FABIG
http://www.fabig.com
Silwood Park, Ascot,
Berkshire, SL5 7QN, UK
Tel: +44 (0) 1344 623345
Fax: +44 (0) 1344 622944
E-mail: fabig@steel-sci.com
http://www.fabig.com
NEWSLETTER
Issue No.30
Published by:
The Steel Construction Institute
R412 EDITORIAL
Welcome to the 30th issue of the FABIG Newsletter.
FABIG held its 23rd Technical Meeting on the 11th
and 12th of September on Fire and Blast Issues on
Deepwater Platforms. The London meeting coincided
with the tragic events that were caused by the terrorist
attacks in the United States. Dr Charles Smith of
the Minerals Management Service (MMS) in the
USA was very kind to continue with the scheduled
meeting in Aberdeen despite the tragic events of the
day before. Our sincere condolences and sympathies
go to him and to the American people.
Delegates at the above meeting should have
already received copies of the Technical Meeting
Review and Certificates of Attendance at the
Technical Meeting.
We have been very busy lately, issuing Technical Note
6 (Design Guide for Steel at Elevated Temperatures
and High Strain Rates) and organising future FABIG
activities and deliverables that are coming up over
the next few months. The December Technical
Meeting will be on Process Integrity and its Role
in Mitigating Fire and Blast. Speakers from Nova
Scotia Offshore Petroleum Board, HSE and Shell
are expected to contribute at the meeting. Our next
Technical Meeting tentatively scheduled for the end
of January will be on our forthcoming Technical Note
entitled “Extensions to the BIGGS Method”. Our last
Technical Meeting for the current year scheduled for
early April 2002 will be on the COMAH Safety Case
(See the Steering Committee Article R414).
We have a series of articles in this issue, which focus
on recent improvements in our knowledge of fire and
CONTENTS PAGE
EDITORIAL
Editorial October 2001
FABIG
FABIG Membership
FABIG Steering Committee
FABIG Web Statistics
TECHNICAL DISCUSSION
A Workbook Approach to Estimating the Flammable
Volume Produced by a Gas Release 5
October 2001
blast engineering:
 Correction note (leaflet which is enclosed with
this Newsletter) and corrected article that was
previously published as R406 ‘A Workbook
Approach to Estimating the Flammable Volume
Produced by a Gas Release’ (see Article R416).
 Risk Based Design of Passive Fire Protection,
which incorporates risks, costs and benefits in the
decision making process (see Article R417).
 Safety Management Offshore: A Systematic
Approach, which is intended to maintain risk
within acceptable range in an organisation’s
operations (see Article R418).
 New Guidelines on Pressure Relief and Blowdown
Systems, which report on the results of a Joint
Industry Project on safe and optimum design of
such systems (see Article R419).
The FABIG Steering Committee meeting took place
on the 11th of September 2001. Several items were
discussed including extending our membership to the
downstream oil and gas industry (see article R414).
We would like to encourage our members to use the
search facility on our web site, which allows users to
search through all past FABIG deliverables including
individual Newsletter Articles. FABIG needs and
welcomes your feedback on how the search facility may
be improved further (e.g. additional search keywords).
I look forward to meeting you at future Technical
Meetings and other related events. Meanwhile, if you
have any suggestions or comments on any FABIG
deliverable or activity, please do not hesitate to contact
me (Fadi Hamdan) at the SCI.
PAGE
Risk-Based Design of Passive Fire Protection 8
1
RESEARCH AND DEVELOPMENT
Safety Management Offshore: A Systematic
2
Approach 13
3
New Guidelines on Pressure Relief
20
4
CONFERENCES, SEMINARS & COURSES 23
CONTACT & FEEDBACK FORM 24
FABIG

R413 FABIG MEMBERSHIP

(as of September 2001)

Oil Companies University

Agip (UK) Ltd Heriot-Watt University, Edinburgh
Amerada Hess Ltd Imperial College of Science, Technology and Medicine
BG University of Bath
BP University of Kingston
Chevron (UK) Ltd University of Liverpool
Chevron, USA University of Manchester
Den norske stats oljeselskap AS University of Ulster
Enterprise Oil plc
ExxonMobil Development Corporation Consultant / Contractor
ExxonMobil Production Corporation Advantica Technologies Ltd
Gaz de France AMEC Services Ltd
Kvaerner Hydrocarbons Amey VECTRA Ltd
Maersk Olie og Gas AS Astonframe Ltd
Marathon Oil UK Ltd BOMEL Ltd
Norsk Hydro COWI (Consulting Engineers &
Shell (UK) Exploration & Production Planners) AS
Talisman Energy (UK) Ltd CREA Consultants Ltd
TotalFinaElf Exploration UK plc EQE International Ltd
Woodside Energy Galbraith Consulting Ltd
GexCon AS
Regulator Granherne Ltd
Canada Nova Scotia Offshore Petroleum Board Kellogg Brown & Root
Health & Safety Executive MSL Engineering Ltd
Minerals Management Service Offshore Environmental Services
Norwegian Petroleum Dictorate RAMBØLL
Risk, Reliability and Safety Engineering
Manufacturer Safetec Nordic AS
Century Dynamics Ltd Salamis (Marine & Industrial) Ltd
Cintec International Ltd SAUF Consulting Ltd
International Coatings Ltd WS Atkins
MechTool Engineering Ltd
Shell Global Solutions Ltd
Van Dam bv

Verifier
Det Norske Veritas AS
Det Norske Veritas Ltd
Det Norske Veritas Principia
Lloyd’s Register of Shipping
Nederlandse Aardolie Maatschappij B.V.

