NEBOSH IOG1 Element3

NEBOSH
International Technical Certificate in Oil and Gas Operational Safety

Unit IOG1: Management of international oil and gas operational safety
Element 3: Hydrocarbon process safety 2

Contents
3.0 Learning outcomes............................................................................................................................ 5

3.1 Failure modes.................................................................................................................................... 6
Forces on materials ............................................................................................................................ 6
Creep................................................................................................................................................... 6
Stress and strain ................................................................................................................................. 7
Effects of loading ............................................................................................................................ 8
Principle sources of stress .............................................................................................................. 8
Stress corrosion cracking .................................................................................................................... 9
Thermal shock..................................................................................................................................... 9
Brittle fracture .................................................................................................................................. 10
Failure of the annular rim ................................................................................................................. 11
The safe operating envelope ............................................................................................................ 11
Applying knowledge of failure modes to the design and operational phases ................................. 12
3.2 Other types of failure ...................................................................................................................... 14
Weld failures..................................................................................................................................... 14
Visual inspection of welds ................................................................................................................ 14
Non-destructive testing .................................................................................................................... 15
Summary of the advantages and disadvantages of different NDT techniques............................ 17
3.3 Safety critical equipment controls .................................................................................................. 19
Safety control ................................................................................................................................... 19
Process equipment controls ......................................................................................................... 19
Fire and gas controls .................................................................................................................... 20
Drilling systems ............................................................................................................................ 20
Emergency shutdown equipment and systems ............................................................................... 21
Levels of shutdown ...................................................................................................................... 22
Procedures for bypassing ESDs .................................................................................................... 24
Safety integrity levels for instrumentation....................................................................................... 25
Blowdown facilities and flares .......................................................................................................... 26
Blowdown..................................................................................................................................... 26
Flaring ........................................................................................................................................... 26
© Astutis Ltd NEBOSH IOGC 2

Unit IOG1 Element 3
Types of flare ................................................................................................................................ 27
Monitoring flaring ........................................................................................................................ 28
Drains, sewers and interceptors ....................................................................................................... 29
Open drains .................................................................................................................................. 29
Closed drains ................................................................................................................................ 29
Sewage ......................................................................................................................................... 29
Process drain water ...................................................................................................................... 29
Interceptors .................................................................................................................................. 30
3.4 Safe storage of hydrocarbons ......................................................................................................... 31
Hazards and risks .............................................................................................................................. 31
Overfilling ..................................................................................................................................... 31
Effects of pressure and vacuum ................................................................................................... 31
Failure of tank shells..................................................................................................................... 31
Types of storage tanks ...................................................................................................................... 32
Floating roof ................................................................................................................................. 32
Fixed roof storage tanks – design and construction .................................................................... 33
Bunding of storage tanks.............................................................................................................. 34
Filling storage tanks .......................................................................................................................... 35
Pressurised and refrigerated vessels ................................................................................................ 36
Loss of containment and its consequences ...................................................................................... 37
Jet fires and pool fires .................................................................................................................. 37
Hydrocarbon vapour clouds ......................................................................................................... 38
Boiling liquid expanding vapour explosions (BLEVEs) .................................................................. 40
Confined vapour cloud explosion (CVCE) ..................................................................................... 41
Unconfined Vapour Cloud Explosion (UVCE) ............................................................................... 42
Preventing vapour cloud explosions ............................................................................................ 43
Pipelines ....................................................................................................................................... 44
Decommissioning ............................................................................................................................. 46
Decommissioning – onshore ........................................................................................................ 46
Decommissioning – offshore ........................................................................................................ 47
Environmental issues associated with decommissioning operations .......................................... 50
Management of simultaneous operations ....................................................................................... 52
3.5 Fire hazards, risks and controls ....................................................................................................... 53

Unit IOG1 Element 3
The fire triangle ................................................................................................................................ 53
Classification of fire .......................................................................................................................... 54
How an explosion or fire will occur .................................................................................................. 56
Stages of combustion ....................................................................................................................... 57
Fuel sources ...................................................................................................................................... 59
Solids ............................................................................................................................................ 59
Liquids .......................................................................................................................................... 59
Gases ............................................................................................................................................ 59
Oxygen .............................................................................................................................................. 60
Fire initiators..................................................................................................................................... 60
Principles of fire and explosion management .................................................................................. 61
Fire prevention ............................................................................................................................. 61
Preventing or mitigating explosions............................................................................................. 61
Electrostatic discharges .................................................................................................................... 64
Lightning ........................................................................................................................................... 65
Classification of zones and plant layout ........................................................................................... 66
Selection of safe equipment ........................................................................................................ 67
Types of equipment ..................................................................................................................... 68
3.6 Furnace and boiler operations ........................................................................................................ 69
Use of furnaces and boilers .............................................................................................................. 69
Furnaces ....................................................................................................................................... 69
Steam boilers................................................................................................................................ 69
Hazards associated with the use of furnaces and boilers ................................................................ 71
Furnaces ....................................................................................................................................... 71
Boilers ........................................................................................................................................... 71

Unit IOG1 Element 3
3.03.0Learning outcomes
Learning outcomes
On completion of this element, delegates will be able to demonstrate an understanding of the unit
content through the application of knowledge to familiar and unfamiliar situations.
In particular they will be able to:
(3.1) Outline types of failure modes that may lead to loss of containment of hydrocarbons.
(3.2) Outline types of failure that may lead to loss of containment of hydrocarbons.
(3.3) Outline the controls available to maintain safety critical equipment.
(3.4) Outline the hazards, risks and controls available for safe containment of hydrocarbons
offshore and onshore.
(3.5) Outline the fire hazards, risks and controls relating to hydrocarbons.
(3.6) Outline the hazards, risks and controls available for operating boilers and furnaces.

Unit IOG1 Element 3
3.13.1Failure modes
Failure modes
Forces on materials
Materials used in the construction of plant, equipment, pipelines, structures, etc. used in the oil and
gas industries, both onshore and offshore, will be subjected to various forces which will affect their
stability, strength and bonding with other materials.
Any force imposed on an item constructed from any material is resisted by its internal structure,
with the internal force equal to the opposite of the force applied.
Forces will include:
 pulling or stretching of a material – tensile force
 pushing or squashing a material – compressive force
 a force not applied in a line – shear force
 external forces causing buckling – bending force
 twisting forces – axial or torsional force.
Creep
Another failure mode affecting materials used in the construction of plant, equipment, etc. on oil
and gas installations is ‘creep’. This is a slow progression deformity in materials caused by elevated
temperatures combined with a constant load, or stress, applied close to the materials ‘elastic limit’
or stress point at which a material, if subjected to higher stress, will no longer return to its original
shape. Brittle materials tend to break at or shortly past their elastic limit, while ductile materials
deform at stress levels beyond their elastic limit.
The extent to which creep will affect a material will depend upon:
 time
 temperature.

Unit IOG1 Element 3
Creep is a particular hazard which requires effective monitoring and testing in environments which
are hot or operating under high pressures, such as furnaces and turbines.
Strictly speaking this is not a true failure mode, as failure will occur as either a brittle or ductile
failure depending upon the type and properties of the material involved, but must form part of the
testing and inspection programme for materials and plant or equipment exposed to extreme heat or
high pressures.
Creep is known to cause:
 excessive deformation in turbine blades

 rupturing of pressure systems, such as fractured steam feed pipes.
Creep should be considered during the initial design specifications of any plant, and can be
controlled by the shape of the components and the choice of materials, such as the use of chrome-
molybdenum steels which have low creep characteristics.
Stress and strain

Stress in materials can occur when a Stress – the force applied per unit area to a material.
material which is subjected to heat cannot Strain – the fractional distortion due to the stress, or
expand due to the material being the amount a material stretches compared to its
constrained. original size.
During process operations, stress can occur in either the process vessel itself, its assembled structure
or in associated pipework due to:
 periodic fluctuations in operating pressure
 temperature cycling
 vibration
 water hammer
 periodic fluctuations of external loads.
Strain is the term used to compare the ability of a material to change length when subject to
compressive or tensile forces, and is the ratio of the extension over the original length.
𝐶ℎ𝑎𝑛𝑔𝑒 𝑖𝑛 𝑙𝑒𝑛𝑔𝑡ℎ
𝑆𝑡𝑟𝑎𝑖𝑛 =
𝑂𝑟𝑖𝑔𝑖𝑛𝑎𝑙 𝑙𝑒𝑛𝑔𝑡ℎ
When a material is distorted by the forces acting on it, it is now in a state of strain, where the strain
is the ratio of:
𝐷𝑒𝑓𝑙𝑒𝑐𝑡𝑖𝑜𝑛
𝐷𝑖𝑚𝑒𝑛𝑠𝑖𝑜𝑛 𝑜𝑓 𝑚𝑎𝑡𝑒𝑟𝑖𝑎𝑙

Unit IOG1 Element 3
Effects of loading
If loads on materials are not too excessive they will return to the normal size in an elastic manner,
once the load is removed. Similar to the way in which an elastic band will return to its original shape
once it has been stopped from stretching.
When higher stress loads are applied, the material’s deformation will remain and become a
permanent feature preventing the material from returning to its original size. When this occurs the
material is referred to as being plastically deformed.
Tensile strength is the maximum force required to cause a fracture, and when a material has been
stressed beyond its yield point, varying degrees of permanent deformity or extension will occur.
Therefore, knowing the tensile strength of any material during the design specification phase will be
a useful guide as to its mechanical properties, and therefore its yield point.
Failure will occur during the lifecycle of any process vessel, pipeline or structure if the endurance
limits of the materials used in its construction are exceeded.
Principle sources of stress

The failure of any structural element under tensile or
Example:
compressive stress will be related to the tensile
strength of the material, but the components may be Thermal stress can result from the
subjected to a combination of different sources of differential expansion of a process vessel
stress. due to different temperatures, or the use
of different materials.
Such stresses will not affect the bursting strength of
Sources of secondary stress may also
the vessel, but must be considered when the vessel is
include the constraints imposed by flanges
subject to repeated pressure or temperature loading.
or supports, and changes of any part of the
If localised yielding has occurred, residual stress when
structure due to reinforcement at openings
the pressure load is removed and when repeated
or where connections for feed or drain
pressure cycling takes place, can lead to fatigue
pipes have been made.
failure.
During the design specification phase, values must be decided upon for the maximum allowable
stress that any material can safely withstand. This can be identified by applying a safety factor to the
material that it could be expected to withstand in standard test conditions. This would allow for any
discrepancies arising during design, the loading, the quality of materials, and the standard of
construction.
When selecting and specifying materials, designers must also take into account the suitability of the
fabrication process, such as welding of joints and connections, and the operating environment itself
(whether onshore or offshore).

Unit IOG1 Element 3
Stress corrosion cracking
The effects of corrosion on a material can be greatly changed if the material is under stress.
Generally the rate of attack on a material by corrosion will not change significantly within the normal
stress values, but in some materials and combinations corrosion media and temperature, can cause
stress cracks to occur.
Stress cracks is the term used to describe the form of attack in which cracks occur, and rapidly grow
and can lead to failures such as brittle fracture of the metal.
Stress corrosion cracking will occur when the Examples

following three criteria are present simultaneously:
 Stress cracking can be caused by
 a material susceptible to corrosion caustic embrittlement of steel boilers.
 a corrosive environment  Stress corrosion cracking of stainless
 the presence of sufficient tensile strength to steel in the presence of chloride ions.
induce the condition.
The problem can also be greatly increased due to:

 a corrosive atmosphere
 operations at an elevated temperature
 the use of pure metal alloys and exposure to specific chemicals, for example:
 cracks in aluminum alloy due to exposure to chloride
 cracks in mild steel due to exposure to nitrates
 cracks in copper and its alloys due to exposure to ammonia.
Stress corrosion cracking can be prevented through the careful selection of materials which are not
susceptible to specific corrosive environments, or to a lesser degree, by annealing after fabrication
welding.
Corrosive fatigue is the term applied to the premature failure of materials present in a corrosive
environment, and is caused by cyclic stress, which refers to the internal distribution of forces (a
stress) that changes over time in a repetitive fashion. This can occur in mildly corrosive
environments and can greatly decrease the fatigue life of a component. Unlike stress corrosion
cracking, corrosive fatigue can occur in any corrosive environment and is not dependent upon a
specific combination of a corrosive substance and susceptible metal.
Where cyclic stresses are likely to occur, designers must specify materials which have a high
resistance to corrosion during the design specification phase.
Thermal shock
Thermal shock is:
the effect of cracking resulting from rapid and extreme temperature changes causing a
material to expand and contract in a cyclic manner and eventually leading to fatigue failure.

Unit IOG1 Element 3
Different parts of an object will expand by different amounts, resulting in uneven expansion –
remember the Longford LPG Plant incident in 1998 (see Element 1.1) – and should be regarded in
the same terms as stress and strain.
At some point the stress will overcome the strength of the material, causing it to crack and
eventually fail if preventative measures are not in place, such as:
 introducing temperature changes gradually

 increasing the ductile strength of the material.
An example of the results of thermal shock could be the failure of a weld in a ductile material, due to
imposed stresses and strains, resulting in a brittle fracture occurring.
Brittle fracture
Brittle fractures will occur suddenly with no visual signs, such as in stress corrosion cracking, and
occurs when an excessive load is placed on a structure and the material is not able to slip:
 owing to the materials structure

 because insufficient time is available due to the intensity of the load imposed.
Small cracks form and rapidly spread through the material so that a massive failure occurs. Failure
can also occur when the applied stresses are below the yield stress, and can also form part of the
sequence of other failure modes.
The speed of this failure often results in some of the released energy forming a sound. Brittle
fractures will have a characteristic ‘crack’ or loud bang.
Brittle fractures can be caused by the following. Brittle fractures

 Low temperatures – can affect failure in a brittle or ductile mode, will not show signs
especially important for materials operating in a cold environment, LPG of deformation, the
cylinders and systems. cross-section of the
break will resemble
 Impact or ‘snatch loading’ – cause high levels of stress quickly, especially
the cross-section of
in the case of lifting equipment. The material subjected to impact/snatch
the original
loading will not have sufficient time to spread the load evenly through the
component, and
crystalline boundaries resulting in high areas of stress forming. When
the surface will
failure occurs in these areas it will propagate through the material and
show no signs of
result in total failure.
corrosion but may
 Residual tensile stresses – stresses may be built into the structure of the display a ‘chevron’
material during the fabrication or assembly process, resulting in tensile pattern across the
stresses acting with the loading and resulting in brittle fractures. This is in fractured surface.
effect pre-loading the material with stresses before it is operational.
 Inherently brittle material – the atomic structure of some materials has difficulty in giving way
under stress conditions, resulting in brittle fracture failure, such as, cast iron, glass and ceramics.

