicate to the operator that the task step has actually been performed
and finalized successfully.
D2.3 - Human error analyses
Human Error Analysis provides a framework for understanding human errors, their causes and
consequences. Human error analysis is often referred to as the slips, lapses, mistakes and
violations model.
The Action Error Mode Analysis technique resembles the Human HAZOP and identifies
human errors for each task to be analysed. For each task step, possible erroneous actions are
identified using guide words such as ‘omitted’, ‘too early’, ‘too late’, etc. Possible abnormal
system states are identified, in order to consider the consequences of carrying out the task
step (correctly or incorrectly) during abnormal system states (e.g. specific hardware failures).
The consequences of erroneous actions, combinations of erroneous actions, abnormal system
states and possibilities for recovery are identified and described in order to support criticality
ratings.
E1 - Legislation in the UK
The primary legislation governing safety in the workplace is the ‘Health and Safety at Work
Etc. Act 1974 (HASWA)’, [E.1]. This imposes a responsibility on the employer to ensure the
safety at work for all employees. Employers have to take reasonable steps to ensure the
health, safety and welfare of their employees.
Various regulations are enacted under the HASWA. These include the ‘Management of Health
and Safety at Work Regulations 1999’, MHSW [E.2] which place an obligation on the employer
to actively carry out a risk assessment of the workplace and act accordingly. Risks assessed
will include those from fire and explosion.
The Duty Holder must ensure that effective evacuation, escape recovery and rescue will occur
in the case of an explosion event (see Regulations 14 to 17 of PFEER).
The Safety Case Regulations SCR [E.4] require that all installations in UK waters have an
acceptable Safety Case. Information regarding the following issues is required to be
addressed in the Safety Case:-
The Design and Construction Regulations DCR [E.5] amend the SCR by placing a
responsibility on duty holders to prepare a suitable verification scheme for their installations to
ensure independent and competent evaluation of those elements of the installation which are
critical to safety (known as safety-critical elements - SCEs). Performance standards are used
to define the functionality and integrity of these safety critical elements. They define how these
SCEs are expected to function during and after explosion events.
Acceptable safety cases will demonstrate that a structured approach has been taken which:
The structured approach listed above is generic, so that there are no specific requirements for
how an assessment of fire hazards should be carried out.
• Provide an introduction to each topic area, e.g. describing the scope of the review, the
nature of the hazard etc (as appropriate to the topic area);
• Describe the significance of the topic with regard to the risk of major accidents on
offshore installations;
• Summarise current knowledge of the topic (i.e. reference to completed and on-going
research, standards, codes of practice, design guidance etc);
• Based on the results of the knowledge summary and the model capabilities above,
identify areas of uncertainty;
• Summarise current industry practice (i.e. reference to approaches taken in Safety Cases,
extent of implementation of existing codes, guidance etc, awareness of issues);
The strategy document emphasises that individual topics are subject to continuous change
and their priority is not addressed in the strategy document.
• The document presents an overview of the current state of knowledge with respect to
fires and explosions. As would be expected, it is focussed around the hazard rather
giving any specific guidance on designing against it. It highlights that there is still much
uncertainty in certain topic areas and suggests further work in a number of areas.
• Fire, Explosion and Risk Assessment Topic guidance [E.9] - The aim of the guidance is
to promote greater consistency and effectiveness in the assessment of safety cases and
greater transparency for duty holders. It gives guidance to HSE specialist inspectors
assessing those sections of the safety case addressing fire and explosion issues. It
serves as a useful checklist for all persons involved in analysis, design or assessment of
fires or explosions and associated protection methods, to ensure fire and explosion
issues are covered in line with HSE’s expectations.
• Guidance for the Topic Assessment of the Major Accident Hazard Aspect of Safety
Cases (GASCET) [E.10] – This document is intended primarily to assist topic assessors
in undertaking Safety Case assessment activities. It addresses the fire and explosion
hazard as well as other hazard topics and contains useful references to codes and
standard that HSE expect to see Operators using in their design processes.
E3.1 - Introduction
There are additional codes, standards and guidance are available, covering elements related
to the hazard, namely:
Alongside UK legislation, EN ISO 13702 [E.11] also addresses the need to develop a fire and
explosion strategy (FES) which describes the role, essential elements and performance
standards for each of the systems required to manage possible hazardous events on the
installation.
These documents only cover operational leaks rather than accidental releases. They do not
define the extent of hazardous areas from the point of view of explosion and fire risk.
Guidance on the demonstration of ALARP is available throughout this Guidance and from the
following sources;
Principles and Guidelines to Assist HSE in its Judgement that Duty Holders Have Reduced
Risk as Low as Reasonably Practicable [E.19]. http://www.hse.gov.uk/risk/theory/alarp1.htm
HSE Books have published a guide which sets out an overall framework for decision taking by
the HSE (Reducing risks, protecting people) [E.20].
In the case of fire hazard analysis, probabilistic methods appear to be of lesser importance
than for explosions, as the extreme events are not so disproportionately severe and can
largely be prevented or designed against.
In Fire assessment, nominal fire loads and modified code check methods have been in
widespread use for some years. Recent developments have given rise to the consideration of
similar techniques for application in the explosion case.
The required scope of assessment for both conceptual and detailed design may be limited for
installations that can be considered less safety-critical. Simplified assessment methods are
described.