Page 2 Issue 30 - October 2001


R414 FABIG STEERING COMMITTEE MEETING
Introduction
The activities of FABIG are monitored and directed by a Steering
Committee drawn from the FABIG membership. The Steering
Committee has members from organisations that represent the
breadth of industry sectors with interests in FABIG. The following
are the current members of the FABIG Steering Committee:
Richard Barnett Kellogg Brown & Root
Brian Corr BP
Fadi Hamdan SCI
Howard Harte Health & Safety Executive
David Piper Amey VECTRA
Nilesh Popat WS Atkins
Terry Rhodes Shell UK Exploration
Graham Schleyer University of Liverpool
Niall Sinclair Amerada Hess
Charles Smith MMS
The most recent FABIG Steering Committee Meeting was held on
11th September 2001 and this article summaries the key points of
discussion and decisions arising from this meeting.
FABIG Deliverables
All of the FABIG deliverables were reviewed. It was noted that the
recent Technical Meetings had very strong attendance in both
London and Aberdeen. The topic of the next Technical Meeting,
to be held in early December in London and Aberdeen respectively,
was agreed as Process Integrity and its Role in Mitigating Fire and
Blast. Topics for forthcoming Technical Meetings were decided
as The Modified BIGGS Method (to be held in late January 2002)
and the COMAH Onshore Safety Case (to be held in April 2002).
A Technical Meeting will also be held on Phase IIIb Fire and Blast
Joint Industry Project in late June 2002.
This year two Newsletters have been published so far (Issues 28 –
April 2001 and Issue 29 - July 2001). Two more Newsletters are
being published before the end of the calendar year (October 2001
and December 2001). It was decided to send an electronic copy of
the Newsletter for all main contacts in the various FABIG member
organisations. The objectives of the electronic copies are to provide
an added value to our members and to increase FABIG exposure
within the member organisations. However, our member
organisations that feel they are unable to prevent piracy of the
Newsletter are kindly requested to refrain from placing it on their
intranet sites.
It was noted that the Web Site was used primarily to provide
information on FABIG for prospective members, and to contact
FABIG on-line (e.g. to register for Technical Meetings). However,
the search facility on the FABIG Web Site which allows users to
Figure 414.1 Variation of FABIG deliverables with time
Issue 30 - October 2001
FABIG
search through previous Technical Meeting Reviews, Newsletters
and Technical Notes is believed to be currently underused. FABIG
was asked to report on site access statistics (see Article R415) and
to try to determine the location of people using the web site. It was
also suggested that it would be beneficial to FABIG and FABIG
members for reciprocal member links to exist with the site.
A Chart showing FABIG deliverables since FABIG’s establishment
(1992) is shown in Figure 414.1.
Finances and Membership
The Steering Committee reviewed and endorsed the income and
expenditure for the current FABIG Year to date (April 2001 to end
of August 2001). It was noted that the membership fee has not
increased for the last 10 years (since it has not kept up with inflation,
the FABIG membership has actually decreased in real terms). The
FABIG Project Manager was asked to review this and consider an
inflationary rise to ensure that FABIG is able to continue to generate
all its deliverables.
The FABIG Project Manager was asked to contact several
organisations (including the Danish and Australian regulators,
and UK operators who are not FABIG members) to discuss possible
FABIG membership.
The Steering Committee was pleased to learn that the Nova Scotia
Offshore Petroleum Board has now become FABIG members. It
was decided that the drive to increase FABIG membership abroad
should continue and that FABIG should participate in the 2002
OTC Exhibition.
Future Trends
The Committee discussed extending FABIG activities into new
geographical areas and into the downstream oil and gas market, in
line with many of its members’ interests. The April 2002 Technical
Meeting will be on the COMAH Onshore Safety Case and will
launch FABIG onshore.
Further information
For further details, please contact:
Fadi Hamdan or Martin Homer
The Steel Construction Institute
Silwood Park
Ascot
Berkshire SL5 7QN
United Kingdom
Tel: +44 (0) 1344 623 345
Fax: +44 (0) 1344 622 944
E-mail: fabig@steel-sci.com
Web Site: http://www.fabig.com
Page 3
FABIG

R415 FABIG WEB STATISTICS

FABIG Web Site statistics are shown in an attempt to better
understand by-whom and for-what the FABIG Web Site is being
used. N o. of
Domain
requests
For those of you who are not familiar with our web site, you may 68488 Commercial (.com)
use the FABIG search facility to search through all past FABIG
deliverables. The web site may also be used to get details of Non-Profit Making
forthcoming Technical Meetings, and to register on-line for these 56127
Organisations (.org)
meetings. You can also use the web site to get details of FABIG
members (and in some cases the members’ web site). 9601 United Kingdom

5737 Network
We are eager to receive your comments on how we can improve
the web site to better serve your needs. 1327 Australia

1262 Norway

% of Area Related to 766 France

Requests Request
657 Denmark
31 Technical Meetings
652 Canada
23 Deliverables
471 Argentina
18 Membership 286 Netherlands
16 Information About FABIG 280 Germany
8 Conferences 227 Austria
3 Forthcoming Events 195 Greece
Table 415.1 Web access per request 167 USA Military