Unit IOG1 Element 3
Brittle fractures occurring in welded structures will be dependent upon:
 plate thickness
 residual stresses present after the fabrication process
 the operating temperature.
Failure of the annular rim

The annular rim is the term given to the bottom rim of a storage tank, which will be susceptible to
rapid corrosion if the fluids stored within it have high sea water content.
In crude oil tanks, for example, the sea water will corrode the base plates and rim faster than other
parts of the storage tank structure. Pitting corrosion will be a significant feature of any corrosion
identified on the annular rim.
Corrosion can also occur from the tank settling into, or onto, the foundation, or from settlement of
the foundation itself, with the corrosion affecting joints and protective finishes due to the
movement.
Bacterial corrosion can also occur in storage tanks for hydrocarbon products, such as crude oil with
high sulphur content. This will be displayed as a deep pitting penetrating the bottom plates and the
rim, resulting in leaks occurring.
Where corrosion occurs this will result in mechanical failure of the rim and bottom plates, resulting
in a loss of containment.
The safe operating envelope

During the processing of oil and gas derivatives, we are aiming to produce a controlled chemical
reaction whilst avoiding the creation of a hazardous situation.
To achieve this we must know and define the ‘safe operating envelope’ necessary to contain any
such reaction, with the designer specifying safety boundaries in terms of the upper and lower limits
and how violations of these limits and system failures will be detected and corrected should they
occur.
The designer may face constraints on the design which will allow for tolerances and recovery from
faults, providing there are suitable warning systems in place to indicate an overrun or failure is in
progress.
Modern oil and gas installations rely heavily on fault detection, alarm systems and instrumentation
systems to maintain safe operations within the defined safe operating envelope. Knowledge of these
limits during the designing of processes and mechanical systems together with effective

Unit IOG1 Element 3
communication to and observation by operations and maintenance personnel should ensure the
safe operation of equipment and processes.
As oil and gas installations change with age, modifications, additions, etc. and are subject to
maintenance over their operational lifecycle, the limits of the safe operating envelope should be
maintained and remain a critical element of the process safety system.
Applying knowledge of failure modes to the design and operational phases

Where designers have determined the design loads for a vessel, pipeline or equipment, and the
maximum stresses due to the design loads have been calculated, the designer must qualitatively
evaluate the individual stresses by type.
Where a pressure component is loaded beyond its yield point by a mechanical (or static) force, such
as the internal pressure of a pipe, or the weight on a vessel, the yielding can continue until failure
occurs.
Creep can lead to excessive deformation in turbine blades, and the rupturing of pressure systems,
and must be considered by designers during specification and load calculations when selecting
materials, such as chrome-molybdenum steels which have low creep characteristics.
Therefore, whilst design criteria will allow the calculation of the required thickness of materials, and
the stresses of the basic components due to the internal load and external pressures, the ultimate
determination of design loads will be left to the designer to quantify who must be competent,
experienced and must:
 consider the use of materials which will avoid thermal shock and ensure that their strength is
sufficient to withstand it should this occur
 ensure that the material has the appropriate thermal conductivity and heat capacity for the
operational and environmental conditions for its lifecycle.
Materials webpages from the UK’s Health and Safety Executive (HSE)
Web links
www.hse.gov.uk/offshore/materials.htm
Falling through the cracks video (YouTube) from the US Chemical Safety
Board (CSB)
www.youtube.com/watch?v=uo7H_ILs1qc

Unit IOG1 Element 3
Outline the following failure modes that may lead to loss of hydrocarbon
containment from storage tanks/vessels or pipelines.
Exam question
(a) Creep. 2 marks
(b) Stress corrosion cracking. 2 marks
(c) Thermal shock. 2 marks
(d) Brittle fracture. 2 marks
Answers are on page 18 of the examiners’ feedback PDF, which you

can find in the revision and exam support section of the course.

Unit IOG1 Element 3
3.23.2Other types
Other types of failure
of failure
Weld failures
Welding is commonly used within the oil and gas industries during the fabrication of pressure vessel
shells, pipework systems and the installation of structures, including the attachment of non-pressure
components to a vessel wall, such as:
 stiffening rings
 lifting lugs
 support clips for piping
 internal trays.
Welded joints, as opposed to bolted joints, are also sometimes used for piping-to-vessel connections
to provide a leakproof connection.
The most widely used welding technique in fabrication process is arc welding.
Residual stresses can occur in the weld, and in the If the weld’s residual stress added to the
region adjacent to the weld, but due to the stress caused by an external load exceeds the
welding process are unavoidable. They are not, yield point of the material, a small degree of
however, considered dangerous when a static load plastic yielding will occur to redistribute the
is applied. stress.
To prevent the loss of ductility in heat affected This occurs in ductile materials, and one
zones, low-carbon non-hardenable steels are used important requirement for a good weld is high
as construction materials. ductility.
The residual stresses in heavier plates are usually removed by post-weld treatments. Cooling after
welding causes the weld to change dimensionally due to the temperature reduction and phase
change which may result in cracking in the weld, or the heat affected areas around the weld.
Therefore, the strength of a welded joint will be dependent upon the type of joint and the quality of
the welding, all of which is checked visually and by non-destructive testing.
Visual inspection of welds

A suitably qualified and experienced welding inspector will visually inspect the weld, sometimes
using a magnifying glass or a microscope where they can be applied, but most usually with the naked
eye, depending on the size and location of the weld or defect being checked for.
Visual inspection will require a good light source, and will require the removal of surface coatings
such as paint, to allow the inspector to view the surface.
As visual inspection only allows for the external observation of the weld, or defect, it should not be
solely relied upon to confirm the integrity of joints, connections, etc.

Unit IOG1 Element 3
Non-destructive testing
Non-destructive testing (NDT) allows for the testing of a material, or component, without causing
any physical damage or deterioration and will involve one or more of the following techniques.
 Dye penetrant inspection
 Magnetic particle inspection
 Ultrasonic testing
 Eddy current testing
 Radiography
 Pressure testing
Dye penetrant inspection

Dye penetrant inspection involves the spraying of a
dye to highlight the defect for visual inspection.
The dye is applied by spraying, which will then

penetrate into any surface crack which indicates the
location of the defect.
Figure 3.1: Dye penetrant inspection
Magnetic particle inspection

Magnetic particle inspection involves the magnetising
of the component and application of magnetic particles
or ink.
Any defect in the component will show as it will distort

the magnetic field and the particles will lie differently.
Figure 3.2: Magnetic particle inspection

Ultrasonic testing
Involves the use of a generator to transmit ultrasonic
waves into a material, which are then detected when
reflected back from within the material.
Any defect present will cause a variation in the returning

signal which can be interpreted to indicate the depth of
the defect.
Ultrasonic NDT can also detect defects within the

materials which do not show up on its surface. Figure 3.3: Ultrasonic testing

Unit IOG1 Element 3
Eddy current testing
Involves the passing of a high frequency alternating

current (AC) through a coil to set up alternating magnetic
fields.
The coil is placed next to the surface of an electrically

conducting material to set up eddy currents within the
material. Any discontinuity in the surface causes a
variation of the eddy current, which can be detected using
a second coil, indicating the location and depth of the Figure 3.4: Eddy current testing
defect.
Radiography
Involves the use of gamma or X-rays which are passed
through the material onto a strip of film.
The radiation will darken the film emulsion, so when

developed, will show where any defect exists within the
material.
Radiological testing provides a permanent record of the

inspection undertaken, and is used extensively in steel
Figure 3.5: Radiography
fabrication especially on welds on oil rigs, pipework and
reactor vessels.
Pressure testing
Involves subjecting a finished pressure system to a test
with the pressure at a value above the operating pressure,
usually 1.5 times.
Liquid is often used, because in the event of a failure, the

pressure is released with the loss of a relatively small
amount of liquid.
Figure 3.6: Pressure testing

Unit IOG1 Element 3
Summary of the advantages and disadvantages of different NDT techniques
Type of Advantages Disadvantages

test
Visual Quick, easy and inexpensive. Only detect surface defects.
Surface must be clean and accessible

to inspector.
Dye Inexpensive. Only detect surface defects.

penetrant
Allows for visual examination and Defects must be open and on the
suitable for all non-porous materials. surface.
Magnetic More sensitive than dye penetrant. Only suitable on ferrous metals.
particle
Can also detect sub-surface defects. Cannot detect defects at any
significant depth.
Requires a power source.
Eddy current Rapid detection of surface or sub- Cannot operate close to other free
surface flaws. surfaces – e.g. thin sheet.
Can measure depth of shallow flaws. Cannot detect deep defects.
Ultrasonic Allows the precise location of internal Expensive equipment.

and external defects.
Allows for the sizing of different
Skilled operator required.
defects.
Radiography Provides a permanent record of Radiation hazard.

inspection.
Expensive equipment.
Easily interpreted images.
Thickness limits (X-rays).
Will locate majority of internal defects.
Power supply required.
Skilled operator required.
Access to both sides required.
Pressure Systems can be tested whilst in Cleaning issues if a hydraulic medium

operation. is used in a system for gases.
Table 3.1: Summary of the advantages and disadvantages of different NDT techniques

Unit IOG1 Element 3
Web links
Inspection/Non Destructive Testing webpages from the UK’s Health and

Safety Executive (HSE)
www.hse.gov.uk/comah/sragtech/techmeasndt.htm
What NDT techniques are used where you work?

Discuss
Go online to join the discussion. Help other learners by sharing

what happens where you work and read about how things work
in other organisations.
In relation to weld failures:
(a) give the meaning of the term ‘non-destructive testing’ 2 marks

(NDT)
Exam question
(b) identify TWO NDT techniques that detect surface defects 2 marks
only
(c) identify TWO NDT techniques that detect sub-surface 2 marks

defects
(d) outline disadvantages of visual inspection techniques. 2 marks


Unit IOG1 Element 3
3.33.3Safety critical
Safety critical equipment
equipment controls controls
Safety control
Safety controls in the oil and gas industry include:
 process equipment controls
 fire and gas controls
 drilling control systems.
Process equipment controls

As part of standard operating procedures process equipment controls should be regularly monitored
to ensure they are working within design specifications, these checks should be supplemented by
electronic/mechanical instrumentation which is capable of performing a shutdown and raising an
alarm if a fault or malfunction occurs.
Such systems will include:

 supervisory control and data acquisition (SCDA)
 programmable logic controllers (PLCs) and PLC programmers
 distributed and batch control systems.
These systems will offer protection by activating emergency shutdown (ESD) systems such as:
 pressure and temperature relief
 flow parameter controls – flow rates, volumes in pipework, etc.
Collectively these systems are referred to as HIPS (High Integrity Protection Systems).
Where there is no independent mechanical system, instrumentation will be provided. This must be
of high integrity and have a high failure-to-safety built-in, be fault-tolerant and have redundant
systems capable of automatically taking over when the primary instrumentation fails.
When a fault or emergency situation, outside the normal safe operating envelope is detected, these
systems must be capable of operating quickly.
In a publication by the UK’s Health and Safety Executive (HSE), Loss of Containment Manual, it is
recommended that emergency shutdown (ESD) systems should have pressure transmitters, as
opposed to pressure switches in HIPS to achieve the fast response times when a situation outside
the normal operating envelope is detected.

Unit IOG1 Element 3
Fire and gas controls
The most effective way of preventing a fire is through segregation of fuel sources from sources of
ignition. In the oil and gas industries this will take the form of segregating the hazardous processes
and areas from the non-hazardous areas of the installation to ensure personnel have safe access and
egress, emergency evacuation routes and safe havens.
These measures are supported by gas and fire detection and protection systems, which are designed
to protect the installation, plant, equipment from damage and personnel from injuries due to
exposure to gas and fire.
This will be achieved through monitoring of specific areas on the installation where fire is considered
a particular risk, such as in the event of an uncontrolled process, interaction of chemicals with air or
water, or through failure of containment systems in which a build-up of flammable gases will occur
and create an explosive atmosphere.
The fire and gas system must be capable of detecting such occurrences early in their development,
and alert process and control room personnel by setting of the ESD and associated visual and
audible alarms.
Such systems will include:
 fire and gas detectors capable of detecting flame, smoke, temperature, rate of temperature rise
and installed throughout critical areas
 feed monitoring information into control room displays, and ESD instrumentation / mechanical
systems to allow an automatic shutdown to occur when the detectors are activated.
Drilling systems
All operational functions and services related to drilling systems should be constantly monitored,
together with mechanical systems in place to control the drilling process. These may be located in
well-decks or drilling units.
Any such systems should also monitor and control water, steam and sludges for pressurisation and
lubrication, as well as the collection and transportation of oil and gas through the system to the
surface.
System monitors should be in place and linked into an ESD system to operate in the event of the
drilling control system failing.
Web links
Loss of Containment Manual from the UK’s Health and Safety Executive
(HSE)
www.hse.gov.uk/offshore/loss-of-containment-manual-2012.pdf

Unit IOG1 Element 3
Emergency shutdown equipment and systems
As briefly discussed above, ESDs are intended to monitor and detect fault conditions in processes
and service systems. When detected they will trigger a shutdown to prevent a potentially hazardous
situation from occurring, protecting the installation and its personnel from damage and injury.
Example: Compressor
Motor
Gas flow to vessel
ESD at 50% Surge

through the vessel
DCS Independent
emergency
High level shutdown at
alarm at 10% 60%
Distributed Control System
Control room
operating panel
Figure 3.7: Emergency shutdown equipment

A motor-driven compressor is used to pressurise hydrocarbon gas and a surge vessel is used to
prevent major fluctuations in flow to the compressor.
During normal operations, gas will flow into the surge vessel, and onto the compressor.
It is possible that liquids may accumulate in the surge vessel and then enter the compressor –
therefore during abnormal operations liquid levels within the surge vessel can lead to catastrophic
compressor damage and failure.
To prevent this from occurring, the surge vessel is fitted with instrumentation to detect liquid
levels. The Distributed Control System (DCS) will under normal operating situations control the
operations of the surge vessel and compressor, sending by data to the control room. In abnormal
operating conditions, an independent (hardwired) detection and control system can activate an
emergency shutdown independent of the DCS.
The ESD system for the compressor would have three levels of instrumentation protection.
 At 10% of the surge vessel’s capacity a high level alarm would operate in the control system
(controlled through the DCS).
 At 50% of the surge vessel’s capacity, the detection system would communicate with the DCS
and initiate an emergency shutdown.
 At 60% of the surge vessel’s capacity, the detection system (hardwired into the surge vessel)
would operate independently of the DCS and initiate an emergency shutdown.