The section on Accidental Actions includes requirements and useful guidance on fire and
explosion hazard management as well as vessel collision, dropped objects and helicopter
crash scenarios. (Natural hazards such as extreme weather and earthquake are dealt with in
other codes.). Although the code will have a very wide audience, ISO 19901-3 is written with
practising project engineers in mind. It makes full use of (and reference to) recently validated
research so as to set out the minimum requirements and to indicate current good practice for
design. Part of the code is Normative (mandatory), whilst the remainder is Informative to
provide additional information about other considerations and to indicate sources of guidance.
Like the API code [E.23], which is proceeding in parallel, the ISO code recognises that the
significance to life from fire and explosion events depends to a large extent on mitigation by
the structural barriers that are fitted to protect the people and safety critical equipment on
board an installation.
There is agreement that the ISO codes for offshore structures should apply across the
European Union and other countries in place of any specific European (CEN) standards.
The IP Guidance addresses the most common causes of loss of containment in process
related systems. These are:
As a result of investigating and understanding the most common failure modes in these areas
the following IP guidelines were issued to assist in avoiding releases:
• Guidelines for the Management, Design, Installation and Maintenance of Small Bore
Tubing Systems [E.30].
• Guidelines for the Avoidance of Vibration Induced Fatigue in Process Pipework [E.31].
In the similar vein of working to reduce the frequency of occurrence of leaks, HSE have
worked with BP and a leading wellhead manufacturer on development of an inherently safer
wellhead design. [E.32].
A catalogue has now been compiled through the Energy Institute [E.35], and is freely available
from the Energy Institute’s website.
E4 - References
E.1 Health and Safety at Work Etc. Act 1974’, Office of Public Sector Information, 1974
E.2 The Management of Health and Safety at Work Regulations 1999, Office of Public Sector
Information, Statutory Instrument 1999 No. 3242
E.3 The Offshore Installations (Prevention of Fire and Explosion, and Emergency Response)
Regulations 1995, Office of Public Sector Information, Statutory Instrument 1995 No. 743
E.4 The Offshore Installations (Safety Case) Regulations 2005, Office of Public Sector
Information, Statutory Instrument 2005 No. 3117
E.5 The Offshore Installations and Wells (Design and Construction, etc.) Regulations 1996,
Office of Public Sector Information, Statutory Instrument 1996 No. 913
E.6 Assessment Principles for Offshore Safety Cases’ (APOSC) HSE Books, 2006
E.7 ‘The Offshore Installations and Pipeline Works (Management and Administration)
Regulations, Office of Public Sector Information, Statutory Instrument 1995 No. 738
E.8 Hazardous Installations Directorate, Offshore Division, “Fire and explosion strategy”,
Issue 1, http://www.hse.gov.uk/offshore/strategy/index.htm
E.9 Hazardous Installations Directorate, Offshore Division, “Fire, Explosion and Risk Assessment
Topic Guidance”, Issue 1, http://www.hse.gov.uk/offshore/fireexp/images/fire_exp.pdf
E.10 Hazardous Installations Directorate, Offshore Division, “Guidance for the topic assessment of
the major accident hazard aspects of safety cases”, April 2006,
http://www.hse.gov.uk/offshore/gascet/gascet.pdf
E.11 EN ISO 13702:1999 ‘Petroleum and natural gas industries – Control and Mitigation of fires
and explosions on offshore production installations – Requirements and Guidelines’,
International Standards Organisation, 1999
E.12 IP 15, Area classification code for installations handling flammable fluids: Model code of safe
practice in the petroleum industry Part 15, 3rd edition, ISBN 0 85293 418 1) was published in
July 2005.
E.13 Equipment and protective systems intended for use in potentially explosive atmospheres
(ATEX), EU Directive 94/9/EC
E.14 The minimum requirements for improving the safety and health protection of workers
potentially at risk from explosive atmospheres (ATEX), EU Directive 1999/92/EC
E.16 BS EN 1127-1, Explosive atmospheres – explosion prevention and protection – Part 1: Basic
concepts and methodology, BSI 1998
E.17 BS 5958: 1991 ‘Code of practice for control of undesirable static electricity’, Parts 1 and 2,
BSI 1991
E.18 Policy and Guidance on reducing risks as low as reasonably practicable in Design
(www.hse.gov.uk/risk/theory/alarp3.htm)
E.19 Principles and guidelines to assist HSE in its judgements that duty holders have reduced risk
as low as reasonably practicable (www.hse.gov.uk/risk/theory/alarp1.htm )
E.20 Reducing risks, protecting people HSE Books 2001 ISBN 071762151 0
(http://www.hse.gov.uk/risk/theory/r2p2.pdf )
E.21 ISO 19901-3 Petroleum and natural gas industries – Specific requirements for offshore
structures – Part 3: Topsides Structure
E.22 API 'Recommended Practice for the Design of Offshore Facilities against Fire and Blast
Loading', API RPFB, 2005
E.23 Recommended Practice for the planning, Designing and Construction Fixed Offshore
Platforms – Working Stress Design, API RP 2A-WSD, 21st Edition. API (American Petroleum
Institute), 2000
E.24 Energy Institute (formerly The Institute of Petroleum), Guidelines for the design and
protection of pressure systems to withstand severe fires, ISBN 0 85293 279 0, 2003
E.25 API RP 520, Sizing, Selection and Installation of Pressure-relieving Devices in Refineries,
Part I, 7th Edition, 2000 and Part II, 5th Edition, 2003
E.26 ISO equivalent of API 521, ISO 23251:2006, Petroleum, petrochemical and natural gas
industries -- Pressure-relieving and depressuring systems, International Standards
Organisation, 2006
E.28 “Guidelines on the Management of Bolted Pipe Joints”, UKOOA/IP document, published by
UKOOA Issue No.1, June 2002
E.30 “Guidelines for the Management of Small Bore Tubing Fittings”, Energy Institute, (formerly
IP), November 2000
E.31 “Guidelines for the Avoidance of Vibration Induced Fatigue in Process Pipework”, (Originally
published by Marine Technology Directorate, available from the Energy Institute (EI),
E.32 M. Copland, J. McKenzie and P. Webb “Improving the Fundamental Safety of Xmas Trees
and Wellheads for Platforms”, Offshore Europe, Aberdeen, 2003
E.34 The Use and Abuse of Passive Fire Protection Offshore, Hilton Aberdeen Treetops,
Aberdeen, Health & Safety Laboratory, Tuesday 28 November 2006
http://www.hsl.gov.uk/news/pfp_prog.htm
E.35 Energy Institute, “Offshore technical guidance catalogue with specific relevance to major
accident hazards: home page” http://www.energyinst.org.uk/offshorecatalogue/
F1 - Introduction
Traditionally large-scale experiments were carried out to study fires. However, mathematical
modelling of fires is now becoming the preferred tool, due to the high cost associated with
large-scale experiments. Computational Fluid Dynamics (CFD) modelling done properly is not
cheap and there are outstanding uncertainties associated with the physical sub-models
implemented in the code. Modelling and experiments are mutually exclusive, but should be
viewed as complementary tools.