137 Brazil

137 Malaysia
Table 415.2 Web access per domain

Page 4 Issue 30 - October 2001


R416 A WORKBOOK APPROACH TO ESTIMATING THE
FLAMMABLE VOLUME PRODUCED BY A GAS
RELEASE
Introduction
Over the past few years, work has been carried out to assess the
consequences of gas explosions in offshore modules [1,2]. This
work has often included studies of a “worst case” scenario, in
which a module has been filled with a stoichiometric gas-air
mixture and the pressure that has been generated as a result of
the combustion of the mixture has been recorded. The results of
these studies have provided information to assess the maximum
severity of a gas explosion in offshore modules and on the
circumstances in which the explosions can be mitigated through
the use of water sprays, for example. The studies have also
helped guide the development or validation of mathematical
models for gas explosions.
However, these studies by themselves do not provide an
accurate assessment of the hazards produced by a specific gas
release in a module. In particular, a specific gas release may not
result in a uniform stoichiometric mixture throughout the module.
The pressures such modules would experience as a result of an
explosion arising from that release may be less than would be
assumed, based on the results of a “worst case” explosion of a
stoichiometric gas cloud extending throughout the entire module.
This may have implications for the design of modules and their
protective systems.
Considerations such as these led the UK Health & Safety
Executive to organise a meeting in 1996, to review the state of
knowledge on gas dispersion in offshore modules. Further
discussions arising after the meeting led to the formation of a
joint industry project to undertake a study entitled “Gas Build
Up from High Pressure Natural Gas Releases In Naturally
Ventilated Offshore Modules.” The project was carried out on
behalf of a group of eleven sponsoring companies (BG plc, BHP
Petroleum Ltd., BP Exploration Operation Company Ltd.,
Enterprise Oil plc, Elf Exploration UK plc, Health and Safety
Executive, Marathon Oil UK Ltd., Mobil North Sea Ltd., Shell
International Petroleum Company, Texaco Britain Ltd. and Total
Oil Marine plc) and was managed by BP Exploration. The project
commenced in September 1997 and a series of 66 large-scale
experiments was carried out at the Advantica test site at
Spadeadam in Cumbria, England. Measurements were taken
during the experiments by Advantica and Shell Global
Solutions, [3]. The test rig in which the experiments were carried
out had previously been used for the Blast and Fire Engineering
Project for Topside Structures-2, co-ordinated by the SCI [1], and
it represented at full scale an offshore process module of the
type in operation in the North Sea.
A technical committee was set up with members elected from BP,
Advantica (formerly BG Technology) and Shell and with an
independent expert from Cambridge Environmental Research
Consultants representing the interests of the sponsors. The
committee members were responsible for producing computer
software to enable the gas cloud to be visualised; for analysing
Issue 30 - October 2001
Technical Discussion
the data to detect any obvious trends and to produce correlations
to reflect such trends; using a number of simple integral or zonal
models to examine factors such as the significance of the release
buoyancy or momentum and finally, for the use of a commercial
CFD package to simulate a number of the experiments. Further
details of the experimental programme and of the findings of the
technical committee are given in the papers published at the
ERA annual conference on Offshore Installations: Fire and
Explosion Engineering [4,5]. It was noted in the most recent paper
that the technical committee had commissioned the production
of a workbook. This workbook was to be based on the results of
that experimental programme and was to provide the user with a
rapid technique for estimating the flammable volume arising from
the release of natural gas within a naturally ventilated offshore
process module. This workbook has now been completed and a
brief summary of it is given in the remainder of this article.
The Workbook Approach
The approach adopted in the workbook is to provide separate
methods to determine the ventilation flow through a confined,
congested region and to determine the flammable volume based
on that ventilation flow, the gas release characteristics and the
geometry of the region. In determining the flammable volume
two estimates are made:
l an upper, but realistic, estimate of the flammable volume that
a certain release would produce; and
l a mid-range estimate of the “typical” flammable volume that
a release would produce. That is, when many possible release
positions, rates, orientations and geometries are being
considered within a quantitative risk assessment what is a
“typical” value for the flammable volume.
The former can be used in a screening stage to determine if a
more detailed analysis is necessary and the latter may be used
to give a ‘best estimate’ of the likely outcome.
The approach adopted in the analysis is to describe the flow
and dispersion in terms of a number of relevant non-dimensional
variables.
The flow through the module is characterised by a representative
‘ventilation velocity’ that is assumed to be related to the external
wind field in a functional way as:
Uv
= f1 (geometry and orientation, confinement, congestion)
Ua
where Ua is the ambient wind speed upwind of the module and
U v is the ventilation velocity through the module. Non-
dimensional geometry and orientation, confinement and
congestion variables are then defined to allow the characteristic
velocity to be evaluated.
Page 5
Technical Discussion

Similarly, a normalised or non-dimensional volume of the

flammable gas cloud is defined as a function of the relevant non-
dimensional independent variables by:

Vf
= f 3 (R )
Vm

where Vf is the volume of the flammable cloud, Vm is the module

volume,

 m ρ s 
R= 
 U L2 
 v  Figure 416.1 Definition of the geometry and orientation
. factor for module type 1
m is the mass flow rate of the release, ρ s is the density the
released material at ambient conditions and L is a characteristic Determining the Flammable Volume
length scale of the module, defined so that L3 = Vm .
For the purposes of the workbook, the flammable volume has
Although a large number of experiments were carried out during been defined as the volume of released material at concentrations
the Joint Industry Project, they were all performed in one between 5% and 15 % contained within the module. Based on
particular module, albeit with different arrangements of perimeter the results for many different release rates, source locations and
confinement. Hence, interpolation and extrapolation, guided by source geometries, Figure 416.2 shows the correlation that was
dimensional and physical arguments, are used in the workbook deduced for the ‘upper limit’ estimation and for the ‘typical’
to extend the applicability of the relationships. A pragmatic flammable volume produced by a release.
approach was adopted, opting for the simplest, operationally
useful technique; only considering more complicated approaches
if subsequent experience shows this to be essential.