Unit IOG1 Element 3
Such systems are designed to provide both a visual and audible alert to operations personnel that an
abnormal situation has arisen, and to take automatic action independent of any input from
personnel to prevent a dangerous situation occurring if no direct action is taken by personnel. The
systems have autonomy to operate independently if inputs are not received from the DCS.
All ESD systems should be independent of the normal production controls, so that in the event of a
failure affecting the DCS, emergency shutdown can still be performed independent of any system
failure. Likewise, control valves forming an integral part of an ESD should not be used for dual
purposes, such as for process operations and emergency shutdown.
All shutdown and blowdown valves should be designed to fail-to-safety. Blowdown refers to the
removal of liquid from a process vessel to reduce the likelihood of fires or explosions.
 Shutdown valves forming part of the isolation for a pipeline and systems should always fail to a
closed position to prevent any uncontrolled release of contents.
 Blowdown valves should on the other hand fail to an open position if their power supply or
control inputs are lost due to system failure.
If fail-to-safety does not form an integral part of any ESD system, the safety case or report will need
to be clear on the justification for any such exclusion.
Where by-pass systems are provided around shutdown valves, e.g. for maintenance purposes, these
will need to be locked closed, and the shutdown valve handwheels removed to prevent their
accidental opening. Any valves on hydraulic system return lines can cause failures, so should also be
locked open.
Levels of shutdown
The level of shutdown required as a response to an adverse situation will need to reflect the severity
of the situation. The following two tables set out the levels of shutdown response appropriate to
different levels of incident for offshore and onshore installations.
The UK’s Health and Safety Executive (HSE) provides information on control systems, safety
instrumentation systems, safety integrity levels and emergency systems, as well as incident
investigation reports on their control systems webpage.
Web links
Control systems webpage from the UK’s Health and Safety Executive
(HSE)
www.hse.gov.uk/comah/sragtech/techmeascontsyst.htm

Unit IOG1 Element 3
Level Cause Required action
1 Failure of non- Affected equipment to be shut down and standby equipment
critical equipment started – minimal effect on production.
2 Failure of any Production terminated until equipment is replaced. Part of system

critical equipment is isolated to allow equipment to be replaced. Blow down and
venting may be required.
3 Fire or gas alarm Production may be affected depending upon the location, nature
activated and extent of the hazard. Equipment may be shut down or isolated
depending on which zone(s) is affected and the sensitivity of the
zone(s).
4 Manual initiation Total shutdown of production including non-essential utilities.

of emergency Product flow from the well-head is isolated, and the platform
shutdown Prepare to Abandon Platform Alarm (PAPA) is sounded for
personnel to muster at lifeboat stations.
5 Manual initiation The inventory is to be vented and the platform abandoned. Subsea
of abandoning Isolation Valves (SSIVs) shut and all essential utilities shut down.
Table 3.2: Offshore platform shutdown level of response (HSE)
Level Cause Required action

1 Unit shutdown Involves the shutdown of single processes or functions. Can be
activated automatically by monitoring equipment/detectors or
manually by operators. The aim is to prevent equipment from
operating outside of its safe limits.
2 Process shutdown Involves the shutdown of all process systems and can be activated
automatically by monitoring equipment/ detectors. The aim is to
isolate all process equipment and limit the potential for an incident
escalating out of control.
3 Emergency Involves the shutdown and isolation of specific process equipment

shutdown through the operation of emergency shutdown valves. Can be
activated automatically or manually by operators and aims to limit
the consequences during an emergency situation.
4 Emergency Involves the shutdown, isolation and depressurising of equipment

depressurisation and processes by the opening of valves to allow blowdown and
venting to occur. This is activated manually by operators and aims
to reduce the potential for overpressure and release of hazardous
vapours and gases from the process.
Table 3.3 Onshore installation shutdown level of response (HSE)

Unit IOG1 Element 3
Procedures for bypassing ESDs
ESDs should not have a bypass function – either for inhibiting or overriding their function – unless
they are subject to stringent controls, such as permit-to-work systems and their isolation is
effectively communicated to operational personnel, especially during shift changeovers.
The proposed bypass of an ESD system must be requested by a competent person justifying the
bypass. As part of the justification a risk assessment must be carried out prior to the bypass, as this
will identify any risk control measures required to safeguard both the personnel working on the
isolated ESD, and additional measures required to safeguard the installation in an emergency
situation.
The bypass should be controlled by a permit-to-work, signed off by a competent issuing authority,
and take place for the shortest possible period of time, where the bypass will need to continue past
the original completion date/time, the extension must be monitored and controlled and effectively
communicated during shift changeovers.
All ESD bypass systems must be subject to regular testing and inspection to ensure they operate
correctly when required, after an ESD has been returned to service its function must be fully tested
to ensure its functioning under operational conditions.
As with other maintenance and testing activities, the bypass must be documented in a bypass log
detailing:
 bypass conditions – equipment involved, systems affected by the bypass
 time and date of the bypass, plus cross-referencing into the approved permit-to-work
 date and time of any assessment of the bypass
 when the bypass was removed and reinstated into operations.
The number of bypasses taking place at any time must be controlled to ensure the overall safe
operation of the installation is not affected, and any emergency situations which may arise can still
be effectively dealt with by remaining ESD systems.
Exam question
Outline the content of a procedure for bypassing an emergency 8 marks

shutdown (ESD) system.


Unit IOG1 Element 3
Safety integrity levels for instrumentation
Hazardous processes should be protected by safety systems. Each system and its instrumentation
must have its safety criticality established during the design phase, and confirmed during the
handover and commissioning processes. This is achieved by identifying the safety integrity levels
(SILs), which generally have 4 levels based on a corresponding range of likelihood of failure targets:
Figure 3.8: Safety integrity levels
The higher the safety integrity level, the more critical the safety system is. Examples of safety
systems include trip systems, high-integrity protective systems (HIPS), pressure relief systems and
blowdown systems.
Standard operating procedures for process operations should clearly identify which instrumentation
functions have been assigned safety critical elements, together with their assigned SIL. Trip settings
for any such instrumentation must be recorded in a trip register, together with procedures for proof
testing and the frequency between tests conducted by competent persons – review the Deepwater
Horizon incident in Element 1.1 for the importance of such testing.
Testing must prove the operational and performance standards for instrumentation continue to
meet the design and operational specifications, and must be documented to provide evidence of
such tests in the event of a serious incident.
The frequency of such testing will be influenced by the SIL rating, the higher the rating the more
frequent testing of the system will be required, and will involve breaking down processes to examine
sensors and logic/final end elements of the process.
The testing of sensors can be easily achieved through inhibiting their logic controls resulting in a
more frequent testing programme. However, the testing of logic and process end elements will
require a physical trip of the operating plant and equipment to occur, resulting in a shutdown, which
will result in a less frequent testing programme for these elements.
Again, just as valves forming part of an ESD should be independent of other elements, production
control functions must be separate from protective functions to ensure both do not fail in the event
of faults occurring.

Unit IOG1 Element 3
Blowdown facilities and flares
Blowdown
Blowdown is a similar process to depressurising carried out in gas process Blowdown describes
systems. the removal of liquid
A flare solely designed to burn off excess gas should never be used for content from
blowdown from liquid containing process vessels, where liquid is introduced process vessels and
into a flare system designed to handle gas, the liquid passing through the equipment to reduce
flare tip may extinguish the flame, and if the flare is at height, this liquid can the likelihood of fires
be spread around a wide area of the installation and/or surrounding areas. or explosions
Offshore such liquid carry-over could damage the marine environment. occurring.
There is also the risk that the pipeline from the process area to the flare may not be structurally
designed to handle the combined weight and pressure of liquid and gas, resulting in fracturing of the
pipeline at a joint, bend, etc.
Where liquid blowdown is to occur, this should be routed through a system designed to handle
liquids, and out into a suitable storage tank, pressurised sewer, or open pit if space allows.
Flaring
Gas flares are widely used throughout the oil and gas
industry, as well in chemical and petrochemical plants.
Gas flares are also integral to well-drilling operations, both

onshore and offshore.
Essentially, a gas flare is a tall discharge facility designed to

eliminate gas which is surplus to other processes, or
transportation.
As well as this discharge function, gas flares also act as a

safety system for non-waste gases, by providing venting of Figure 3.9: Flaring of associated gas
process gases through pressure relief systems. from an oil well site in Nigeria
It has been known that during incidents, emergency venting has burnt off the total gas reserves of
an installation. Therefore, at oil and gas installations, as well as providing the facility to burn off
excess waste gas, a flare system will also provide a vital safety function in relieving overpressure
which may build-up during non-routine operations or process faults, thus protecting both process
plant and equipment, but also pipelines from failure and rupturing.
Where overpressurisation occurs, emergency relief valves will operate to automatically release
pressure – in some cases for both liquid and gas content – which will be routed through a ‘knock-
out’ drum and through large flare-header pipework systems to the flare stack to be burned off as
they vent through the stack.

Unit IOG1 Element 3
Where ‘dirty’ flaring occurs, steam can be injected into the
flame, at the tip of the flare stack, to reduce the black
smoke. This however, will result in the flaring activity
becoming noisier.
Some flare systems will prevent the freezing of wet steam

at the flare tip – as this will result in flameout – by injecting
a constant stream of gas (similar to a pilot light on a gas
boiler). This will ensure the flare system is always available
Figure 3.10: Dirty flaring from an
to carry out its primary, and safety related, pressure relief
offshore oil rig in Vung Tau, Vietnam
role. This type of flare tip design also allows for complete
combustion of diluted gases.
Flaring activities can produce a range of by-products and adverse effects, such as:
 noise
 smoke
 heat
 light
 radiation
 various combustion and thermal decomposition products.
All of these can be eliminated, or minimised, through good initial design and operating practices.
Types of flare
The types of flare are determined by two factors.
 Height of the flare-tip.
 Mixing method.
For most flare types combustion of the waste or process gases occurs through a diffusion flame. Air
is diffused across the boundary of the fuel stream towards the centre of the fuel flow, which in turn
forms an envelope containing the combustible gas mixture around the core of fuel gas, and then
creates a stable glare at the flare tip.
In order to ensure the combustion process is efficient, and to minimise the generation of smoke, a
good supply of air must be present, as well as the correct mixture of air and gas.
The selected flare type will be influenced by:

 the available space at the installation
 the characteristics of the flare gas – composition, pressure, quantity, etc.
The two constant features for any flare system will be its ability to operate reliably and to meet its
function as part of the overpressurisation relief system in the event of non-routine operations or
process failures.

Unit IOG1 Element 3
Steam-assisted flares
 Will have a single burner tip, and are elevated above ground level to allow the burning of vented
gas through a diffusion flame.
 Commonly used in refineries and chemical plants.
 Steam is injected into the combustion zone, causing turbulence for mixing and introducing air
into the flame to ensure an effective air/fuel mixture.
Air-assisted flares
 Use forced air for combustion and mixing, resulting in relatively smoke-free flaring.
 The burner will have many small gas orifices, in a spider-shaped pattern arrayed inside at the top
of a steel cylinder, with the air for combustion provided by a fan in the bottom of the cylinder.
 The fan speed can be altered to vary the amount of air for combustion.
 Often used where there is no steam available to the flare, but not suitable for large flare types.
Non-assisted flares
 These are simple types of flares and are not fitted with any steam or air mixing facility.
 Limited to use on gas streams with low heat content, and a low ratio of hydrogen/carbon – this
will burn well without producing a large quantity of smoke.
 Operate with less air to allow complete combustion, and have lower combustion temperatures.
Pressure-assisted flares
 Utilise the vent steam pressure to assist with the mixing of combustible fuels at the flare burner
tip, where there is sufficient vent steam pressure this type can be used on flare tips which would
usually have utilised steam or air, and will result in a smokeless discharge.
 Fitted with burner heads which will operate depending upon the amount of gas to be burnt.
 Can also have the burner arrangement at ground level – if so the flare must be located in a
remote area away from process units and storage tanks, and with adequate space.
Enclosed ground flares

 The burner heads are enclosed within an internally insulated shell, which will help to attenuate
the noise, as well as reduce the smoke, illumination, radiation and prevent wind interference.
 Mixing is achieved by a high nozzle pressure-drop, therefore steam and/or air are not required.
 The height of the flare tip must be sufficient to create a draught to supply enough air and to
result in smokeless combustion, as well as to allow the thermal plume to disperse.
 Will have less capacity than open flares, and will operate well with a constant-flow vent stream.
Monitoring flaring
Flaring activities should be monitored to ensure the integrity of the flare, and its emissions, which
will be achieved through the use of:
 thermocouple sensors (usually sited within the flame to allow continuous monitoring)
 ultra-violet flame sensors
 remote flame sensors
 flue analysers (monitor the condition of the fluid and gas mixtures in the stack).
Visual observation should also take place to ensure excessive smoking does not occur, and to carry
out remedial action where dirty flaring is avoidable.

Unit IOG1 Element 3
Drains, sewers and interceptors
Open drains
Usually include drainage from normal ground waters – rainwater, wash-down from hoses, etc. – and
from areas with hazardous safety ratings – water containing hydrocarbons – and are routed to an
open drain caisson before being passed through interceptors, and/or skimmers, to remove any oil
and residues before the water is eventually discharged.
Open drains carrying non-hazardous waste will generally return to an oil drain tank, and then onto
an injection unit to feed into downhole re-injection.
Open drain caissons are usually fitted with an extraction point to allow the removal of samples for
testing, as well as allow regular monitoring for cleanliness and oil or residue content.
Closed drains
Usually fed to high pressure and low pressure closed drainage drums. Once the liquid has been
drained from a vessel, the gas contained and released from the closed drain drums will be sent to a
flare, whilst the liquids are sent to a separator to be re-treated.
Liquids within a closed drain will commonly contain hydrocarbons, and as such can become a hazard.
Closed drain systems should not be connected into an open drain system. In a fire, gases would
flashover into the open system spreading the fire further into ‘safe’ area where additional ignition
and fuel sources could be present.
Sewage
Sewage should be collected by a sewage system and processed at a treatment plant involving the
maceration and chlorination of the waste.
Treated sewage can then be mixed with sea water (for offshore installations) and untreated
‘domestic’ water (for onshore installations), for eventual discharge through a sewage caisson.
Food waste will also be macerated, and discharged through a sewage caisson. Offshore installations
may be permitted under national laws to discharge sewage directly into the sea.
Process drain water

This is a by-product of operations involving the pumping of crude oil, or where drilling takes place.
This water is polluted with oil and therefore cannot be discharged directly into the sea, or drainage
systems, without cleansing and de-oiling.
Drain water will be passed through an interceptor unit which will usually heat up the contaminated
water, and inject treatment additives, before separating it into liquids, oils and sludges.
Separated oils will then be sent to a waste oil tank for storage, with solids dried and disposed of
safely and the water discharged into the sea when the oil content is low enough – 15 parts per
million (ppm) is stated in the International Convention for the Prevention of Pollution from ships
(MARPOL) from the International Maritime Organization (IMO).