The very rapid development of faster computer processors and more memory at reasonable
prices enables the user to use finer meshes that will yield to solutions that are more accurate.
The development of physical sub-models is not as rapid, but there are, nevertheless, some
interesting models coming on-stream – some of which are only now becoming feasible to use
due to the improved performance of the computers.
There are two important steps to complete before any model can be used in anger and its
results to be trusted: verification – ensuring that the correct equations with correct source
terms are solved, and validation – showing the model’s accuracy. It is rare to find that the
models are not verified. The validation process is time-consuming, expensive and laborious –
validation is often incomplete. The lack of validation of the fire models was recognised by the
Model Evaluation Group, part of a CEC sponsored project on fire modelling. The outcome of
the Modelling Evaluation Group was a number of documents outlining minimum requirements
for validation of jet fire models. The pool fire models did not undergo the same level of
scrutiny, though most of the points made on jet fire model validation also apply to pool fire
models.
F2 - Types of model
F2.1 - General:
There are a number of mathematical models of varying level of complexity that can be used for
modelling hydrocarbon fires on offshore installations:
• Probabilistic models
• Empirical models
• Zone models
• CFD models
• Evacuation models
• Video analysis
There are limitations with empirical correlations. Only very simple configurations can be
modelled. The models cannot take account of buildings and other structures, or the
topography of the site. The estimates could be conservative, but it cannot be guaranteed to be
the case for all situations. This type of model is only valid for the fuels and conditions that were
studied in the experiments. One should therefore be wary of extrapolating the results to
situations not covered in the experiments.
Zone models are also limited to modelling relatively simple geometries. The models should not
be used for fuels or conditions that were not covered in the experiments.
Routine calculations are usually carried out using either the k- model, k-ζ model or Menter’s
SST model. The weaknesses of these models are well documented. The models are
sometimes applied in situations where it would be advisable to use some other turbulence
model. Nevertheless, these models do quite well in many applications. While the models might
not be able to provide very accurate results at all times they nevertheless provide the
opportunity to study trends, i.e. how geometrical changes might affect the solution.
It might be sensible to reduce the problem size, by only considering a subset of the
installation. It is not feasible to model the whole offshore installation, including parts of the
surroundings, as well combustion, multi-phase or single-phase flow, phase change in the
vessels subjected to impact of a jet fire with a CFD model. The run times would be
prohibitively long. There are also large uncertainties in some of the physical sub-models in the
CFD codes that make the use of CFD less attractive.
A more in-depth review of the various modelling techniques has been carried out by the Health
and Safety Laboratory, both in terms of current industry standard and of state of the art and
much of this information is reproduced in this annex. The emphasis is on the CFD models as
these incorporate the most realistic representations of the physical processes. There is a
definite need to revise the assessments of applicability of the modelling techniques as the
models and the available computer resources develop further.
F2.8 - Miscellaneous
In light of uncertainties with the various types of models, it might be prudent to carry out
simulations where a zone model and a CFD model can provide input to and output to each
other.
Ideally a great number of scenarios, different wind directions, wind speeds, release locations,
release directions, need to be investigated. This is not feasible to do with CFD due to the long
computer runtimes. The use of simpler models as scoping tools could highlight scenarios that
warrant an in-depth investigation with CFD. It is vitally important that the simple model
includes all the important physical processes. Therefore the suitability of a simple model as a
scoping tool will have to be assessed on a case-by-case basis.
Traditionally fluid flow modelling and structural analysis have been carried out separately.