Determining the Ventilation Velocity

Two techniques have been considered to determine the
representative ventilation velocity through an offshore module.
The first is through the use of a zonal or integral model. This
technique was found to be a good predictor of the experimental
results undertaken in the JIP study (see previous section for
details). However this method relies on performing calculations
with a computer package or a sophisticated spreadsheet. Hence
a second, very simple, approach was also developed as an
alternative, rapid estimation procedure. This was based on the
experimental programme of the JIP study and uses, directly, the
results obtained in that study.
Figure 416.2 Plot of non-dimensional flammable volume
This approach assumes that the effects relating to the geometry versus ventilation parameter
and orientation of the module relative to the wind, the internal
congestion within the module and its perimeter confinement can
each be treated independently. Based on an analysis of the This approach has been extended to provide a means of estimating
experimental results and a physical understanding of the flow, the volume of material between any two concentration levels C1
formulae are provided for each factor for a number of common, and C2, expressed as volume percentages and in the range of 2%
generic cases of platform and module layout. to 15%, by means of the formula:

The specification for the ‘geometry and orientation’ of the module   . 

3/ 2    . 
3/ 2 
  m / ρs     m / ρs  
is provided for four different generic module layouts. The Vc1 − Vc 2 = Min1670C1−3 / 2   , L  − Min1670C 2−3 / 2 
3
 , L3 
  Uv     Uv  
specification of the effect of internal congestion and of perimeter        
confinement is provided by two simple algebraic equations.
Using the above formula, a maximum flammable volume of about
By way of illustration, the geometry and orientation factor for a three quarters of the total volume is produced by a non-
module with relatively open ends and closed sides and top is dimensional release rate, R, of about 0.04, a result that is
given in Figure 416.1. consistent with the experiments.

Page 6 Issue 30 - October 2001

 Technical Discussion

Discussion Further information

In developing the simplified approach described above, there For further details, please contact:
are inevitably many uncertainties that arise and also some
restrictions on the circumstances in which the approach may be R.P. Cleaver
applied. For example, the treatment of very low wind speed Advantica Techologies Ltd
conditions in the workbook could be improved by taking account Ashby Road
of additional factors, such as the momentum of the gas release. Loughborough LE11 3GR
However, it is most likely that the workbook would be used at United Kingdom
the early stages of a new development when some idea of the
overall level of risk is required. The probability of various release Tel: +44 (0) 1509 282 000
scenarios can be obtained from direct experience from data held E-mail: phil.cleaver@advanticatech.com
by regulatory authorities. It would be relatively easy to automate
the process of combining this information with the frequency of or
occurrence of various wind speeds and directions, in order to
evaluate the distribution of the flammable volumes that may be R.E. Britter
produced. Such an approach would reduce to some extent the Department of Engineering
uncertainties involved in using a correlation developed University of Cambridge
specifically to predict an upper estimate of the flammable volume Trumpington Street
produced by a certain release or the ‘average’ value produced Cambridge CB2 1PZ
by that release. Given suitable data, it may be possible to link United Kingdom
this approach to a similar ‘workbook’ for assessing the pressures
generated, should the flammable mixtures be ignited.

Further, as more details of the module layout are produced it is

likely that more detailed analysis would be warranted, using a
range of more sophisticated models. Having carried out the
workbook analysis first, such analysis could be focused on those
scenarios that lead to unacceptable risks. In this way, the
screening analysis afforded by the workbook would be refined
and the resulting detailed results used to further the design
process.

References
[1]
Selby, C.A. and Burgan, B.A., Blast and Fire Engineering for
Topside Structures Phase 2, Final Summary Report, Steel
Construction Institute, UK. SCI Publication Number 253, 1998.

[2]
Al-Hassan, T. and Johnson, D.M. in 17th International
Conference on Offshore Mechanics and Artic Engineering,
Lisbon, 6-9 July, 1998.

[3]
Cleaver, R.P., Buss, G.Y., Tam, V., Connolly, S and Britter, R.E.
Gas Build-up from High Pressure Natural Gas Releases in
Naturally Ventilated Offshore Modules, 7 th Annual
Conference on Offshore Installations: Fire and Explosion
Engineering, Church House Conference Centre, London, 2
December, 1998

[4]
Cleaver R.P., Buss G.Y., Tam, V., Connolly S., and Britter R.E.
Analysis of Gas Build-up from High Pressure Natural Gas
Releases in Naturally Ventilated Offshore Modules, 8th Annual
Conference on Offshore Installations: Fire and Explosion
Engineering, Lord’s Conference and Banqueting Centre,
London, 30 November, 1999.

[5]
Savvides, C., Tam, V., Cleaver, R.P., Darby, S., Buss, G.Y., Britter,
R.E. and Connolly, S. Gas Dispersion in a Congested, Partially
Confined Volume, International Conference and Workshop on
Modeling the Consequences of Accidental Releases of
Hazardous Materials, San Francisco, 28th September, 1999.