Unit IOG1 Element 3
Interceptors
Will be used on onshore installations to collect and separate ground waters from hazardous areas,
or process waters which have been discharged.
An interceptor will consist of several layers of settling bays, which allow water to flow through each
bay whilst oil will stay on the top for collection in one area. The oil is then sucked out for safe
disposal.
Drain covers
Control room
operating
panel
Alarm
Oil level
Chamber 1 Chamber 2 Chamber 3 sensor
Oil/water inlet Oil/water level
Shut off
to interceptor
Manual
isolation Manual
valve isolation valve
Automatic
isolation Outlet
valve stream
Figure 3.11: Oil/water interceptor/separator
Offshore, an interceptor is often known as an oil/water separator, and will separate oil and water
before the latter is discharged into the sea. There are legal limits regarding the disposal of oil
contaminated water into the sea. A log of any such discharges must be kept, together with the
results of sampling conducted every 12 hours. Modern offshore installations will utilise a carousel
sampling system.
If too much oil accumulates in the separator, the excess oil will escape. Separators should be
installed with an automatic closure device and a high level alarm which will sound in a control room
to indicate maintenance is required.
Web links
International Convention for the Prevention of Pollution from Ships

(MARPOL) from the International Maritime Organization (IMO)
www.imo.org/knowledgecentre/ReferencesAndArchives/HistoryofMARP
OL/Pages/default.aspx

Unit IOG1 Element 3
3.43.4Safe storage
Safe storage of hydrocarbons
of hydrocarbons
Hazards and risks

The hazards associated with storage tanks will be dependent upon the type of the tank.
 Ground tanks – overfilling, vent fires.

 Floating roof tanks – vent and rim-seal fires.
All of the above can give rise to full-surface fires, which can be obstructed or un-obstructed.
Overfilling
Storage tanks can be overfilled due to:
 operator failure (not monitoring filling if done manually)

 failure of the pumping system to shut-off when the contents reach a set level (refer back to
Buncefield in Element 1.1 for causes of overfilling and lessons learned in relation to leak and
overfill monitoring, and alarm equipment)
 lack, failure or isolation of over-filling sensors, high level alarms, etc.
 blockage or lack of adequate tank venting or relief systems.
Effects of pressure and vacuum

In tanks which operate with an internal pressure, pressure and vacuum valves are used to prevent,
or minimise, the effects of pressure or vacuum on the structure of the storage tank.
Overpressurisation can cause stress on the joints and seals in tank panels, and for floating roof
storage tanks, can result in the tank roof being lifted and/or split.
Pressure relief valves will have an integral vent, which will open when a pre-set pressure is reached,
such as during tank emptying operations through pumping. In addition to pressure relief valves,
emergency valves will also be used to release any sudden rise in pressure beyond the normal limits
for the vent valves, for example, a fire in close proximity to a storage tank will result in the contents
heating and expanding.
Failure of tank shells

Failure can occur due to natural forces, such as pressures exerted by wind or earthquakes, as well as
failure due to corrosion affecting the metal components and those arising from operational failures.
Poor construction can also lead to deformation of the structure, as well as failure arising due to
settlement of foundations and/or tank bases.
Another common failure mode is due to faulty welding or the use of inappropriate steels during
manufacturing of the tank. Other structural issues will involve the shell thickness being inadequate
for the pressure or vacuum conditions, insufficient thickness to withstand repeated loading of the
contents or failure during, or due to lack of, hydraulic testing to prove the tank’s integrity.

Unit IOG1 Element 3
A much higher risk exists from fire and explosion occurring due to the presence of
explosive/flammable atmospheres within the tanks, this is more common where tanks have been
emptied for maintenance, where hot work such as welding or grinding takes place without sufficient
venting or testing for explosive/flammable atmospheres taking place prior to work.
Also the overpressurisation of tanks during refilling can cause expansion of the shell, resulting in the
weakening of seals. Likewise, the effects of vacuum when a tank is being emptied can also lead to
problems with the tank’s integrity, often resulting in inward bowing or warping of the shell, resulting
in damage to seals and joints.
As covered previously, corrosion to the annular rim at ground level, as well as damage resulting from
impacts on the shell’s surface coating, can cause the shell to weaken at the points of damage.
Types of storage tanks

Floating roof
The roof of these tanks can move up and down within the outer shell of the tanks, but will always
remain above the surface of the liquid to minimise the air gap, and potential for the build-up of
flammable hydrocarbon vapours.
There are two types of floating roof tanks.

 External floating roof.
 Internal floating roof.
External floating roof
Commonly used to store large quantities of
medium flashpoint hydrocarbon products, such
as naphtha, kerosene, diesel and crude oil.
The tank is an open topped cylindrical shell, with

a roof inside the shell floating on the surface of
the liquid contents. Therefore, the tank roof will
rise and fall depending upon the volume of liquid
Figure 3.12: External floating roof storage tank
within.
The tank will have a rim seal between the main shell and the floating roof, which will reduce vapour
evaporation and escape via the floating roof. The roof is supported by legs which hang down into the
liquid, so that when the liquid level is low, the roof will stand on the base of the tank, and a vapour
space will form between the liquid surface and the tank roof. The legs can be retractable to increase
the useable volume of the tank.
This type of tank will prevent the loss of fuel, by reducing the emissions of volatile organic
compounds (VOCs), but problems can arise due to the accumulation of snow and rain on the roof
which may result in the roof sinking. Where this occurs, water can be drained via flexible hoses from
a sump on the roof, usually passing through the tanks interior down into the base of the tank for
discharging through external control valves.

Unit IOG1 Element 3
Lightning is a common cause of fires. A lightning strike on the roof can cause ignition at the rim
around the tank roof seal.
Internal floating roof

An internal floating roof is generally used for Petrol level Access hatch Fuel spilled out
gauge through vents
storing lower flashpoint hydrocarbons, such as Vents
high level alarm
gasoline and ethanol. Deflector
plate
These tanks will have vents built into the fixed roof,
Floating deck to
together with inspection hatches. control vapours
Petrol
Internal floating roof tanks are less susceptible to Temperature

probe Petrol
fires caused by lightning strikes.
Figure 3.13: Internal floating roof storage tank

Fixed roof storage tanks – design and construction
This type of storage tank are used for liquids with a very high flashpoint and low volatility, such as
water, and are generally constructed from steel or other metal able to withstand the effects of direct
flames or radiant heat from a fire in close proximity to the tank. Construction should also follow
accepted and recognised engineering practices.
Consideration must also be given to the chemical and physical properties of the intended contents,
to ensure the contents and construction material are compatible and that failure will not occur due
to chemical attack.
As with all types of storage tanks, these should be protected from corrosion by suitable coatings, the
external surface of storage tanks intended to be sited underground at an onshore installation,
should be shot-blasted clean or chemically primed, and then coated with glass or synthetic fibre.
Following construction fixed roof storage tanks

If water is used for hydraulic leak-testing,
should be subjected to hydraulic leak-testing to
then the tanks, its connecting pipeline and
ensure their integrity before filling takes place. Care
supports must be designed and constructed
must be taken to take into account the specific
to have sufficient strength to withstand the
gravities of different flammable liquids and water.
hydraulic loading of the test.
Supports and foundations for above-ground tanks

Above-ground storage tanks should be supported on concrete, masonry or steel. For offshore the
supports should be steel. Steel supports should be protected by material to give a fire resistance of
no less than 2-hours, but where steel saddles are used these do not require fire protection if less
than 30 cm high at their lowest point.
Supports must be designed to bear the weight of the tank, plus all the volume of the fluids contained
within the tank and taking into account the different specific gravities of the fuel contained, as well
as the additional weight from accumulated rainwater or snow.

Unit IOG1 Element 3
Where storage tanks are filled from delivery vehicles, these need to be on a suitable hard-standing,
and again taking into account the additional weight and movement of the tanker.
Tank supports should also be designed to prevent corrosion from water accumulating within their
structures, and be designed to allow for the expansion and contraction of the tank due to
temperature changes.
Tank fitting and connections

Where a tank does not form part of the permanently-piped delivery and supply system, the filling
line should be fitted with a suitable flange, or coupling, to allow connection with the delivery hose.
This connection point should be outside of the tank’s bund wall, with connection points located
where they are easily accessible to delivery or collection vehicles, so that only one short flexible
connection hose is required.
Filling and emptying connections such as plug-on and unplug hoses, should be located in open air
and segregated from ignition sources. They should be no less than 2 m away from any building,
opening, trench, depression or drain, with spillages contained, during connection and disconnection
operations using flexible hoses, by a low sill or drained to a safe place.
The discharge end of the filling line should extend into the tank below the lowest anticipated level of
the liquid. This is to minimise aeration and the generation of static electricity. In order to maintain a
liquid seal, the discharge suction line should terminate above the bottom of the filling line.
Again the supports for pipework must be adequately designed, located and secured to support the
pipework’s configuration, as well as withstand anchorage and guide friction forces. Pipe supports in
the immediate vicinity of tanks will also require fire protection to a resistance of 2-hours.
Bunding of storage tanks

Storage tanks should be surrounded with an adequate bund to prevent the spread of any liquid
contents, following a spillage, leakage or structural failure. Where this may not be possible,
alternative arrangements such as diverting any liquid to a collection or evaporation area, by walls
will be required.
Bunds should be designed and constructed to hold at least 110% of the tanks contents. Where bunds
may surround more than one storage tank, it should be designed to hold at least 110% of the largest
tanks capacity within the bund taking into account the space occupied by other tanks.
Where there is no hazard of pollution affecting the public, tank bunding to 75% of the tanks contents
may be permitted.
Where more than one tank is located within a bund, such as in a tank farm, immediate lower bunds
may be used to sub-divide tanks into groups.
This will allow containment of small spillages, and maximise the surface area of any spillage – this
will have an effect on the size of any fire occurring within a bund should the leak contents be ignited.
Bunds must be impervious to the liquid likely to be stored within the tanks, and designed to
withstand the full hydrostatic head (the vertical distance the liquid escaping from the tank will fall

Unit IOG1 Element 3
before coming into contact with the ground/bund wall ), with part of the wall’s structure
underground to improve wall strength.
Impact protection may also be required, such as crash barriers and bollards.
The bund’s height should consider the need to provide natural ventilation within the bund, as well as
escape for personnel and access to emergency personnel. Generally the height should not be more
than 1.5 m, or in the case of larger tanks up to 2 m. Where used, diversion walls and immediate
lower bunds should not exceed 0.5 m, unless ground conditions such as slopes require additional
height.
A bund’s floor should be made of concrete, or other material impervious and resistant to the liquids
stored within the tank, and provided with drainage (where necessary) to prevent minor spillages
accumulating near tanks. A suitable buried membrane may also be used, as can specially designed
systems using the water table to retain liquids not miscible with water.
No vegetation, other than short grass, combustible material, liquid containers or gas cylinders
should be stored in the bund, or within 1 m of the external wall of the bund.
Chlorate, or other oxidising substances, should not be used as weed killer within the storage area, as
this will introduce a fire hazard into the bund area.
Where surface water will be removed from a bund by an electrically driven pump, the equipment
must be of a type suitable to the zoning of the area – it must be intrinsically safe (see ‘selection of
safe equipment’ in Section 3.5).
Where a bund drain is used, the valve should be located outside the bund, with standard operating
procedures requiring the valve to remain closed, and preferably locked into the closed position,
except during cleaning operations.
Where surface water has been mixed with flammable liquids not miscible with water, this should be
routed through an interceptor to prevent the flammable liquids entering the drainage system.
The loss of hydrocarbon containment from storage tanks will also have a serious environmental
impact. Uncontrolled releases or leaks may enter surface water drainage systems, and cause
substantial water pollution outside the confines of the installation, as well as land contamination,
both of which can cause harm to our health if the contaminants enter the food chain.
Filling storage tanks

The safety issues around the filling of storage tanks can be:
 the suitability of the tank for the intended contents

 the holding capacity of the tank
 the materials used in its construction
 the location of the tank and the weather effects it will be exposed to
 mixing incompatible substances, resulting in an uncontrolled chemical reaction, where a tank
has been emptied of one product and refilled with another without cleaning

Unit IOG1 Element 3
 the method of filling:
 top filling by means of a gravity-fed filling valve through the top of the storage tank,
which can create a splash causing contamination of the surrounding area as well as
aerating the substance and creating an electrostatic charge and releasing vapours
 bottom filling under pressure through a closed pipeline, which can cause
overpressurisation issues if the tank is not designed to deal with different pressures, or
fitted with any pressure venting or relief systems.
Whichever filling method is used, a primary hazard to avoid is overfilling. We’ve already discussed
the consequences resulting from overfilling (see Buncefield in Element 1.1), with the consequences
for the immediate and surrounding environment potentially catastrophic.
Therefore, the tank selected to be filled with a liquid must have sufficient capacity for the intended
contents, together with continued monitoring of the delivery to ensure overfilling does not occur, as
well as audible and visual high level alarms to warn of any dangerous situation. As previously
covered, adequate bunding should also be provided, supported by spillage kits and equipment
should overfilling occur and result in escape of the liquid into the bund.
Another important aspect is the correct marking of storage tanks to prevent dangerous situations,
such as uncontrolled chemical reactions between incompatible liquids from occurring.
Pressurised and refrigerated vessels

Liquefied natural gas (LNG) is liquefied at the
production facility and transported via specially
designed cryogenic tankers – either by sea or
land – to a regasification terminal for storage
and transportation via a pipeline.
Liquefied petroleum gas (LPG) can be liquefied

by increasing the pressure, or by reducing the
temperature.
Refrigerated storage can be used by gas

suppliers to store large volumes of LPG, but the Figure 3.14: Gas holder in London, UK
more common type of storage is usually
pressure tanks. These have very thick wall
sections and are designed to withstand the
immense pressure exerted by the gas inside.
LPG storage vessels will have walls up to 15 cm

steel thickness, with pressure relief valves at
the top to release any excess pressure and
prevent rupturing of the vessel.
Unless stored together in a tank farm, LPG

storage vessels should be segregated from Figure 3.15: 15 000 gallon stationary LNG
process areas, and other storage tanks. storage tank at Harris Ranch station, USA

Unit IOG1 Element 3
Loss of containment and its consequences
Jet fires and pool fires
Jet fires are turbulent diffusion flames resulting from the combustion of a fuel that is under
continuous release, usually caused by some momentum jetted or sprayed in a particular direction or
directions.
Jet fires are usually fuelled by gas, two-phase flashing liquids and pure liquid releases.
A jet fire composition will depend on:
 the fuel’s composition

 the conditions under which it was released
 the rate at which it is released
 the direction(s) of its release
 the prevailing weather conditions, in particular the wind speed and direction at the time of
release.
Jet fires will present a significant risk to personnel, plant and equipment, particularly on offshore
installations as the high temperatures of burning liquids sprayed onto surfaces can lead to structural,
vessel and pipework failures all of which can cause an escalation of the situation.
The confinement conditions will also have a bearing on the jet fire – either confined or unconfined. A
release of crude oil, or of mixed fuels, will have different heat flux characteristics on contact with
heated surfaces, so in a confined space a jet fires temperatures will be carried through the structure
more readily than when unconfined, where prevailing weather conditions will affect the jet flame.
A confined jet flame will also produce smoke, thermal decomposition products and carbon
monoxide / carbon dioxide content.
If water is present in the fuel this can result in a more unstable jet flame, and in the case of an
unconfined jet fire, the flame may be extinguished before the fuel supply can be isolated, resulting in
the potential for an explosion to occur.
During the design phase of process plant and equipment, consideration must be given to the
potential length of any jet fire flames, to ensure no buildings or structures are placed in close
proximity and to ensure safety areas are maintained.
Pool fires are turbulent diffusing fires which burn above a horizontal pool of vaporising hydrocarbon
fuel. As opposed to a jet fire, a pool fire has little or no momentum.