However, it would be desirable to model, say, escalation due to the collapse of parts of the
structure, i.e. Fluid-Structure Interaction (FSI). It is now more feasible to integrate the two
types of modelling due to the availability of faster computers with large memory, and FSI is
therefore finding increasingly widespread use. Nevertheless, the computer runtimes are
roughly an order of magnitude greater than for a comparable fluid flow simulation. There are a
number of different packages in which the fluid flow solver and the structures solver are fully
integrated. Filters for converting the fluid flow results into something that can be read by the
structural analysis code enabling the coupling of separate a fluid flow and structural solver are
also available. Some of the integrated fluid flow solvers are limited to inviscid flows and are
thus not suitable to fire modelling. The required outputs from the CFD code are heat fluxes,
concentration of toxics, transport of toxic products and provision of output from a fluid flow
simulation using CFD in the correct format to be used in structural analysis using a Finite
Element code.
Routine calculations are usually carried out using either the k-ε model, k-ζ model or Menter’s
SST model. The weaknesses of these models are well documented. The models are
sometimes applied in situations where it would be advisable to use some other turbulence
model. Nevertheless, these models do quite well in many applications. While the models might
not be able to provide very accurate results at all times they nevertheless provide the
opportunity to study trends, i.e. how geometrical changes might affect the solution.
The choice of multi-phase model depends on the flow, i.e. whether it is a gas-liquid, gas-solid,
liquid-solid or a gas-liquid-solid system. The fraction of dispersed phase is also of importance
when choosing which model to use. When dealing solids and droplets that have are not mono-
disperse, i.e. distribution of different sizes, one would not normally attempt to follow each
individual particle or droplet but rather consider groups of particles, with all particles in each
group having same size and properties. Two situations that are of particular importance on an
offshore installation are when a jet release is made up of gas and condensate, where both
phases are combustible, and water mitigation. For larger problems the dispersed phase is
treated as continuous, i.e. as a part of the bulk fluid.
A two-flow model, where the phases have different momentum, energy and heat, and the
inter-phase exchange of these quantities represent state of the art. However, there are great
uncertainties associated with the modelling of the interfacial information transfer between the
phases. A transported-PDF method where a velocity-scalar PDF is combined with either LES
or Reynolds Averaged Navier-Stokes could be used to model dispersed multi-phase flows.
There are uncertainties associated with the modelling of combustion processes. Some of
these are related to the complexity of the chemical kinetics, with a large number of
intermediate species and reactions describing the combustion of even the simplest
hydrocarbons, and the lack of understanding of the processes involved. Further uncertainty is
introduced, as it is not possible to accurately resolve the flame front for flows considered in the
present report. The simpler combustion models introduce constants that are not universally
applicable and need to be adjusted for each fuel.
Industry standard: Routine simulations of combusting flows usually involve the use of the
Eddy Dissipation Model or, less likely, a laminar flamelet model with a prescribed PDF, for
non-premixed combustion, and the Eddy Break-Up (EBU) model for premixed combustion and
the Zimont model for partially premixed or premixed combustion. Fires are also sometimes
represented by a volumetric heat source. This will provide a means of heat release (location
and magnitude) but will not provide any information of the amount of toxic products that are
produced.
State of the art techniques in gaseous combustion modelling are the Probability Density
Function (PDF) approach and the Conditional Moment Closure (CMC) model. The PDF
method involves solving a transport equation for the PDF. This is then coupled to a detailed or
reduced chemical kinetics scheme. However, these calculations place great demands on the
available computer resources. The need for detailed treatment of chemical kinetics in fires in
offshore installations is not likely to great. The CMC model can also be used to represent
detailed chemical kinetics and does not place the same demand on the computer resources as
the PDF transport approaches
Industry standard: It would appear that relatively simple combustion models, such as mixed-
is-burnt or Eddy Break-Up-type models, are being used. Heavier hydrocarbons are well
characterised and will of course change with time and location of the wellhead within each
reservoir. The complexity of the combustion of heavier hydrocarbons makes it intractable to
attempt to use more sophisticated combustion models.
State of the art: It might be possible to use a transported PDF method with either detailed or
reduced chemical kinetics or the Conditional Moment Closure model. However, no references
to combustion modelling of mixtures of heavy hydrocarbons using either of these two methods
have been found in the open literature.
Industry standard: One cannot afford model the combustion of each individual droplet in a
spray. However, a Eulerian-Lagrangian approach where one tracks groups of droplets, and
particles in each group have the same size and properties might be feasible. The actual
combustion would be modelled using a simple combustion model, i.e. mixed-is-burnt, Eddy
Dissipation or the Zimont model.
Conduction of heat is of great importance. One possible scenario is when a jet fire impacts on
a vessel. Passive Fire Protection (PFP), i.e. coating of process equipment and vessels, is
used to protect the equipment from the fire. However, PFP ages and is affected by the
weather. There is also a risk that the coating is removed due to the erosive effect exerted by a
high momentum jet. The subsequent heating up of the content of the vessel could lead to
pressure build-up due vaporisation of hydrocarbons.
The complexity of the problem that involves fluid flow, combustion, heat conduction (possibly
with deteriorating PFP) and phase transition makes this problem intractable for CFD models in
many cases. It might be feasible to combine the CFD model with a zone model that can
provide the conditions in the vessel.
F3.4.2 - Convection
Convection plays a very important part in the heat transfer processes from a fire. The
momentum imposed on the plume greatly affects where and how fast the hot exhaust gases
travel. This has implications for the evacuation of personnel. The use of wall functions is the
industry standard for modelling convective heat transfer at walls. These wall functions have
usually been derived for natural convection. The state of the art wall functions are the
scaleable wall functions that are more accurate than the old equilibrium wall functions. CFD
modelling of smoke transport carried out at Cambridge University and HSL showed that the
choice of convective heat boundary condition greatly affects the flow, i.e. wall functions should
be modified to account for forced convection if the heat transfer is a combination of forced and
natural convection.