Issue 30 - October 2001 Page 7

Technical Discussion
R417 RISK-BASED DESIGN OF PASSIVE FIRE
PROTECTION
The design of Passive Fire Protection implies making a choice
from a few alternatives - for each alternative solution the designer
should assess the total associated risk. The selection or decision
process demands weighing up the costs, risks, and benefits of
the alternatives. The total risk is a combination of both the
likelihood and level of the fire’s size and duration, and the
uncertainty in the response of the system. In this note, the outline
of a method is presented, which examines, in probabilistic terms,
the damage that a certain fire of given duration will cause to a
particular structure that is designed with a design strategy that
could include accepting some or no damage.
Introduction
In general, the topside structures of offshore installations are
designed to withstand normal loads, then structural members
are coated by Passive Fire Protection (PFP). BS5950 Section 8
gives guidance for determining the necessary PFP. This is a
manual method for the fire proofing design. However, computer
methods can also be used to design an optimal PFP scheme.
There is a systematic uncertainty with the manual method since
the extent of fire proofing cannot be optimised. In contrast a
computational approach can minimise the uncertainty, account
for random errors and optimise the extent of required PFP.
It is generally accepted practice that a topside structure should
be designed so that:
l it does not collapse during a major fire within the given
survival time; and
l it does not incur significant damage from moderate or minor
fires.
While both of these principles are widely accepted as a basis for
design, it is difficult to be precise in their implementation. The
second criterion clearly implies a balancing of the risk of future
loss against the initial cost of providing more PFP. Even the first
criterion implies some risk, since calculating a fire’s size and
duration involves uncertainty and the definition of a major fire is
always a compromise between the cost of providing more PFP
and its benefit. The fire proofing design of North Sea structures
during the last decade represents a very serious attempt to
implement these principles. There is a requirement to analyse
statistical information on the leak sizes and ignition probability
as well as structural material properties. To protect the topside,
there is generally a choice of measures that can be used. On the
control side, these measures include breaking large sections
into smaller ones with less inventory, providing some kind of
deluge system to mitigate the effect of fire and so on. This paper
concentrates on the passive measures to mitigate the effects of
fire.
Those measures that affect the structural resistance to fire are
called design strategies in this note. In the context of fire
protection this only involves the extent of PFP, its thickness and
the coat-backs on unprotected members (increasing the members
size is not an efficient strategy in these situations). For each of
the alternative protective measures (strategies), the associated
Page 8
total risk of structural failure needs to be assessed. This total
risk combines the various levels of threat from fires i.e. the
uncertainty regarding the structural strength, intensity and
duration of the fire, the extent and thickness of PFP, its
effectiveness after explosion and finally, the ability of the system
to redistribute internal forces (redundancy). The choice of a
design strategy demands an evaluation and weighing up of costs,
risks, and benefits, and must also include any factor, which leads
to economic or other losses.
The current practice attempts to answer the question of which
structural members to protect and for how long in a prescribed
manner. Generally, a selected number of primary members, which
would be potentially exposed to the fire heating, are usually
protected. The survival duration could be a nominal number of
minutes, e.g. 120 minutes, or the shorter of how long it takes to
evacuate personnel on board and how long it takes for the fire to
subside by depleting the inventory. Although this approach
provides some level of asset protection, it views fire coating as
a safety issue only. Moreover, as the survivability of the total
system is not established, the system behaviour under fire attack
is not known. It is suggested that the extent, thickness and
duration should be established using a risk-based approach,
subject to the condition that the survival time should not fall
below the time required for the safe evacuation.
Analysis of Total Risk
The calculation of the total risk for a particular fire resistant
design is based on the combination of two statistically varying
characteristics. The first is the response of the particular
structure, which may be better or worse than expected. The
second is the type of fire as characterised by its intensity and
duration - factors that are obviously subject to statistical
variation.
The determination of the total risk as a basis for design is in
contrast to the usual design process undertaken for a
structure[1,2]. In the latter case, the designer calculates the
maximum (or equivalent) stresses for a given structural member
since these stresses are correlated with structural failure and
economic loss. For fire resistant design, however, the interest is
containment of the fire effect, i.e. preventing escalation of the
event and progressive collapse of the structure by limiting
deformations and avoiding rupture that could aggravate the
situation. A specific deformation or rupture may be caused, for
example, by a moderate fire coupled with an unexpectedly bad
response of the structural system, or as the result of an unusually
large fire combined with better than expected behaviour of the
structural system. This could happen due to variation in material
strength or the PFP thickness among other things. If both of
these input-response combinations have the same net result in
terms of the state of the system (i.e. the size of deformation or
rupture), then they are considered equivalent within the selection
process. That is, in the analysis of the fire resistant design it is
not necessary to distinguish further between any combinations
that have the same result on the structural system.
Issue 30 - October 2001