Unit IOG1 Element 3
The rate of burning for a pool fire will be the same
regardless if the pool is floating on water or a steel
deck.
Outdoor pool fires will be well ventilated, or if

occurring within an enclosed space may become under-
ventilated and can be either static or running fires.
Pool fires present a significant risk offshore, particularly

where the installation holds large amounts of liquid Figure 3.16: Cataño oil refinery fire 2009,
hydrocarbon fuels and the risk they pose to escape Puerto Rico
routes due to the large volume of smoke and flames.
Pool fires involving heavy hydrocarbons will produce large volumes of smoke, whilst pool fires
involving LNG will burn more cleanly.
Hydrocarbon vapour clouds

Hydrocarbon vapour clouds are formed during the release of hydrocarbon fuels, such as the
vaporisation of a release of liquefied gas from a ruptured vessel or pipeline.
Vapour clouds can be ignited by an ignition source of greater energy than the minimum ignition
energy of the vapour cloud, and can result in an explosion the effects of which may be:
 overpressure
 fire
 explosion
 flying debris as missiles.
Mechanisms of vapour cloud explosions and fire spread

An extremely dangerous situation will occur if a large mixture of combustible fuel/gas and air is
formed in a cloud and ignites.
The time period from the release of the fuel mixture in air through to ignition can range from a few
seconds, to tens of minutes. The amount of fuel involved can also vary, in the case of gas the amount
can vary from a few kilograms to up to several tons.
The pressure generated by an explosion’s combustion wave is dependent upon how fast the flame
propagates through the explosive mixture, and how easily the pressure can expand away from the
cloud (this is governed by confinement).

Unit IOG1 Element 3
When a cloud is ignited, the flame can propagate through it in two different ways.
Deflagration is the most common

mode of flame propagation, where the Pipe
flame front travels at subsonic speeds

Expanding hot
(typically not in excess of 300 m/s) Unburned fuels combustion products
through the unburned gas reaching a

pressure of several bars. Direction of burning
Figure 3.17: Deflagration in a pipe
Detonation is where the speed of the

flame front is supersonic. In a fuel/air
cloud a detonation wave will move at
speeds of between 1 500 and
2 000 m/s and reach a peak pressure in
front of the flame of 15 to 20 bar.
Where the pressure font is enclosed
within a building or structure, this can
Figure 3.18: A US Marines detonation in Helmand
lead to substantial damage including
province, Afghanistan
the collapse of the building or
structure.
When an explosion of a fuel/air cloud is ignited by a spark, the flame will normally start out with a
velocity of between 3 to 4 m/s. If the cloud is uncontained and unobstructed then the flame is
unlikely to accelerate to velocities of more than 20 to 25 m/s, with the overpressure negligible.
Within a building, or other enclosed space, the temperature of the burning mixture will increase,
with the air/fuel mixture expanding by a factor of up to 8 or 9. This will have the effect of
accelerating the flame front to several hundred metres per second.
If the ignition source originates from a weak source, such as a hot surface or spark, the explosion will
initially start as a slow burning deflagration. Due to obstructing objects and confinement, the
deflagration can accelerate and become fast burning.
When a deflagration becomes sufficiently rapid, a sudden transition from deflagration to detonation
can occur.
If this transition between deflagration and detonation occurs, pressure loads of up to 50 bar can
occur locally, resulting in severe damage within the building, compartment, etc.

Unit IOG1 Element 3
Boiling liquid expanding vapour explosions (BLEVEs)
A BLEVE (ble-vee) occurs when a tank containing a liquid,
Feyzin, Eastern France 1966
held above its atmospheric pressure boiling point
ruptures resulting in the explosive vaporisation of a large On the morning of 4 January 1966
portion of the tank contents. whilst attempting to drain off an
aqueous layer from a propane
The process is as follows. storage sphere, a temporarily blocked
 Fire impinges upon the walls of the tank or cylinder. valve allowed liquid propane to gush
out.
 Fire heats the walls of the tank.
 The liquid within the tank cools the tank metal. The resulting vapour cloud found an
 As the temperature increases the tank contents boil ignition source and enveloped a
and vaporise causing an increase in pressure. storage sphere in a fire, the heat from
 The pressure relief valve operates, letting off excess which caused an overpressurisation of
pressure (this vapour may be ignited by the fire and the sphere resulting in the relief valve
flare off). opening releasing LPG vapour which
 Once the pressure is relieved the valve closes. was ignited.
 This cycle will be repeated. The LPG tank farm contained 8
 The liquid levels within the tank fall. propane and butane spheres, and the
 The tank metal above the liquid level is not cooled, responding fire service personnel
as it heats it expands and weakens until it eventually concentrated on cooling the
ruptures. remaining spheres.
 Upon rupture the tank contents are explosively
vaporised. 90 minutes after the initial incident,
the burning sphere ruptured resulting
The effects of a flammable liquid BLEVE include: in a fireball which killed and injured
firemen and spectators.
 a major fireball, as vapour and liquid droplets are
ignited Debris caused the leg of an adjacent
 thermal radiation sphere resulting in a BLEVE, with a
 flying debris (tank shrapnel) further 3 spheres falling over due to
the collapse of their supports – these
 flying droplets of burning fuel which can cause
secondary fires ruptured but did not explode.
The fire was eventually brought under

A BLEVE occurring in a propane sphere of 15 m in
control 48 hours later. 18 people were
diameter can cause damage as far away as 4 500 m, with
killed with a further 81 injured and 5
radiation and debris damage both extending to around
storage spheres destroyed.
1 000 m. The emitted radiant heat could ignite adjacent
wooden structures, further spreading the fire.
Web links
th
Refinery fire at Feyzin. 4 January 1966 webpage from the UK’s Health and
www.hse.gov.uk/comah/sragtech/casefeyzin66.htm

Unit IOG1 Element 3
Confined vapour cloud explosion (CVCE)
CVCEs occur when a flammable vapour
Danvers, USA 2006
cloud ignites within a confined space, such
as a process vessel or building. In November 2006 at the CAI/Arnel manufacturing
facility in Danvers, an explosion occurred which
 A pressure build-up results in the
destroyed the facility and heavily damaged
containing walls rupturing.
adjacent homes and businesses. Windows in
 A relatively small amount of flammable
premises over 2 miles away were also shattered.
material results in a significant
explosion. The US Chemical Safety and Hazard Investigation
 Such explosions causing considerable Board (CSB) identified that the explosion was the
damage. result of vapour released from a 2 000 gallon tank
 CVCEs have insufficient energy to of highly flammable liquid. An open steam valve
produce more than localised effects, but on the tank heater caused the flammable liquid to
for anyone close to the explosion, flying overheat, and accumulate within the building
debris will cause injuries together with production area at an explosive concentration.
flash-burns and in some cases fatalities. This resulted in the ignition of the flammable
atmosphere and a rapid expansion of ignited
vapour inside the building creating a pressure
wave that shattered destroyed the building and
ignited large quantities of flammable liquids
stored inside, as well as industrial grade
nitrocellulose material stored nearby.
The resultant fire to 17 hours to be extinguished.

Web links
CAI/Arnel Chemical Plant Explosion webpages from the US Chemical Safety

Board (CSB)
www.csb.gov/cai-/-arnel-chemical-plant-explosion

Unit IOG1 Element 3
Unconfined Vapour Cloud Explosion (UVCE)
UVCEs occur when a substantial amount
Flixborough, United Kingdom 1974
of flammable gas or vapour is released
into the atmosphere and its subsequent At 16:53 1 June 1974 an explosion occurred at the
ignition. chemical factory owned and operated by Nypro
(UK) Ltd. The explosion was the equivalent of
UVCEs can cause considerable damage. between 15 and 45 tonnes of TNT explosive.
 A large amount of volatile material is The plant oxidised cyclohexane which, when
released rapidly into the atmosphere to heated to 155oC at a pressure of 128 psi produced
form a vapour cloud and disperse. caprolactam – this was used in the manufacturing
 If the vapour cloud comes into contact of nylon.
with an ignition source before it is In addition the site also stored large quantities of
diluted below its lower flammable limit, benzene, toluene, naphtha and gasoline.
a UVCE will occur.
The process consisted of six reactors in a series
 Shock waves and thermal radiation from
containing a total of 120 tonnes of cyclohexane,
the explosion affecting both the site and
and a small amount of cyclohexanol. The sixth
surrounding area.
reactor in the series contained 94% cyclohexane.
 The effects will be most pronounced
when explosions involve reactive gases The fifth reactor had developed a 6 foot crack, and
– such as ethylene – and least where was bypassed using a 20 inch diameter pipe fitted
unreactive gases are involved – such as between the 4th and 6th reactors.
natural gas. As each reactor was 14 inches below the preceding
one, a dog-leg was welded into this pipe (the pipe
was fabricated from material on-site, but not from
the same material as specified by the designers).
An expansion joint, in this case bellows, was
incorrectly installed and is thought to be the main
cause of the accident.
This temporary pipe failed resulting in a release of

a large vapour cloud of cyclohexane which was
ignited.
26 workers were killed, 36 injured and 53 injuries
reported to people outside of the site.
Web links
st
Flixborough (Nypro UK) Explosion 1 June 1974 webpage from the UK’s
Health and Safety Executive (HSE)
www.hse.gov.uk/comah/sragtech/caseflixboroug74.htm

Unit IOG1 Element 3
Preventing vapour cloud explosions
VCEs can be prevented through:
 location – siting hydrocarbon process plants away from residential areas to minimise the off-site
consequences if an explosion does occur
 quantities stored – keep the amounts of volatile liquids, especially those stored under pressure,
and gases to the minimum
 design and layout – include the installation of remote isolation and shut-off valves, provide as
much space around process vessels and containment vessels as is possible to achieve, route
pipelines, cables and services together where possible
 buildings – well-ventilated but resistant to the entry of vapours, minimum number of occupants
when located near process plant and containment vessels, if required in close proximity to a
process unit/containment vessel consideration to providing blast protection must be made
 emergency and safety measures – include the installation of leak monitoring and detection
devices, water sprinkler systems and automated alarm systems.
(a) Identify TWO ways in which vapour clouds can be 2 marks

Exam question
generated.
(b) Outline how a vapour cloud explosion can be generated. 4 marks
(c) Identify the physical consequences of vapour cloud 2 marks

explosions.


Unit IOG1 Element 3
Pipelines
Pipelines are a versatile means of transporting oil,
hydrocarbon products and gas either overland, or on the
seabed.
Pipelines are generally constructed from steel or plastic

tubes, with diameters from 100 mm to 1200 mm and can
be sited:
 above ground
 buried between 1 and 2 m underground
 deployed on the seabed connected to offshore
Figure 3.19: Trans-Alaska pipeline
platforms.
Products are pumped through the pipeline through intermediate pumping stations, usually at speeds
of between 1 to 6 m/s.
Crude oil can contain varying amounts of wax, which can accumulate within the pipeline, especially
under colder conditions.
Therefore, pipelines require regular inspection and cleaning to remove deposits which will affect the
flow of the product, together with adding additional weight to the pipeline.
Generally there are three types of pipeline.
 Gathering pipelines – used for transporting oil and gas from wells to treatment and processing
plants.
 Transportation pipelines – larger pipelines for transporting oil, gas and refined products cross-
country.
 Distribution pipelines – consisting of smaller pipes for delivering oil to consumer outlets.
The pipeline will also be supported by field services, which will include instrumentation, data and
communications. Pumping stations and entry/recovery points for ‘pigs’ will also be provided. A
‘pig’ is a device used to carry out inspections or clean the inside of a pipeline – smart pigs will be
sent along the inside of pipelines to inspect and record internal conditions and remove wax
deposits.
Instrumentation positioned along points of the pipeline are known as remote terminal units
(RTUs), and will be connected to a central control room to allow the monitoring of flow rates,
pressure, temperature, etc.
Leak detection and flow monitoring

Whilst it is important to detect leaks, oil and gas companies also invest in equipment that will alert
them to changes in flow rates, which could be due to a ‘tapping’ point having been installed without
their knowledge. This is particularly relevant to overland pipelines crossing national boundaries.
There are many ways of monitoring pipelines, ranging from walking the pipeline to visually inspect it,
to satellite surveillance and location systems.

Unit IOG1 Element 3
Computational pipeline monitoring (CPM) systems will gather data from a pipeline on pressure,
flow-rates and temperature, so that the fluid behaviour of the pipelines contents are constantly
plotted and compared next to standard data. This will allow the detection of leaks, or illegal taps, as
well as other issues such as vandalism, arson, terrorism or damage to due animals, falling trees,
weather conditions, etc.
Web links
Pipelines health and safety from the UK’s Health and Safety Executive (HSE)
www.hse.gov.uk/pipelines/index.htm
The diagram below shows a typical arrangement for receiving a pipeline

inspection gauge (PIG). A pressure gauge (P) and a PIG detector (D) exist within
the receiver/trap. The detector (D) confirms that the PIG has been received in
the trap, having earlier been launched upstream at high pressure.
Main line flow
Main line isolating By-pass valve C Vent valve E

valve A
Exam question
P D
PIG receiver/trap PIG Door
Main line flow

PIG receiver
isolating valve B
Drain valve D
(a) Outline the functions of a PIG. 4 marks
(b) Using the information and diagram above:
(i) identify TWO valves that must be closed before 2 marks

removing the PIG from the door
(ii) identify TWO valves that must be open before 2 marks
removing the PIG from the door.