F3.4.3 - Radiation
Industry standard: The Discrete Transfer Model (DTM) is frequently used and offers accurate
predictions at a relatively reasonable cost. Though there is a trade-off between accuracy and
speed, as more rays used will up to a point result in more accurate radiative flux predictions.
Also frequently used are radiation models based on the Discrete Ordinate Model which solve
the radiative energy transfer equation for a number of solid angles. Another commonly used
simple model is the P1 radiation model that was developed for coal combustion.
State of the art in radiation modelling is stochastic modelling using Monte Carlo simulations
with either a narrow band or a wide band model. This is an expensive technique, but it is
suitable for complex geometries and is potentially a very accurate method. The accuracy is
dependent on the number of rays used.
The term “toxics” encompasses many products of combustion including carbon monoxide,
soot and smoke. It is important to be able to model the movement of these toxic substances,
as it can be used to determine how long time the occupants have before, say, the smoke
concentration becomes too high, and thus provide information upon which to draw up an
emergency evacuation plan. Dispersion of toxic products can be modelled in a number of
ways. CO and smoke are frequently treated as a single passive scalar, respectively. There are
correlations that would provide an estimate for the amount of CO and smoke produced by a
particular fuel. It is also possible to model the production of CO and smoke via a combustion
model, i.e. Eddy Dissipation model. Soot can also be modelled with a version of the Eddy
Dissipation model that has been adapted to soot modelling. A more sophisticated approach is
to use a laminar flamelet method. It is then necessary to solve two transport equations for
mixture fraction and mixture fraction variance and two transport equations for the soot volume
fraction and soot number density. LES and DES techniques are likely to be used for modelling
of smoke transport, but the high computational cost of LES and DES will probably preclude the
use of these approaches for modelling of an entire offshore installation.
F4 - Miscellaneous issues
F4.1 - General
Committee of the European Community (CEC) sponsored a project in the area of Major
Industrial Hazards with the aim to establish suitable criteria and procedures for model
verification and validation, surveying the state of the fire models for jet fires and pool fires, and
propose further development and validation of the physical sub-models. This Model Evaluation
Group (MEG) held a number of open meetings where mode developers and academics
discussed the state of fire modelling at great length. Unfortunately, the pool fire models were
never properly assessed. The jet fire models on the other hand were scrutinised a much detail.
A number of recommendations for how the models should be validated and the results of the
validation studies be reported were presented.
F4.2 - Verification
The purpose of the verification process is to show that the correct transport equations are
solved, i.e. that all the important terms have been included in the equations.
Most CFD codes and the models implemented therein will have been verified.
F4.3 - Validation
Definition: Validation is the process of demonstrating that the model provides a sufficiently
accurate representation of the real world.
Validation is a very difficult, costly and time-consuming exercise. One of main difficulties lies in
that there are an infinite number of different scenarios that ideally should be investigated. This
is clearly not feasible. It is therefore important to select a set of representative scenarios that
are run each time a new release of the code is due to be distributed. There should be no
differences in the results obtained with the old and news releases unless bug fixing to a
particular, relevant model has been carried out. The results should be investigated if there are
any differences between two solutions.
• Mesh quality;
• Computational cell size in the near-wall region;
• Grid dependency;
• Ray dependency (radiation model), if applicable;
• Time step dependency, if transient simulation;
• Convergence;
• Sensitivity to choice of boundary conditions, if applicable;
• Settings of turbulence and combustion model constants;
• Effects of choice of spatial and temporal discretisation methods on the solution; and
• Inclusion of buoyancy in the transport equations for momentum and turbulence
quantities.
These factors should always be taken into consideration in CFD simulations. It is important
that reports describing CFD modelling should also include this information, to show that these
factors have been investigated. There are a number of guidance documents on the use of
CFD for various types of flows; ERCOFTAC has produced a document providing Best Practice
guidelines on the general use of CFD, Casey and Wintergeste (2000) [F.1]; NAFEMS has also
produced guidance document on the general use of CFD, NAFEMS (1996) [F.2] and HSL has
produced a Best Practice guidance on modelling of smoke transport, Gobeau et al. (2002)
[F.3].
The use LES to model combusting flows has increased greatly, though there are concerns
over the coarseness of the meshes that are used in the calculations. Many simulations using
an LES technique are also not run for a sufficiently long time (in real-time) to provide reliable
flow statistics. The DES or similar hybrid technique combining LES and a simple turbulence
model will find increased use and be applied to combusting flows, as a great deal of effort is
going into further refinement of the models. DES-like techniques are also better suited to wall-
bounded flows than LES.
There is great uncertainty in the modelling of interfacial transfer of momentum, heat and mass
between different phases. It is also very difficult to measure interfacial transfer of momentum,
heat and mass between different phases in experiments. This is an area that should see
improvements as more sophisticated measurement techniques are employed. However, it may
be necessary to be to resolve the interface between the different phases, which would
significantly increase the computational overhead, in terms of computer runtimes and memory
requirement.
F5 - References
F.1 Casey, M., and Wintergerste, T., Special Interest Group on Quality and Trust in
Industrial CFD – Best Practice Guidelines, ERCOFTAC, 2000
F.2 NAFEMS, CFD Analysis: Guidance for good practice, NAFEMS Document Ref. No.