In estimating the risk that a particular level of response will be
experienced by the structural system, it is necessary to determine
the total probability associated with all possible combinations
of fire intensity and the deviations in the response of a particular
design strategy.
The total risk is determined by[2,4]:
∑ P[R E ]P[E ]
P[Ri ] = i j j (1)
all j
here P • represents the probability of the event indicated
within the brackets, Ri denotes the event that the state of the
structure is i, Ej indicates that the fire size/duration experienced
[ ]
is “level” j, and P R i E j denotes the probability that the state
(response) of the structure will be Ri given that the event Ej
takes place.
In the context of a fire resistant design of a topside structure, Ri
is the worst post-fire state (or state of damage, response, or
loss) of the installation during its design lifetime. Ej represents
the entire range of possible fire size/duration which could happen
during the lifetime of the platform. In this case, Ri is a unique
description of the installation condition after each event.
The form of the total probability Equation (1) emphasises that it
couples the two sources of uncertainty and that it accumulates
all combinations having the same behaviour or response. In this
form of the equation the responsibilities of the quantitative risk
assessor and structural engineer are also clarified. The risk
assessor should compute the values of the fire risk P[E j ] for all
j, and the structural engineer must estimate the likelihood of
different levels of behaviour Ri given different levels of fire size/
[
duration P R i E j . ]
Frequencies of Events
Probabilities and frequencies are used to describe the uncertainty
of the occurrence of an incident such as a leak. This is an attempt
to explicitly account for the most important factors affecting
safety. However, this simple model itself is subject to uncertainty.
Some attempt should be made to explicitly quantify uncertainties
associated with fire risk.
The systematic identification of undesirable events is carried
out based on operational experience, the HAZOP study and
experience with similar studies[3]. Leaks and the probability of
ensuing fires and explosions are one group of undesirable events
that will be identified at this stage.
Blowout is the main sources of fire for wellhead platforms and all
floating platform with their own drilling facilities. Most floating
production facilities are well away from the blowout hazard area.
A short duration blowout may last for some hours. Thus, the
safe evacuation of personnel is the primary concern.
Leaks from flexible flowlines or rigid still risers, as well as pipeline
leaks, could endanger the safety of the structural system. For a
full bore rupture of a riser the dimension is quite substantial. In
the case of jacket structures, less of the structure is exposed to
fire. Process leaks require the most effort.
Issue 30 - October 2001
Technical Discussion
The event tree technique is used to determine an estimate of the
risk related to process leaks. Event trees are simplified models of
the possible accidents and sequence of events leading to the
accident but they give a reasonably accurate picture of the risk.
The event tree identifies all accident scenarios by showing their
path from the initiating event to the terminating event. There are
three main categories of leaks, namely blowouts, riser leaks and
process leaks.
For each tree a risk contribution is calculated. The sum of these
risk contributions gives the total risk related to process leaks.
To be able to estimate the possible outcome of the identified
events, each leakage is divided into a number of categories, for
instance:
Minor: < 0.05 kg/s
Medium: 0.05 - 1.0 kg/s
Large: 1- 50 kg/s
Very large: > 50 kg/s
Minor leaks would not contribute significantly to the risk.
The fire frequencies and probabilities may be derived from the
analysis of different leak scenarios and paths in the event tree.
The frequency of a fire decreases as the duration increases; i.e.
short duration fires are more frequent than long duration fires.
The probability of escalation is a result of considering different
escalation mechanisms in the paths of the event tree, and
modelling of this is a time dependent function. In principle such
a diagram should be determined for each leak scenario in each
segregated compartment, but in practice it is possible to group
together similar cases. This leads to a discrete representation of
frequency against fire duration.
It is usual to also account for the release rate. To do this an
estimate of the hole size distribution for each type of component
is made[3]. An example is shown in Table 417.1.
Normalised hole size (% of
0.1 0.2 0.4 1.0
diameter)
Proportion of holes 0.60 0.25 0.10 0.05
Table 417.1 Distribution of hole size
It is necessary to introduce an additional step in the above
calculations. After having counted the number of items of a
particular component and multiplied this by the leakage rate of
that component, the resulting leakage frequency is split into a
set of frequencies, each specific to a given range of release
rates. Having carried out this calculation for all components and
categories involved, all frequencies that belong to a certain
release rate range are added.
Standard formulae for releases of hydrocarbons from a hole in
pressurised equipment can be used to determine the leakage
rates and time to depletion of inventory.
An ignition will result in fire or an explosion, depending on the
available volume of combustible gas and when the ignition
occurs. The probability of ignition depends on:
Page 9
Technical Discussion

1. The probability of the occurrence of a combustible mixture. especially for proprietary materials. It also should be noted that
2. The probability that the combustible mixture reaches a source most countries do not allow any credit to be taken due to water
of ignition. deluge.

The range of fire duration is a continuous variable. This Multiple Damage States
continuous distribution can be divided into five bands
The Damage State, which is assumed here to be the cost of
compatible with five levels of PFP requirement, see Table 417.2
repair or replacement, may be represented in discrete form in a
below, assuming it is possible to have five design strategies.
similar manner to the fire size/duration. Five general states of
These bands would represent the whole spectrum of possible
damage, Ri, are defined in terms of such loss-related factors as
protective measures available to the designers. Within each
level of repair cost, degree of the structural and non-structural
duration band, the fire size is a random variable.
damage and the fraction of personnel injured and killed. This
Fire discrete definition of damage states is described briefly in Table
Duration < 10 10 to 30 30 to 60 60 to 90 90 to 120 417.4. The coefficient of variation for mean values noted in Table
(min) 417.4 are around 0.25. Numbers given in Table 417.4 are only an
indication of what one should expect and their applicability must
Frequencies 6.8E-3 1.86E-3 0.82E-3 0.34E-3 0.15E-3 be verified before use.