Unit IOG1 Element 3
Decommissioning
Decommissioning – onshore
Decommissioning of plant will usually occur at the end of its lifecycle, after a catastrophic incident
where it is not possible to return it to service after repairs or where the plant is to be moved and
installed at another location.
The decommissioning of hydrocarbon process plant also has the extra safety issues associated with
the product itself, and its associated hazardous nature.
Before decommissioning can begin, a comprehensive plan should be developed with the starting
point being the plant shutdown, before isolation and cleaning ahead of dismantling/deconstruction
can take place.
Similar to carrying out a HAZOP, or similar risk assessment process, before constructing,
commissioning and handing over a new process plant, the similar process should be followed to
identify the hazards associated with shutting down the plant, and setting procedures for the safety
of all persons present on the site, and involved in the shutdown, to ensure a safe transition from
operational status to isolation and disconnection from surrounding process plant, equipment and
pipelines – care must be taken to ensure this will not have an adverse impact on safety equipment
and systems.
Following shutdown and isolation, the next step is the decontamination of the plant.
This will involve the:

 emptying of all process equipment, storage vessels and pipelines
 cleaning and possibly chemical treatment of each item.
Internal and external areas of structures, plant and equipment are likely to have been exposed to
contaminants, so will also require decontamination to:
 remove contaminants and reduce occupational health risks to persons carrying out the
decommissioning of the plant
 salvage equipment and maintain its usability as far as possible
 clean up and restore the site environmentally.
Decontamination will usually involve the use of water, compressed air, and for heavy contamination
steam, caustic and detergents may also be required – again with the risks to the health of those
involved in decontamination evaluated in a risk assessment, referencing into technical information
from suppliers/manufacturers of the cleaning agents used.
The next phase of decommissioning is dismantling. This is carried out in phases and may require the
dismantling of some elements of the structure, process vessel, etc. before decontamination can take
place, with further dismantling and/or breaking up taking place once decontamination is complete.
Where plant and equipment is to be re-used it may require the application of a protective coating or
packaging, before transportation into storage or to another location.

Unit IOG1 Element 3
Where plant and equipment will not be used again, it will require safe disposal and will require the
same level of decontamination as for plant and equipment being retained for future use.
Where practicable the preferred option is to recycle any components, supports, pipelines, etc. which
are suitable for continued use, after decontamination and refurbishment. If not possible, then
disposal will involve scrapping or disposing of the materials in a landfill site.
Decommissioning – offshore
Issues to be considered during planning
Decommissioning an offshore installation should be considered a process rather than a simple
deconstruction activity for the following reasons.
 The nature of the working environment, which can change suddenly and dramatically and have a
serious impact on planned activities.
 The technical nature of decontaminating and dismantling a structure where the surrounding
area is constantly shifting and moving.
 Not all alterations, modifications, etc. may have been included in drawings and plans for the
installation.
 The safe draining and removal of hydrocarbons, and other potentially hazardous substances and
materials stored on the installation.
 Storage for materials, equipment and accommodation for personnel.
 Safe isolation and disconnection from any well-head, undersea pipeline, etc.
 Emergency response and assistance from the mainland in the event of a serious incident.
Securing old oil and gas wells

This is essential to ensure no dangerous situations are caused by the uncontrolled release of any
hydrocarbons retained within the well-head and drill system, together with the environmental
impact caused by the release of hydrocarbons, sludges, etc. in the sea.
Full site details must be acquired, including all safety case information to allow a full determination
of the hazards, and development of appropriate procedures to safely secure and isolate any existing
oil and gas wells.
Adequate finance will need to be in place, as the decommissioning agent will need to know the costs
associated with plugging the well, abandoning equipment in place, etc.
Only contractors who have a proven track record and experience in securing existing oil and gas
wells should be selected to carry out such tasks.

Unit IOG1 Element 3
Decommissioning of topside production platforms
Part of the decommissioning process will be the removal and disposal of the sections of the
installation above sea level. This will involve:
 removal of the deck support structures, including accommodation blocks and other facilities
 removal of the drilling deck and plant
 removal of plant and structures associated with the storage and transportation of oil and gas
brought to the surface.
The size and configuration of all of the above will differ from platform to platform, and will require a
survey to identify hazards to the health and safety of personnel carrying out the decommissioning.
This will require making a decision on how to safely remove and dispose of the platform and
associated structures, etc. Possible options include:
 the piecemeal dismantling of the rig in-situ

 removing the rig in modules
 dismantling in the reverse order of construction
 dismantling in unrelated small units.
As with onshore installations, disposal will be based on future requirements for any re-useable
components and the cost of transporting components to shore for breaking up to allow recycling of
re-usable materials or eventual disposal at a suitable landfill facility.
Decommissioning and disposal of deck and jacket structures

Deck structures are usually installed as modules, therefore during decommissioning and dismantling
the option to remove them in their as-installed configuration should be explored. This will require
the use of lifting vessels alongside the platform, to lift and lower the modules on to suitable
transport vessels.
The jacket structure (the structure supporting the platform from the seabed) poses a different set of
challenges and problems. How much of it can safely be left in place? This will have been in place for
years, possibly decades, and will have developed and support its own marine eco-system, but if left
in place will pose a hazard to marine transport.
The decommissioning agent will need to make a determination, in consultation with national marine
agencies/bodies as to the pros and cons of:
 leaving the structure in place to continue to provide an established marine eco-system and, if
close to shore, marine recreation (e.g. scuba diving) and the need to provide effective maritime
warning and navigation beacons to mark the location
 dismantling the structure from the surface to the seabed with the risks associated with working
at depth.
Due to the size of such structures, especially those on the seabed, it may be more economical to
abandon in place, following consultation with the relevant national or international marine agencies.

Unit IOG1 Element 3
Pipeline and power cable decommissioning
Pipelines in diameters ranging from 100 mm to 500 mm will be in place to transport oil and gas
product from the well-head to the platform or from the platform to an onshore facility. Other
pipelines may be used for process and service water.
As with other aspects of decommissioning an offshore platform, the decommissioning of pipelines

will present environmental, safety and technical challenges, such as:
 the location and depth of pipelines which are buried under the seabed
 the water depth along the full run of the pipeline
 the proximity of any other pipelines or marine structures, and the environmental impact of
removal on marine life-forms, such as kelp beds, coral formations, etc.
To reduce emissions associated with providing electrical power on a platform, electricity may be
supplied via cables laid on the seabed from an onshore facility. Again the environmental, technical
and safety challenges of their removal need to be considered. It is more common to disconnect the
power cables and to leave them in place, as opposed to dragging them up from the seabed and the
damage this can cause to aquatic flora and fauna. For both of these, the decommissioning work will
take place along the full length of the pipeline/cable, not just at the onshore and offshore
connections.
Clearance and verification

All remaining sub-surface structures, platform debris and its operations and any seabed disturbances
are cleaned up.
For seabeds, unless abandoning in place represents a major operational loss, it is more common to
leave seabed structures in place for the same reasons discussed above.
The amount of time the platform has been in place, and the nature of the operations and debris
likely to have been disposed of from the platform, will determine the nature and duration of any
seabed clean-up and removal operations.
Decommissioning and removal of associated onshore facilities

Associated with the decommissioning of offshore platforms will be the decommissioning of any
related onshore service facilities that will no longer be in operational use, such as storage vessels,
pipelines, marine terminals, etc.
The decommissioning, dismantling and disposal of these must be considered and planned at the
same time as the activities taking place offshore.
The decommissioning should follow the steps outlined for onshore facilities.

Unit IOG1 Element 3
Environmental issues associated with decommissioning operations
Both onshore and offshore decommissioning operations will have a variety of impacts on the local
environment.
Impact on soil and ground water contamination

Decommissioning and decontamination of onshore facilities will need to consider the environmental
impact of any contaminated water run-off from cleaning operations. As discussed previously,
interceptors should be used to trap oil and deposits, before any water run-off enters any site
drainage systems, with the oil and deposits removed for safe disposal by a registered waste
contractor.
Planning should also include the likelihood of any contaminants penetrating the ground to reach the
water table. To prevent this identification of a decontamination area with an impervious hard
standing, bund and drainage/interceptor arrangements should be in place, with all decontamination
operations covered by a permit-to-work, risk assessments and safe systems of work.
To safeguard the health of personnel carrying out decontamination activities, health surveillance,
appropriate personal protective equipment and welfare facilities must also be provided.
Air quality/pollution
Environmental monitoring of the air quality during dismantling and decontamination activities will
need to be scheduled for the duration of the project. Air quality issues can arise in connection with:
 venting and opening up process vessels, storage tanks, etc. to atmosphere or during
purging/inerting operations
 cutting and burning operations using oxy-acetylene cutting equipment, or cold cutting using high
pressure water jets
 spraying of detergent and other cleaning agents onto structures for decontamination in place
prior to dismantling and removal
 the accidental release of asbestos, PCBs (polychlorinated biphenyls), hydrocarbons, etc. during
their removal.
Prior to decommissioning commencing, a full survey of the structure, plant, etc. should be carried
out to identify any potential health hazards, determine the route of exposure and likely health
effects and develop preventative measures to avoid or minimise exposure to any hazards by
personnel involved in such tasks.
Noise
Noise will be generated due to the use of plant and equipment during cutting, grinding, lifting, etc.
operations.
As with air quality, regular checks on the noise levels personnel will be exposed to in different areas
will need to be carried out by competent persons.

Unit IOG1 Element 3
Where noise levels exceed nationally set limits (in the UK above 80 dB(a)), consider:
 attenuating the noise level at source through the use of sound absorbing screens
 providing personnel with appropriate hearing protection, and instruction on the effects of high
noise levels to their hearing
 enforcement of the wearing of hearing protection through supervision, warning notices, etc.
Effects on commercial and recreational fishing and marine transport

During decommissioning activities offshore consideration must be given to the impact on fishing in
and around the ‘site’. It may be necessary to prevent the contamination of the food chain, that
commercial and recreational fishing is suspended for the duration of the project. This would need to
be carried out in consultation with the relevant national and international organisations.
Consideration must also be given to the navigational hazard decommissioning operations may pose,
which may require the setting up an exclusion zone for maritime transport.
Where sub-surface/seabed structures are left in place, navigational charts will need to be updated
so that drag nets from fishing vessels do not snag on such structures.
Impact on the marine environment from explosives

Whilst the deck and jackets can be taken down piecemeal or in modules, explosives may be used on
sub-surface/seabed legs and piling. Therefore an analysis on the impact to the seabed and marine
eco-systems must be carried out, again in consultation with national and international maritime
organisations.
Effects of decommissioning activities on marine eco-systems

Oil and gas installation structures on the seabed, or below the surface, will develop their own marine
eco-system and communities, in essence an artificial reef will be formed.
Wherever possible, seabed structures should be abandoned in place to prevent harm to marine eco-
systems from dismantling, dragging, explosives, etc.
Onshore oil and gas well decommissioning and abandonment statutory

guidance from the UK Government
www.gov.uk/government/publications/onshore-oil-and-gas-well-
decommissioning-and-abandonment
Web links
Oil and gas: decommissioning of offshore installations and pipelines

guidance from the UK Government
www.gov.uk/oil-and-gas-decommissioning-of-offshore-installations-and-
pipelines
Decommissioning Committee webpages from the International Association

of Oil & Gas Producers (IOGP)
www.iogp.org/decommissioning-committee

Unit IOG1 Element 3
Management of simultaneous operations
It is common for offshore operations to involve more than one activity
‘Simultaneous
taking place simultaneously such as:
operations’ (SIMOPs)
 operations at multiple well-heads all feeding into one platform is the term used to
 drilling for and the recovery of oil and gas describe the potential
 resupply operations from support vessels clash of activities
 diving operations from diving vessels which will have both
 lifting operations from lifting vessels safety and operational
 use of fixed or floating production platforms. implications.
SIMOPS can occur:
 when more than one contractor is working on the platform at the same time
 when responding to process failures, such as hydrocarbon leaks, whilst other processes and
activities are going on
 where there is overlap between the platform and support vessel operations
 when simultaneous maintenance operations are being carried out on the same plant/area by
different teams or contractors.
Where SIMOPS occur, they should be controlled through:

 planning and scheduling meetings between maintenance and operations personnel, especially
those with responsibility for planning and scheduling operations
 risk assessment and issuing an appropriate safe system of work controlled through the permit-
to-work system, including operational constraints on parties working in close proximity to each
other
 effective two-way communications between operations and maintenance teams, support vessel
crew, etc. especially in the event the SIMOP is due to a process failure
 reviewing the emergency plan prior to work commencing, where possible, to identify any issues
with escape routes, rescue points, etc. and interference with safety equipment
 reviewing the task at the end of any simultaneous operations, to identify any issues, lessons
learned, etc.

Unit IOG1 Element 3
3.53.5Fire hazards,
Fire hazards, risks andrisks
controlsand controls
The fire triangle
Figure 3.20: The fire triangle
Fire is a chemical reaction involving rapid oxidation (burning) of a fuel. Three things must be present
at the same time in order to produce fire.
 Fuel – any combustible material - solid, liquid or gas.
 Oxygen – sufficient oxygen must be present in the atmosphere surrounding the fuel for fire to
burn.
 Heat/ignition – sufficient heat energy must be applied to raise the fuel to its ignition
temperature.
The combination of these three elements is frequently referred to as the ‘fire triangle’.
The important thing to remember is that if any one of these three things can be removed there will
be no fire or the fire will be extinguished.
The principle sources of fuel for workplace fires are:
Liquids
Solids
Examples: gasoline,
Examples: coal, timber,
kerosene, turpentine,
paper, plastics.
alcohol, paints.
Gases
Examples: natural gas,
LPG, hydrogen, acetylene.

Unit IOG1 Element 3
Air is approximately 21% oxygen, making it a ready source of oxygen. In workplaces natural or
powered ventilation systems can introduce additional oxygen. It can also be present in the form of:
 oxygen cylinders – oxy-acetylene welding or cutting, oxygen cylinders in medical centres

 chemical reactions – oxidizing agents such as nitrates, chlorates, chromates and peroxides
release oxygen as they burn.
The principle sources of heat/ignition for workplace fires are
 naked flames
 external sparks
 internal sparking
 static electricity
 hot surfaces
 chemical reactions.
Classification of fire
In the UK fires are classified in accordance with BS EN 2 Classification of fires as follows (this is in line
with EU and International classification, but the US have a different system).
A Class A – combustible solids

 wood, paper, cloth, etc.
B Class B – flammable liquids

 petrol, diesel, oil, etc.
C Class C – flammable gases

 butane, propane, natural gas, methane, etc.
D Class D – metal fires

 potassium, magnesium, lithium (batteries).
Electrical
 a source of ignition – casings of electrical appliances would be a class a fire.
F Class F – cooking oils/fats

 cooking fats and oils heated to high temperatures.