R0063, 1996
F.3 Gobeau, N. Ledin, H. S., and Lea, C. J., Guidance for HSE Inspectors: Smoke
movement in complex enclosed spaces - Assessment of Computational Fluid
Dynamics, HSL Report No. HSL/2002/29, 2002
F6 - Further reading
Carregal Ferreira, J., Forkel, H, Bender, R., Menter, F. R., Improved LES-, DES- and SAS-
Models for the CFD-Simulation of Chemically Reacting Flows, EROFTAC Bulletin No. 64,
pp. 57-60, 2005
CRC, The Handbook of Fluid Dynamics, Ed: Johnson, R. W., CRC Press/Springer Verlag,
Boca Raton, FL, USA, 1998.
Model Evaluation Group, Model Evaluation Group – Report of the Second Open Meeting,
Cadarache, France, 19 May, 1994, EU Report No. EUR 15990 EN 1995a
Model Evaluation Group, Protocol for Model Evaluation, Commission of the European
Communities, DG-XII, Brussels, 1995b
Model Evaluation Group, Guidelines for Model Developers, Commission of the European
Communities, DG-XII, Brussels, 1995c
Annex G Checklists
Oil/condensate Export pump arrangements • The pump seals and the complex jointed piping leak
pressurisation for export may use one or two pumps to a high likelihood of a release.
in series, pumps may be • Releases on the high pressure sides of the pumps
duplicated with manifold may be significant.
arrangements. These
complex piping • Operator error or other hazards arising from the role
arrangements can give an and status of stand-by pumps (how they are
isolated inventory of up to 15 switched in and out and how they are left,
tonnes for a field with large pressurised or not?).
throughput. • The inherent design of the plant requires the pumps
to be located close to the lowest level of the
platform, often beneath the separators. May cause
low level external flaming, smoke affecting most of
the topsides and escalation to the inventories above.
Gas drying This will use either glycol • Some potential for local escalation, due to failures of
units or molecular sieves small bore instrumentation and associated piping.
and can operate at up to 60 • Release potential/severity can be minimised using
barg. The largest inventory depressurisation.
is likely to be a contactor
with up to 3 tonnes of gas.
High pressure export, Typical pressure for these • Some potential for local escalation, due to failures of
gas lift and re-injection systems is 150 barg but can small bore instrumentation and associated piping.
compression be as high as 400 barg for • Release potential/severity can be minimised using
some re-injection depressurisation.
requirements. Inventories
typically 1-3 tonnes. • Potential vibration may cause premature fatigue for
attached piping.
• Operator error or other hazards arising from the role
and status of stand-by compressors (how they are
switched in and out and how they are left,
pressurised or not?).
Oil and gas metering Metering is generally carried • Equivalent to piping with additional potential release
out using inline flow meters. sites at the instrument connections.
• Generally robust systems although running at export
pressures and flow rates.
• Hazards may be introduced by lack of understanding
how the process runs when they require
maintenance or re-calibration. The production may
be recycled to avoid a shut-down, especially in
F(P)SOs where storage capacity is available and
held for later export.
Have historically been used for Location in an air intake duct is an arduous duty
detection of gas in air supply for this type of detector Executive action occurs
ducts to enclosed areas on 2oo3 voting. Access for frequent
containing unclassified electrical maintenance and testing is essential. I/R point
equipment or other potential detector with duct probe or I/R open path
sources of ignition but not detector are now available, and better, for this
recommended now IR, beam service.
detectors available.
Not very effective for small leaks in open areas.
In this situation use in conjunction with acoustic
detectors.
Susceptible to drifting if not regularly checked
and maintained, leading to unnecessary shut-
downs.
Unless the gas comes into direct contact with
the detector head it will not operate so numerous
detectors, suitably located are required. Vapours
heavier than air require detector location at floor
level. For natural gas releases, detectors need a
high level location.
Must be calibrated and located appropriately for
the vapours they are designed to detect.
Calibration settings for LNG (methane), LPG
(propane), condensate and hydrogen are all
different. Heavier or lighter than air gases
require increased numbers of detectors and
present difficulties positioning to avoid damage
at low level and maintenance access at high
level.
Note: On older installations where there is heavy reliance on pellistor type detectors, consideration should be given to
setting the devices to give initial (low level) alarm at a levels just above the anticipated drift range of the device and high
level alarm slightly above that. Operators have found that alarm at 10 to 20 % LEL and executive action at 25 to 40 % is
feasible for a well maintained system. This gives an added margin of safety while avoiding nuisance alarms. Different
set points will be necessary for different applications. The suitability of the set point each application should be
documented, and not automatically assumed to be 20 % LEL for low level and 60 % for high level alarm.
Low
LowComplexity
Complexity Medium
MediumComplexity
Complexity High
High Complexity
Complexity
Key
KeyTechnique
Technique Method
Method Method
Method Method
Method
•• Emission
Emissionmodelling
modellingtotoestimate
estimatelikelihood
likelihoodof
of •• Use
UseCFD
CFDto toanalyse
analyseemission
emissiondispersion,
dispersion,influence
influence
mixture
mixturebuild-up
build-upwithin
withinenclosure
enclosureusing
usingCSTR-
CSTR-
A.
A. Scenario
Scenario •• Simple
SimpleIdentification
Identification of
ofwind,
wind,local
localconcentrations
concentrationsand
andingress
ingressfrom
from
style
stylecalculations,
calculations,ESD
ESD//Blowdown
Blowdown
Identification
Identification appropriate
appropriatefor
forinstallation
installation neighbouring
neighbouring volumes to arriveat
volumes to arrive atscenario
scenario
•• Effect
Effectof
ofwind
windononmixture
mixturebuild-up
build-up definition.
definition.