Table 417.2 Fire duration frequencies (sample)
The choice of five bands is adequate, considering all possible
measures available to counteract the fire effect. The logic behind
the above discrete representation of fire size/duration is a
corollary of the current practice. A topside structure designed
according to the API-WSD method has enough capacity to
withstand 160 kW/m2 for about 10 minutes. To increase this
capacity to beyond 10 minutes requires most of the primary
steel and parts of the secondary steel to be fire coated. As the
requirement reaches 120 minutes, the amount of fire coating
increases.
There are three parameters that together determine a fire, these
are fire loads (or intensity), size and duration. All structural
member within a compartment would not experience a uniform
fire load. The current UK practice uses a hydrocarbon fire
temperature curve, which is designed for fire testing. This fire is
almost equivalent to 200 kW/m2. Since this curve is used in the
certification of PFP material, 200 kW/m2 became a standard value
for pool fires. For jet fires, the associated heat flux is 350 kW/m2.
NORSOK Technical guidance (NTS, 1996)[5] have specified fire
loads for the selection of PFP, see Table 417.3. These values are
lower than those used in the UK. Furthermore, the way fire tables
for PFP are produced, these values cannot be used easily,
Due to non-uniform design and construction practices, like
variations of material properties and the distribution of topside
equipment, structures that are designed to the same code
specification will not all experience the same level of damage
even if subjected to identical fire loads. Furthermore, the degree
of damage is dependent on the fire size and fire duration, which
are also uncertain. Thus, for each level of fire size/duration it is
[
necessary to define a probability distribution function P Ri E j ]
for damage. The determination of the damage probability
function is explained in a case study later in this paper.
The damage probability distribution function can be used to
determine the probability that a structure will find itself with
associated repair cost and injuries or deaths. The first step is to
calculate the mean annual frequency λ Ri of events in which the
structure experiences the Damage State Ri. The mean rate is
determined by the application of equation (1) modified to apply
frequencies.
λ Ri = ∑ P[R | E = I ](λ
I
i I − λ I +1 ) (2)
in which (λ I − λ I +1 ) is the annual frequency of events with E = I
(assuming repair, if necessary). Accumulating the appropriate
mean annual rates of different states will yield the mean annual
rate of events causing damage of a given level or greater.

Reduced average
Initial heat flux Initial heat flux
inital heat load taking
Type of fire density density
credit for w ater
Maximum point loads Average loads
deluge

Pool fire (crude)

Open or closed area, 150 kW/m 2 100 kW/m 2 kW/m 2
fuel controlled

Pool fire (crude)

Enclosed area, 200 kW/m 2 130 kW/m 2 100 kW/m 2
ventilation controlled

Jet fire 250 kW/m 2 200 kW/m 2

Table 417.3 NORSOK recommended fire loads

Page 10 Issue 30 - October 2001

 Technical Discussion

The ultimate goal of an assessment is to determine the probability during repair, or, in extreme cases, injury or loss of life, and other
of survival for a topside structure. To calculate the installation impacts such as the operator’s standing in the community and
survivability, all the failure mechanisms must be identified. The its stock value. In general, not all of the incident losses can be
load is a function of the amount of combustible material, ignition expressed in monetary terms.
probability and location, topside layout, ventilation and so on.
The resistance is a function of framing, material properties, If it were possible to express all losses in terms of money, then
workmanship, possible and so on. the criterion for selecting the optimal design strategy would be
the minimum present total expected cost, that is a design strategy
Application that minimises the sum of initial costs plus the discounted value
of expected future losses.
The simplest form of a design strategy is the basic design, in
which no PFP is provided to resist the fire effects. As a result,
Most PFP in use are proprietary type whose established
the cost of a fire resistant design is limited to the cost of firewalls
theoretical behaviour in a fire situation is known. In addition, for
for segregation purposes. As PFP is added to delay the
certification purposes fire tests and tables are produced with
degradation of material strength, the cost of enhancing the
discrete time steps, e.g. 30, 60 and so on are. Furthermore
capacity over the basic design starts to rise.
continuos variation of thickness is not practical. Consequently
the choice of thickness is stepwise.
One key step in the calculation of the fire risk is to determine the
probability that a fire of some stated duration would occur during
In heat transfer analysis the temperature time histories of all
a year. Fire severity is expressed as convective and radiative
structural members are calculated[6]. The operational loads are
heat fluxes, or by gas temperatures.
applied in the first step of a two-step non-linear structural analysis.
The temperature time-histories are applied in then the second
The effect of fire on the structure is expressed by a number of
step. In both heat transfer calculation and the structural analysis
Damage Probabilities (DP’s). Each DP is associated with a fire
the effect of random errors can be accounted for using a Monte
size/duration (rise and fall) and a design strategy and gives the
Carlo simulation.
probability that various levels of damage would result from
various levels of fire duration. By combining the fire with the
The process starts with no PFP at all. If the calculated risk is
information in the DP table, the probability that the topside
intolerable or the time to collapse is less than that required for
structure will sustain various levels of damage can be assessed
evacuation, then another strategy, e.g., having 30 minutes PFP
and the future repair costs may be determined.
only on certain members is investigated. The number of members
and the PFP thickness are increased until the calculated risk for
For each damage state there is an incident loss; such incident
each category becomes acceptably low. Often previous
losses include loss of function or loss due to deferred production
experience can be used to reduce the amount of computation.

Damage State Description of * Mean material ** Mean injuries ** Mean loss of

and Symbol damage loss ratio ratio life ratio

No or minimal non- Minor Potential

1. Limited (L) 0.5%
structural damage. (1%) (0.1%)

Minor localised
structural and F ew Minor
2. Moderate (M) (5%)
extensive non (2%) (0.5%)
structural damage.

Major structural
damage; possibly Some F ew
3. Substantial (S) (30%)
total non-structural (5%) (1%)
damage.

Severe damage to
Several Up to 10
4. Total (T) parts of platform. (100%)
(20%) (5%)
Structure replaced.
Widespread
Significant Greater than 20
5. Catastrophic (C) platform damage. (100%)
(100%) (20%)
Total collapse.
* Mean value of material loss as a percentage of installation cost.
** Mean values of injuries or loss of life as a percentage of personnel on board.
NB: These values are dependent on the platform and are shown here for illustration purpose only.
Table 417.4 Description of Damage States

Issue 30 - October 2001 Page 11

Technical Discussion

Conclusions
A methodology has been outlined for deciding on the level of
fire protection for the topside of an offshore installation. This
method accounts for all probable fire intensities, their duration
and the strength of the topside to withstand the degradation of
material strength. The method allows the level of protection to
be improved until the residual risk becomes ALARP.