Unit IOG1 Element 3
BS EN 2:1992 Classification of fires
Web links
shop.bsigroup.com/ProductDetail/?pid=000000000030124873
Extinguishers Basics webpage from the US Occupational Safety and Health

Administration (OSHA)
www.osha.gov/SLTC/etools/evacuation/portable_about.html

Unit IOG1 Element 3
How an explosion or fire will occur
To fully understand the difference between fire and explosion, we need to understand the following
definitions.
 Combustion – a chemical reaction, or series of reactions in which heat and light are evolved.
 Fire – the chemical reaction caused by the combining of fuel and oxygen, with the application of
sufficient heat to cause ignition.
 Fuel – either in the form of a gas, liquid or solid which will allow combustion to take place,
depending upon the fuel’s state.
A block of wood will require a hotter heat source (greater ignition energy) for combustion to occur
than will be required to ignite petrol. This is because when heated, combustible materials give off
flammable gases and vapours, which if the temperature is high enough and a sufficient level of
oxygen is present, ignition of these gases and vapours will occur resulting in a fire. Therefore, if the
petrol is already producing vapours it will be easier to ignite than the block of wood.
All materials will burn if sufficient heat is present to cause the molecules to break down and give off
flammable vapour. Once the vapour or gas is released it is this which ignites resulting in more heat
being released and therefore resulting in more reactions and the fire has begun.
The longer the fire burns the more the material will decompose, resulting in less material to react
and ultimately the fire to run out of material to propagate, causing it to die out.
The fire process can be illustrated as follows.
Fuel Smoke
Oxygen
Heat
Ignition
heat
Figure 3.21: The fire process
The decomposition of the material during a fire is referred to as pyrolysis. The smoke which is
produced during a fire contains the unburnt products of pyrolysis, including the vapours given off.

Unit IOG1 Element 3
Stages of combustion
The fire process is ‘exothermic’, as it releases significant

For example, a fire involving
quantities of heat. The amount of heat generated is
polystyrene will give off heat rapidly,
dependent upon the fuel involved and its location.
and therefore the speed at which
the fire develops will increase.
As with any chemical reaction, the control of the amounts
If a fire involves oxidizing chemicals
and levels of heat, fuel and oxygen has a significant bearing
the same effect will occur. When
on the rate of reactions, and the heat output.
heated they will give off large
amounts of oxygen which can
rapidly increase the growth and
There are four recognized stages of combustion:
spread of the fire.
Induction
Smouldering fires involve porous
 This is the start of the fire process.
materials, such as paper, cardboard,
 All three elements of the fire triangle are present in the
sawdust, fibreboard, and is the
right mixtures and states to support combustion.
combustion of a solid in air which
Growth does not produce a flame.
 The growth time may be from a few minutes to several
The smouldering will take place
hours depending on the prevailing conditions.
slowly, so can remain undiscovered
 The fire is now supplied with an uninterrupted flow of
for a long period of time, although it
oxygen or fuel.
can however produce a large volume
 The reactions become more rapid and grow in intensity
of smoke.
to create large volumes of smoke.
 The point at which the fire involves all the combustible To ignite, the smoke must
materials within a room, or area, is referred to as the accumulate and reach its lower
'flashover point' – the time taken to reach this point will flammability limit before ignition can
vary due to factors such as the room size, surface linings, occur.
availability of oxygen and other complex chemical
Some chemical reactions can extract
reactions. heat from surrounding materials.
This is referred to as an endothermic
reaction.

Unit IOG1 Element 3
This process can be illustrated as follows:
Rate of heat release
Flashover Fully developed Decay

zone
Growth
Induction
Time
Figure 3.22: Stages of combustion
Prior to the fire reaching the fully developed stage, there is a period of time where there is a risk of
flashover occurring.
This occurs due to the layering of hot gases beneath a ceiling, and the oxygen concentration in the
air being less than normal. At this time, as the concentration of gaseous fuel rises sharply, if air
enters it will mix with the fuel layer and, given the presence of heat and flame, a flashover will occur.
This is similar to the processes involved during an explosion.
Fully developed
 This is the stage where the reactions are not as rapid as the growth stage, but the fire continues
to burn violently consuming all the available oxygen and fuel sources.
 This stage is characterised by large flames and very high temperatures, in excess of 300oC.
 At this stage the fire is controlled not by the fuel sources present to burn, but by the amount of
oxygen on which it can feed.
Decay
 At this stage, the fire has consumed all the available fuel and will eventually die down and
extinguish – this can be due to the intervention of on-site emergency teams or local emergency
services, or naturally due to the lack of oxygen and fuel to support the combustion stage.

Unit IOG1 Element 3
Fuel sources
Solids
Often referred to as carbonaceous materials and includes:
 wood, cardboard, paper
 hardboard
 soft furnishings (carpets, curtains, furniture coverings)
 plastics
 foam rubber 4
 some metals (lithium, magnesium).
As the structure of solids is based on tightly formed particles, it will require substantial heat sources
to be applied for a fire to be initiated.
Liquids
Liquids will readily supply fuel to a fire due to their ability to release vapour.
Liquids such as petrol, paraffin, white spirit, thinners, varnish and paints
present a significant fire risk.
Other chemicals, such as twin-pack adhesives, acetone and toluene also release 3
vapours, and due to their lower flashpoint present a greater risk.
Aerosol containers contain a flammable liquid, which is pressurized to a level so that it changes to a
gas. Therefore, these containers present a significant risk if they come into direct contact with a heat
source.
In the UK flammable liquids are sub-classified as follows.

 Flammable – Liquids with a flashpoint below 55oC but which are not highly flammable.
 Highly flammable – Liquids with a flashpoint below 21oC, but which are not extremely
flammable.
 Extremely flammable – Liquids with a flashpoint lower than 0oC.
Gases
Common throughout workplaces and include natural gas and liquefiable
petroleum gas (LPG).
The most common type of flammable gas used in workplaces is LPG. These are
stored in pressurized cylinders and include butane and propane.
2
Also dissolved acetylene and oxygen mixtures are used in welding operations.
As with the vapours given off by flammable liquids, gases present a significant risk of fire and they
also pose a significant explosion risk.
Gases do not always pose a risk when in containers. Gases can be produced by chemical reactions,
processes, decomposition of waste oil, contaminated water etc.

Unit IOG1 Element 3
Oxygen
The final part of the fire triangle is oxygen. The air we breathe consists of approximately 21% oxygen
and therefore can influence the behaviour of fire significantly.
Therefore, recognizing how the supply of oxygen can be increased or decreased is vital in
considering control factors.
Ventilation and air handling systems can provide an enhanced supply of oxygen, as can the presence
of oxygen cylinders used in welding, medical use in hospitals, etc.
As with gases, chemical reactions can also produce oxygen. Particular chemicals such as sodium
chlorate (pesticides), hydrogen peroxide (water treatment).
Oxidizers give off highly exothermic reactions which in contact with other
substances, particularly flammable substances.
Oxidizing agents can also increase the combustibility of substances which do

not normally burn in air, or can lower ignition temperatures so that materials 5.1
can burn more readily and violently than normal.
Fire initiators
As we’ve seen previously, for a fire to start there has to be sufficient heat from an initiator or
ignition source.
The most common fire initiators are:

 naked flames – matches, welding torches, lighted cigarettes etc.
 electrical sparking sources – defective switches, electric motors, non-intrinsically safe electrical
equipment
 spontaneous ignition
 sparks from grinding or cutting tools, internal combustion engines, the impact of metal tools,
electrical arcing or static discharge
 static electricity or friction
 hot surfaces – heaters or overheating plant and equipment
 lasers, or other sources of intense non-ionising radiated heat
 chemical reactions, especially between incompatible substances.
About dangerous substances – Liquids webpage from the UK’s Health and
www.hse.gov.uk/fireandexplosion/about.htm#liquids
Web links
Global Harmonized System of Classification and Labelling of Chemicals (GHS)

– Part 2 Physical Hazards – Chapter 2.6 Flammable Liquids
www.unece.org/fileadmin/DAM/trans/danger/publi/ghs/ghs_rev00/English
/GHS-PART-2e.pdf#page=29
GHS hazard pictograms webpage from Wikipedia

en.wikipedia.org/wiki/GHS_hazard_pictograms

Unit IOG1 Element 3
Principles of fire and explosion management
As discussed in previous elements, fire and explosion risks must be identified and evaluated during
the design phase, through the use of HAZOP, HAZID, or other recognised methods.
Fire prevention
 Effective plant and process control design during the initial design phases.
 Structural fire protection of buildings and support structures for process plant, equipment and
pipelines.
 Segregating the storage of flammable liquids and gases away from ignition sources.
 Use of inert gases to purge process vessels and storage tanks prior to maintenance work, or by
providing an inert blanket over flammable liquids in storage.
 Controlling the quantities of flammable liquids and gases stored at the installation, either in
external storage vessels or in suitable storage arrangements within buildings which are designed
and provided with suitable ventilation and detection/alarm systems.
 Minimising the likely ignition sources in process and storage areas through the use of intrinsically
safe equipment.
 Use of monitoring and detection equipment for detecting vapours accidentally released from
storage or process vessel, before they reach the lower/upper explosive limits, which will trigger
an alarm and shutdown of a process unit, pump, etc.
Preventing or mitigating explosions

Explosion management can be broken down into two discrete principles.
 Control.
 Mitigation.
Control
The avoidance of, or minimizing the potential for, an explosive atmosphere is a critical element of
eliminating the risk, or mitigating the consequences, of an explosion.
Oil and gas installation operators must consider the substitution of flammable substances with inert
materials, or minimizing the concentrations of the flammable substances, so as to avoid their
explosive range.
This can be achieved by:

 reducing the storage of flammable gas and/or liquids to the absolute minimum
 limiting the concentration of vapours through the use of mechanical systems linked to
ventilation, which may be actuated via gas or flow detectors.
Where combustible liquids are concerned, the aim should be to reduce the concentration of any
mist formed to below the lower explosive limit. This in turn should ensure it is sufficiently below its
flashpoint and thus prevent an explosion.

Unit IOG1 Element 3
Other techniques include:
 the addition of inert gases, such as nitrogen or carbon dioxide

 utilising water vapour
 using a powdery substance, such as calcium carbonate.
With appropriate dispersal, these materials can prevent the formation of an explosive atmosphere.
This is known as inerting.
Design and construction

When considering the types of equipment, protective systems and components that will contain
flammable substances, all reasonably practicable steps must be taken to ensure the substances
remain enclosed at all times.
It follows that the materials used in the construction of containment vessels, etc. should be non-
combustible themselves.
Leak detection systems should be fitted, with particular attention paid to:
 joints
 piping
 areas that may be subject to impact
 areas that may be subject to hazardous interactions with other substances.
Mitigation
The best means of containing a primary explosion is to ensure that the process equipment is suitably
constructed to withstand one.
The pressure generated by a dust explosion is usually within the range of 5 - 12 bars. To design plant
to the same standards as pressurised vessels is likely to be cost prohibitive, therefore designers look
to design-in explosion venting.
Explosion venting
This is one of the most effective measures for relieving pressure, however it is often difficult to size
the vent correctly to ensure that sufficient pressure relief is available as the vent must allow
sufficient outflow of the burnt fuel and air to relieve the pressure being generated by the heat of the
explosion.
There are a wide variety of designs which are dependent upon the processes being carried out, such
as:
 simple panels which are ejected

 vent covers (attached to process vessels by clips and seals)
 hinged doors that can withstand explosions, or redirect the explosion.

Unit IOG1 Element 3
The vent area will depend upon:
Vented dust
 the volume of the enclosure Explosion vent
 the enclosure’s strength

 the vent cover’s strength
 the burning rate of the vapour cloud.
Dust explosion
The following hazards caused by venting will need to be Fire
controlled or minimized.
 Emission of blast waves from the vent opening.

 Ejection of flames from the vent opening. Figure 3.23: Explosion vent
 Fireballs can be ejected.
 Emission of solid objects, vessel debris, vent covers, etc.

 Reaction forces on the equipment, induced by the venting process.
Internal venting may also lead to secondary explosions.
Therefore, consideration must be given to the location of explosion relief panel or venting during the
design stage of process units, vessels, etc.
Explosion suppression
Where explosion venting is not Suppressor
practicable, the next option is explosion Nozzle
Pressure rise
suppression.
detector
Any suppression unit will be: Ignition
 permanently pressurised
 fitted with a large diameter discharge
orifice
 fitted with a valve which will work at a Pressure
high enough speed to discharge the wave Flame
suppressant (often achieved via a
small detonation charge).
The trigger for a suppression system will

either be a pressure sensor or flame
sensor. Each type will have systems to
prevent false alarms and actuation.
Figure 3.24: Explosion suppression

Web links
Fire, explosion and risk assessment webpages from the UK’s Health and
www.hse.gov.uk/offshore/assessment.htm

Unit IOG1 Element 3
Electrostatic discharges
The flow of a flammable liquid through a pipeline can result in the build-up of static electricity. This
results from the contact between moving dissimilar materials in this case the flammable liquid and
the pipeline’s interior coating, which results in positive and negative charges to separate and
accumulate within the liquid and on the pipeline itself.
Many fuels present on oil and gas installations are capable of accumulating and retaining charges
during high flow-rates, with this accumulated static electrical charge eventually released. If the
discharge energy is of sufficient potential it can result in the ignition of a fuel/air mixture. The
potential of any charge to ignite a flammable fuel/air mixture will be dependent upon the
flammability limits of any such mixture.
Static electricity can be generated during processes such as:
 mixing
 pouring
 pumping
 filtering
 agitating liquids.
The rate of generation is determined by the following factors.

 Conductivity – some flammable liquids can easily conduct electrical charges and will accumulate
static charges.
 Turbulence – large flow-rates, splashing or free-falling liquids will increase the accumulation of
static charges.
 Surface area – filters installed into pipelines, etc. will have a large surface area and can generate
higher levels of electrostatic charge than pipework without filtration systems installed.
 Flow-rate – as discussed in turbulence, high flow-rates can result in the accumulation of
electrostatic charges.
 Presence of impurities – the mixing of dissimilar substances with flammable liquids, such as
water or rust, will increase static generation.
The risk of electrostatic generation and accumulation can be minimised through:
 controlling and monitoring pumping rates

 correct sizing of pipelines to keep liquid velocities low
 eliminating splash filling and free-falling flammable liquids by:
 lowering filling velocities
 directing the discharge of liquid down the side of the vessel
 submerging fill pipes below the liquid level in a vessel
 installing filters far enough upstream of discharge points to allow adequate time for any static
charge to dissipate.

Unit IOG1 Element 3
One of the activities conducted at an oil or gas installation that can produce electrostatic discharge is
during the transfer of fuel from one vessel to another, as instead of following the flow of the fuel any
charge will find an easier route and discharge to ground.
Therefore, during fuel loading/unloading activities effective bonding and earthing systems must be
in place. These will reduce the discharge by allowing continuity through the fuelling system’s
connections, as will conducting materials in the vessel and pipework’s structures.
In some cases additives can be added to fuels to prevent, or dissipate, any build-up of static
electrical charges.
Lightning
Lightning is a natural form of static electricity. A large amount of electrical energy is dissipated in a
short period of time in a limited space with varying degrees of damage. The vast majority of lightning
strikes exceed 3 000 amps.
Before a lightning strike the electrical potential between the cloud and the earth could be as much
as 1 000 000 watts per metre of strike. Therefore oil and gas facilities must be protected against
lightning strikes, with the measures employed based upon:
 the lightning strike risk
 the number of people likely to be affected
 the location of the structure and the nearness of other tall structures
 the type of construction, including materials used
 the contents of the structure or premises including any flammable substances, floating roofs on
storage vessels, etc.
An operator is draining a flammable liquid from process pipework to a metal

container. The supervisor is concerned about the possibility of an electrostatic
charge forming and stops this operation until a risk assessment is undertaken.
Exam question
During this work activity:
(a) identify factors that influence the generation of the 4 marks

electrostatic charge
(b) outline practical ways of minimising the formation of an 4 marks

electrostatic charge.