•• Special
Specialsituations
situations--external
externalexplosions
explosionsetc.
etc.
•• Represent
Representequipment,
equipment,vessels
vesselsand
andpipework
pipework
•• Simple
Simpleestimate
estimateof ofventing
ventingand
and •• Use
UseCAD
CADto torepresent
representmodule
moduleinternals.
internals.
down
downto toaalevel
levelappropriate
appropriatefor
for
congestion
congestionisisrequired
requiredto
tojudge
judge •• Model
Modelall
alllocal
localturbulence
turbulenceand
andflame
flamepropagation
propagation
phenomenological
phenomenologicalmodelling
modellingtool.
tool.
whether
whetherexplosion
explosioncancanoccur.
occur. effects
effectsusing
usingmesh
meshmodel
model
B.
B. Blast
BlastAnalysis
Analysis •• Define
Defineexplosion
explosionexceedence
exceedenceusing
usingignition
ignition
•• Discourage
Discourageuseuseof
ofventing
venting •• Define
Defineaadistribution
distributionofofleak
leaksources,
sources,release
releasehole
hole
point
pointarray
arrayororother
otherempirical
empiricalmethod
methode.g.
e.g.
model
model sizes,
sizes,wind
winddirections
directionsto
togenerate
generateananoverpressure
overpressure
historical
historicaldata.
data.
•• Use
Useof
ofhistorical
historicalcomparison
comparison exceedence
exceedencecurve.
curve.
•• Model
Modelshould
shouldbebeable
ableto
toassess
assessmitigation
mitigation
•• Assess
Assess“basecase”
“basecase”overpressure
overpressurefor foriteration,
iteration, •• Assess
Assess“basecase”
“basecase”overpressure
overpressureforforiteration,
iteration,
based
basedononestimate
estimateof
ofpracticable
practicablelimit
limitofof based
basedononanananalysis
analysisand
andreview
reviewof
ofpracticable
practicable
C.
C. Blast
BlastImpulse
Impulse •• Assess
Assess//estimate
estimateworst
worstcase
case protection.
protection. design
designlimits
limitsof
ofstructure
structure
Selection
Selection blast
blastimpulse
impulse •• Consider
Consideruncertainty
uncertaintyaffects
affects •• Iterate
Iterateby
byassessing
assessingallalllocal
localand
andglobal
globalexplosion
explosion
•• Iterate
Iterateby
byassessing
assessingeffect
effectof
oflayout
layout&&structural
structural effects
effectsand
andpotential
potentialrisk
riskreduction
reductionstrategies
strategies
risk
riskreduction
reductionmeasures
measures
•• Has
Hasaadetailed
detailedescalation
escalationanalysis
analysisbeen
beencarried
carriedout
out
•• Has
Hasassessment
assessmentof ofescalation
escalationpotential
potentialbeen
been that
thatconsiders
considersthetheeffect
effectof
ofblast-induced
blast-inducedSCE
SCE
D.
D. Assessment
Assessmentof
of •• Direct
Directimpact
impactof
ofPersonnel
Personnel made?
made? failure
failure(structure
(structure++designated
designatedsystems)
systems)ononthethe
Explosion
Explosion •• Direct
Directimpact
impacton
onSCEs
SCEs •• Is fatality estimation method realistic for the
Is fatality estimation method realistic for the emergency
emergencyresponse
responsefunctions
functions
Consequences
Consequences module
moduletype?
type? •• Consider
Considerexternal
externalexplosions,
explosions,blast-funnelling,
blast-funnelling,far-
far-
field
fieldoverpressures
overpressures
•• Use
Usemodel
modeltotoassess
assessthe
theeffect
effectof
ofchanges
changesinin
•• Use
Usemodel
modelto toassess
assessthe
theeffect
effectof
ofequipment
equipment layout
layoutand
andventing
ventingareas.
areas.
location
locationchanges.
changes.
D.
D. Layout
Layout •• Best
Bestpractice
practicee.g.
e.g.EN
EN •• Show
Show that
thatlocal
localBOPs
BOPsandanddrag
dragforces
forcesare
arenot
not
•• Assess the effect of changing wall location,
Assess the effect of changing wall location,
Optimisation
Optimisation ISO13702
ISO13702etc..
etc.. excessive.
excessive.
removal
removalof ofblockages
blockagesandandcongestion
congestion •• Consider
Considerexternal
externalexplosions
explosionsand
andbang-box
bang-box
reduction.
reduction. ignitions.
ignitions.
•• Non-linear
Non-linearstructural
structuralanalysis
analysistotodemonstrate
demonstrate
•• Use
Usesimple
simplequasi-static
quasi-staticload
load •• Use
Usedynamic
dynamicanalysis
analysistotoassess
assessvibration
vibration residual
residualstrength
strengthofofstructure.
structure.
E.
E. Structural
Structural&& analysis
analysiswith
withworst-case
worst-caseblast
blast magnitudes.
magnitudes. •• IsIsthe
the structural response coupledto
structural response coupled tothe
theblast
blast
Equipment
Equipment impulse estimate
impulse estimate toto •• Assess overall drag forces on SCEs.