Unit IOG1 Element 3
Classification of zones and plant layout
Any building or plant where there is a potential for gaseous explosions must be designed on similar
lines to those in which explosives are manufactured and stored. This will include:
 locating such buildings or plant away from other buildings, with operational parts of the plant as
remote from one another as possible
 constructing buildings of one-storey only and kept as low as possible
 the explosion prone parts of any process should be kept as high as possible (on a building this
should be at roof level, to minimize the risk of building collapse)
 where any hazardous part of the plant is located within a building, the area should be reinforced
and protected from the rest of the area by a blast wall
 escape routes and other emergency response planning must take into account the explosive
nature.
The classification of hazardous areas into zones is based on the assessment of two factors:
 the frequency of the occurrence of an explosive gas atmosphere

 the duration of the explosive atmosphere.
Figure 3.25: Hazardous zone classifications

Unit IOG1 Element 3
Zones for gases and/or vapours
Zone 0 An explosive atmosphere consisting of a mixture with air of flammable substances in the
form of gas, vapour, or mist is present continuously or for long periods or frequently.
Note: in general these conditions, when they occur, arise inside containers, pipes and
vessels.
Zone 1 A place in which an explosive atmosphere consisting of a mixture with air of flammable
substances in the form of gas, vapour or mist is likely to occur in normal operation
occasionally.
Note: this zone can include, among others, areas in the immediate vicinity of:
 a Zone 0 area
 feed openings
 filling and emptying openings

 fragile equipment, protective systems and components made of glass, ceramics and
the like
 inadequately sealed glands, e.g. on pumps and valves with stuffing-boxes.
Zone 2 A place in which an explosive atmosphere consisting of a mixture with air of flammable
substances in the form of gas, vapour or mist is not likely to occur in normal operation
but, if it does occur, will persist for a short period only.
Note: This zone can include, amongst others, places surrounding Zones 0 or 1.
Table 3.4: Explosive atmosphere zones for gases and vapours
Selection of safe equipment

The zone will determine the requirements for the selection of equipment to be used in hazardous
areas.
 Zone 0 – Category 1 equipment.

 Zone 1 – Category 1 or 2 equipment.
 Zone 2 – Category 1, 2 or 3 equipment.

Unit IOG1 Element 3
Types of equipment
Type of Ex
Definition Zone(s) Examples
equipment code
The principle behind intrinsically safe

Intrinsically i ia Zone 0 Commonly used in
equipment is to ensure that the
safe Zone 1 instrumentation
available electrical and thermal energy
equipment Zone 2 and monitoring
in the system is always low enough that
equipment in areas
ignition of the hazardous atmosphere
ib Zone 1 where flammable
cannot occur.
Zone 2 liquids or gases are
This is achieved by ensuring that only present,
low voltages and currents enter the communications
hazardous area, and that no significant equipment used by
ic Zone 2
energy storage is possible. operations
personnel, etc.
Classed in 3 sub-types – ia, ib, ic.
Flameproof d Equipment in a totally enclosed casing Zone 1 Motors, lighting,

strong enough to withstand the effects switchgear.
Zone 2
of an internal explosion without igniting
the flammable atmosphere in which the
equipment is located.
Will require regular maintenance to

ensure the integrity of the casing.
Increased e Equipment which does not spark or Zone 2 Induction motors

safety generate temperatures high enough to and transformers.
ignite a flammable atmosphere.
Non- n Non-sparking equipment. Zone 2 Solid-state relays.

sparking
Table 3.5: Types of equipment
Hazardous Area Classification and Control of Ignition Sources webpages

from the UK’s Health and Safety Executive (HSE)
www.hse.gov.uk/comah/sragtech/techmeasareaclas.htm
Web links
Electrical and control systems webpages from the UK’s Health and Safety
Executive (HSE)
www.hse.gov.uk/offshore/controlsystems.htm
Hazardous (classified) locations standards webpages from the US

Occupational Safety and Health Administration (OSHA)
www.osha.gov/pls/oshaweb/owadisp.show_document?p_id=9884&p_table
=STANDARDS

Unit IOG1 Element 3
3.63.6Furnace andoperations
Furnace and boiler boiler operations
Use of furnaces and boilers

Furnaces and boilers are primarily used to generate steam by heating water, which is then used at oil
and gas installations for various processes, such as:
 heating and steam for turbine operations
 steam cleaning and washing
 product recovery at wells
 heat sources for some oil and gas processes.
Furnaces
Furnaces are used in oil refineries to directly heat crude oil. By reaching its boiling point fractional
distillation occurs separating the various petroleum products, such as LPG, petrol, kerosene, diesel
oil, fuel oil and asphalt.
Figure 3.26: Fractional distillation process
The crude oil is heated in a direct-fired furnace, and then fed into a vertical distillation column at just
above atmospheric pressure and close to 400oC. This results in all but the heaviest fractions flashing
into a vapour.
Steam boilers
In a steam boiler, fuel is ignited to produce a flame, which in turn heats water to above its boiling
point, instead of placing the flame directly under the boiler’s water storage, most modern boilers
now have superheating elements which will concentrate the space in which steam is generated to
give increased energy.
Steam boilers operate on the principle of convection – steam collects at the top of the boiler to pre-
heat water flowing into the boiler via inlet tubes, which ensures cold water does not enter the
boiler, thus keeping a high internal temperature.

Unit IOG1 Element 3
The two types of steam boilers are:
 closed systems – unused condensed steam is recirculated back through the system to be re-
heated
 open systems – unused steam is vented from the system, so a continuous flow of water is
necessary.
Closed and open system boilers can also come in two different configurations.
 Fire tube boilers – consist of an outer shell – referred to as the fire tube – with tubes of water
inside. Heated gases pass through the core of the fire tube to heat water in the internal water
tubes, which in turn generates steam.
Steam out Hot gasses
Boiler
Furnace Smokestack
Figure 3.27: Flame-tube boiler
 Water tube boilers – consists of vertical tubes above the heat source. Water enters the vertical
tube and is heated until steam is produced, which then passes out through the top of the tube.
Hot gasses
Steam out
Water pipes
Furnace
Smokestack
Water in
Figure 3.28: Section through a water tube boiler
Before operation of a boiler operators must ensure all valves and switches are operating correctly,
as well as visually inspecting all pipe fittings and valves to ensure they are clear of blockages and
remain open during use. A low-water cut-off valve should be installed within the system to ensure
water is maintained at operating levels, with regular tests carried out to ensure the low-water cut-
off valve functions correctly.

Unit IOG1 Element 3
All dampers should be fully opened before firing up the boiler, with the boiler’s firebox ventilated to
remove any unburned gases, such as oil fumes, fuel gas, from previous operations. The heating
flame must be maintained at the correct level throughout operation, so as to prevent flame-out or
flame impingement.
Boilers are fitted with safety valves to prevent the pressure rising above pre-set safe operational
limits, and the standard pressure valves fail to operate. It follows that safety valves should be
inspected, tested and maintained regularly to ensure their operation if overpressurisation takes
place.
Hazards associated with the use of furnaces and boilers

Furnaces
Although the heating of crude oil, to produce fractional distillates, takes place within a closed vessel,
the potential for fire and explosion exists if a leak occurs.
Therefore, constant monitoring of temperature and pressure must take place to ensure the process
remains within safe design parameters, and overpressurisation safety measures installed onto
furnaces and distillation columns to prevent fire and explosion occurring.
Boilers
 Loss of pilot gas supply – for the boiler to perform its function a pilot light will need to be
continually maintained to light the boiler fuel. The pilot flame is lit by an ignition transformer,
with the pilot light in turn igniting the main heating flame. For boilers using liquid fuel, the pilot
light is fuelled via an atomizer.
If the pilot flame is extinguished, e.g. due to a disruption in the fuel supply or over-pressure from
the main gas supply, the fuel supply to the pilot light will still enter the unit, resulting in a
potential build-up of flammable and/or explosive gases. This can result in a boiler explosion. To
prevent this flame detectors are used to ensure that the pilot light flame can be ‘seen’ at all
times whilst the boiler is in operation, and an alarm raised if the pilot light is extinguished.
 Low tube flow – the flow of either hot water or heated air through the boiler tubes must be
maintained at all times so that both temperature and pressure in the boiler are maintained
within safe operational limits.
If tube flow is interrupted, or reduced, heat exchange will become inefficient, resulting in
temperature and pressure rises which could result in a boiler explosion.
 Control of tube metal temperature (TMT) – this is essential to ensure excessive stresses are not
placed on boiler tubes during increased periods of demand.
Tube temperature monitoring of the boiler furnace walls, generating tubes, super-heater tubes
and re-heater tubes can minimise problems such as leaks, breaks and blockages in pressurised
areas of the boiler from occurring, as well as detecting heat-transfer reduction due to scale
build-up.
TMT is measured during operating cycles by thermocouples welded into the tube walls.

Unit IOG1 Element 3
An important aspect of boiler operations is the effective management of water content within the
boiler. Where water levels are allowed to run low, major damage can be caused and result in
explosions. Water and temperature levels are usually monitored together. An indicator that water
levels are low will be an increase in temperature above normal operating levels.
Boiler explosions are similar to BLEVEs, as steam will require 1 600 times more space than water and
will expand in seconds. So a sudden release in pressure from a structural failure, loss of water, etc.
will result in the steam being released under high pressure.
Firebox explosions occur after a flame-out has taken place and the firebox is hot. In gas-fuelled /
gas-ignition boiler systems the pilot light could be extinguished due to a disruption in fuel, with the
fuel vapours exploding in the firebox. This is likely to cause damage to the pressurised tubes inside
the boiler shell, resulting in structural failing and release of pressurised steam. This in turn is likely to
lead to a steam explosion.
Overfiring is the term given to an overlarge heating flame, and is caused by either too much fuel
being supplied, or poor flame adjustment, and can lead to flame impingement. This occurs where
the flame used to heat the water within the boiler comes into contact with the boiler’s surfaces and
components, such as heating coils or pipework which will cause erosion and corrosion, cracking and
failure of the materials.
Flame impingement can be prevented by:
 ensuring the burner is always correctly adjusted

 positioning the burner in order to direct flames away from surfaces
 moving the flame further away from surfaces
 ensuring proper flame control during operations.
Poor water management, together with the lack of / incorrect water treatment can also increase the
problems of flame impingement. This can occur through the accumulation of sediment, and other
contaminants, inside tubes which can result in localised heating on the inside of tubes whilst flames
impinge on the outside surfaces of the tubes.
Web links
Furnace/boilers webpages from the UK’s Health and Safety Executive (HSE)
www.hse.gov.uk/comah/sragtech/systems7.htm

Unit IOG1 Element 3
© Astutis Ltd.
All rights reserved.
No part of this study material may be stored in a retrieval system, reproduced

or transmitted in any form, or by any electronic, photographic or other means
without the express written permission of Astutis Ltd.
Applications for written permission to reproduce any part of this study

material should be sent to Astutis Ltd, 6 Charnwood Court, Parc Nantgarw,
Cardiff, CF15 7QZ.
Information sourced from the Health and Safety Executive and Government
Departments has been reproduced and/or adapted under the terms of the
open government license for public sector information version 2.0, as
presented by the National Archives at:
www.nationalarchives.gov.uk/doc/open-government-licence/version/2
Information obtained from other sources has been properly acknowledged

and referenced.
Whilst every effort has been made to ensure the currency and accuracy of the
information contained within Astutis Ltd bears no liability for any omissions or
errors, or any concepts and interpretations advanced by the authors.

Unit IOG1 Element 3

NEBOSH IOG1 Element3

Uploaded by

Copyright:

Available Formats

You might also like

NEBOSH IOG1 Element3

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

NEBOSH IOG1 Element3

Uploaded by

Copyright:

Available Formats

NEBOSH

International Technical Certificate in Oil and Gas Operational Safety

Element 3: Hydrocarbon process safety 2

3.0 Learning outcomes............................................................................................................................ 5

© Astutis Ltd NEBOSH IOGC 2

© Astutis Ltd NEBOSH IOGC 3

© Astutis Ltd NEBOSH IOGC 4

In particular they will be able to:

(3.3) Outline the controls available to maintain safety critical equipment.

© Astutis Ltd NEBOSH IOGC 5

Forces will include:

 pulling or stretching of a material – tensile force

 pushing or squashing a material – compressive force

 a force not applied in a line – shear force

 external forces causing buckling – bending force

 twisting forces – axial or torsional force.

© Astutis Ltd NEBOSH IOGC 6

Creep is known to cause:

 excessive deformation in turbine blades

Stress and strain

© Astutis Ltd NEBOSH IOGC 7

Principle sources of stress

© Astutis Ltd NEBOSH IOGC 8

Stress corrosion cracking will occur when the Examples

The problem can also be greatly increased due to:

© Astutis Ltd NEBOSH IOGC 9

 introducing temperature changes gradually

 owing to the materials structure

Brittle fractures can be caused by the following. Brittle fractures

© Astutis Ltd NEBOSH IOGC 10

Failure of the annular rim

The safe operating envelope

© Astutis Ltd NEBOSH IOGC 11

Applying knowledge of failure modes to the design and operational phases

© Astutis Ltd NEBOSH IOGC 12

(a) Creep. 2 marks

(b) Stress corrosion cracking. 2 marks

(c) Thermal shock. 2 marks

(d) Brittle fracture. 2 marks

Answers are on page 18 of the examiners’ feedback PDF, which you

© Astutis Ltd NEBOSH IOGC 13

Visual inspection of welds

© Astutis Ltd NEBOSH IOGC 14

Dye penetrant inspection

The dye is applied by spraying, which will then

Figure 3.1: Dye penetrant inspection

Magnetic particle inspection

Any defect in the component will show as it will distort

Figure 3.2: Magnetic particle inspection

Any defect present will cause a variation in the returning

Ultrasonic NDT can also detect defects within the

© Astutis Ltd NEBOSH IOGC 15

Involves the passing of a high frequency alternating

The coil is placed next to the surface of an electrically

The radiation will darken the film emulsion, so when

Radiological testing provides a permanent record of the

Liquid is often used, because in the event of a failure, the

Figure 3.6: Pressure testing