Assess overall drag forces on SCEs. analysis
analysis
Optimisation
Optimisation demonstrate
demonstratestructural
structural •• Check
Checkfor
forlocal
localplastic
plasticdeformation
deformation&&assess
assess •• Piping
Pipingstress
stressanalysis
analysisusing
usingselected
selectedBOP
BOPpulse
pulseto
to
integrity.
integrity. against
againstredundancy.
redundancy. demonstrate
demonstrateprocess
processintegrity.
integrity.
•• Use
Usesemi-quantitative
semi-quantitativearguments
argumentsto to
•• Demonstrate
Demonstratebest
bestpractice
practiceinin demonstrate
demonstrateALARP
ALARPfor forstructural
structural&&equipment
equipment •• Use
Userobust
robustQRA
QRAtotofully
fullyjustify
justifythat
thatno
nofurther
further
F.
F. ALARP
ALARP layout,
layout,equipment
equipmentselection
selection protection.
protection. measures
measurescancanbe
betaken
takento toreduce
reduceexplosion
explosionrisks
risks
Assessment
Assessment and
andso
soon.
on. •• Use
Useofofcase-by-case
case-by-caseCBA
CBAto toassess
assessthe
theworth
worth further,
further,supported
supportedby
byCBA.
CBA.
of
ofupgrading
upgradingblast
blastprotection.
protection.
High sophistication methods may be used where more sophisticated methods of assessment
which may result in reductions in conservatism and hence cost are considered more
appropriate.
What are the The inspector should establish that the safety case has explored the practicable
practicable limits for overpressure protection on the basis of the worst-case overpressure and
protection any probabilistic analysis. Is it possible to design for the worst-case, even though
limits? this is a remote event? This goes a long way to removing uncertainty.
Note that SCEs located in non-hazardous or safe areas are vulnerable to blast-
induced acceleration.
Check for local Points to consider in the assessment are:
plastic
deformation and • Has the structural design accounted for heavy explosion loads giving rise
redundancy to plastic deformation;
• Has sufficient redundancy been build into the structure;
• Has the effect of plastic deformation on SCEs been accounted for in the
Safety Case?
ALARP Is cost-benefit For larger, more complex installations, it is envisaged that these require greater
Assessment analysis used to risk exposure on the part of operations POB to inspect and maintain the plant
assess risk items. As exposure increases, so the use of cost-benefit analysis (CBA) becomes
reduction more meaningful. Care is needed to ensure that the analysis is conservative, and
measures? Is it that the criteria used are valid. Conservatism in cost-benefit analysis relates to
conservative? ensuring:
• Costs associated with implementing remedial measures are not over-
stated (some remedial measures can be implemented as part of an
ongoing scope of work and so offshore mobilisation costs etc. are
therefore not applicable);
• POB exposure is not underestimated;
• Gross disproportion is accounted for;
• Where benefits are marginal, other losses - production and so on - are
accounted for. These could point to a conclusive overall benefit.
The costs of risk reduction measures require careful "reality" checking, so that the
benefit is accurately measured. Where the results of CBA are counter to historical
experience, the duty holder must show that the preferred way forward follows best
practice.
Typical PDUQ platforms, FPSOs, platforms where it is clear that the potential for
Application escalation exists
Typical PDUQ platforms, FPSOs, platforms where it is clear that the potential for
Application escalation exists
Blast Impulse What is the CFD codes require a lot of computing power to operate and run times are lengthy.
Magnitude methodology for At present this probably precludes a full probabilistic analysis arriving at an
Selection selection of exceedance curve, as the number of runs required to build up a convincing
lower-than- dataset would be prohibitively time-consuming. CFD codes are of most use in
Worst-Case determining local overpressure effects.
blast impulse
magnitude for A transfer function can be arrived at, by combining CFD results at local locations
design? to the exceedance calculation results from a phenomenological model. These can
then be used to provide an exceedance curve for a given location - or SCE.
A database of dispersion and overpressure results can be used as a basis of a
probabilistic analysis. It is clear that effort is being directed to using CFD codes to
input to a probabilistic analysis; the inspector must be aware of these and assess
whether the installation Safety Case under scrutiny has used such tools in the
ALARP demonstration. (See Scenario Identification / General for the duty holder's
requirement to ensure they obtain competent consulting support where
necessary).
How have It is likely that overpressures in complex multi-module installations can rise to high
practicable values. SCE protection may not be practicable for the worst-case. The
protection limits assessment must show that sufficient structural and piping stress analysis has
been been carried out to determine ultimate strength for the applied load. This will
determined? naturally lend itself to determining whether additional strength can be built into the
structure and supports in line with cost-benefit analysis.
Assessment of Has a detailed At this level, an attempt should be made to properly demonstrate the effect of SCE
explosion escalation failure on the capability of the emergency response functions of the installation
consequences analysis been and ultimately the individual and group risk levels. This is additional to the simple
carried out? calculation of direct and indirect fatality referred to in the Medium Complexity
checklist. It is only by fully considering the effect on SCEs that full cost-benefit
analysis of explosion risk reduction measures can be carried out.
Layout Show that local The blast analysis should be of a suitable degree to identify areas of locally high
optimisation overpressures overpressures. Evidence should be presented that the layout has been optimised
and drag forces to reduce these potentially damaging local overpressures to a tolerable level in
are not order to demonstrate ALARP.
excessive
Typical PDUQ platforms, FPSOs, platforms where it is clear that the potential for
Application escalation exists
Annex H Acknowledgements
Note: All affiliations are shown as existed at the time of the contribution.