References
[1]
Yasseri, S., Risk-Based Decision Analysis for the Protection
of Marine Pipeline from Dropped Objects, 97-JSC-235, ISOPE
1997.
[2]
Yasseri, S., Decision Analysis for Target Fatigue Lives,
Presented at SIMoNET inaugural meeting, University College,
March 30th 2000.
[3]
Vinnem, J.E., Offshore Risk Assessment: Principal, Modelling
and Applications of QRA Studies, Kluwer Academic
Publishers, London, 1999.
[4]
Yasseri, S., Design Decision analysis for Topside Blast loads,
Major Hazard conference, ERA, London 2000.
[5]
NTS 1996, NORSOK Technical safety, Design principles,
NORSOK standard S-DP-001, Rev2, January 1996.
[6]
SINTEF, Handbook for Fire Calculations and Fire Risk
Assessment in the Process Industries, SINTEF/Scandpower,
1992.

Further information
For further details, please contact:

Sirous Yasseri
Kellogg Brown & Root (KBR)
ACS Full Field Development Project- Phase 1
South Point
6-14 Sutton Court Road
Sutton
Surrey SM1 4TY
United Kingdom

Tel: +44 (0) 1372 865 226

Fax: +44 (0) 1372 865 111
E-mail: sirous.yasseri@halliburton.com

Page 12 Issue 30 - October 2001

 Research and Development

R418 SAFETY MANAGEMENT OFFSHORE: A

SYSTEMATIC APPROACH

A Systemic Safety Management System Model and opportunities, system 4 can suggest changes to the
organisation’s safety policies. This function may be regarded as
The Systemic Safety Management System (SSMS) model
a part of effective safety planning. System 4 first deals with the
described here is intended to represent a systemic approach
safety policy received from system 5. Second, it senses all
intended to maintain risk within an acceptable range in an
relevant threats and opportunities from the wider physical and
organisation’s operations. This model builds on the Viable System
socio-economic infrastructure of the organisation, including the
Model (VSM) developed and proposed by Beer[1,2,3] and the
safety future environment. Third, system 4 deals with all relevant
Failure Paradigm Method (FPM) proposed by Fortune and
needs of system 1 performance, and its potential future. Finally,
Peters[4] as described elsewhere[5]. A brief description of the
it deals with the confidential or special information communicated
SSMS model is given below.
by system 4*. System 4*, safety confidential reporting, is part
of system 4 and it is concerned with confidential reports or
Recursive SSMS Structural Organisation causes of concern that may require the direct and immediate
The SSMS needs to achieve five functions associated with intervention of system 5. Finally, system 5, safety policy, is
systems 1 to 5. System 1 consists of various operations within responsible for deliberating safety policies and for making
an organisation that deal directly with the organisation’s normative decisions. According to alternative safety plans
production activities. received from system 4, system 5 considers and chooses feasible
alternatives, which aim to maintain an acceptable level of safety
A typical organisation’s operations, for example, power throughout the organisation’s operations. It also monitors the
generation, transport, oil and gas exploration, production, and interaction of system 3 and system 4, as represented by the lines
treatment could form part of system 1, as shown in Figure 418.1. that connect the loop between systems 3 and 4 as shown in
It should be noted that each operation performs five functions Figure 418.1. Also shown on Figure 418.1 is a dashed line directly
namely safety policy, development, functional, co-ordination, from system 1 to system 5, representing a direct communication
and implementation. This means that the SSMS as a whole is or ‘hot-line’ for use in exceptional circumstances; e.g. during an
replicated in each operation of system 1. Systems 2 to 5 facilitate emergency.
the function of system 1, as well as ensuring the continuous
adaptation of the whole organisation. System 2, safety co- The SSMS and its Environment
ordination, co-ordinates the activities of the operations of
The SSMS relies on five functional imperatives and the extent to
system 1. System 2, along with system 1, implements the safety
which the SSMS structural organisation accommodates
plans received from system 3. It informs system 3 about routine
contextual constraints determines its ability to adapt. The
information on the performance of the operations of system 1.
organisational structure of the SSMS is shown as interacting in
To achieve the plans of system 3 and the needs of system 1,
a defined way with its environment through system 1 operations,
system 2 gathers and manages the safety information of the
and through system 4, as illustrated in Figure 418.1. Environment,
system 1 operations. System 3, safety functional, is not only
both socio-economic and physical is understood as being those
responsible for maintaining risk within an acceptable range in
circumstances to which the SSMS response is necessary. The
system 1, but also ensures that system 1 implements the
SSMS also needs to respond to necessary internal matters, e.g.,
organisation’s safety policy. It achieves its function on a day-
inadequate training. System 4 deals with the SSMS’s total or
to-day basis according to the safety plans received from system
wider socio-economic and physical environment into which an
4. Detailed aspects of safety plans are given below. System 3
organisation is embedded. The broken line elliptic symbol
requests from systems 1, 2, and 3* information about the safety
represents the SSMS total environment, as illustrated in Figure
performance of system 1 to formulate its safety plans and to
418.1. System 4 deals also with the safety ‘future environment’,
communicate future needs to system 4. It is also responsible for
which is also embedded into the SSMS total environment. The
allocating the necessary resources to system 1 to accomplish
safety future environment is concerned with threats and
the organisation’s safety plans. System 3*, safety audit, is part
opportunities for the future development of safety. On the other
of system 3 and its function is to conduct audits sporadically
hand, system 1 operations deal with local environments or
into the operations of system 1. System 3* intervenes in the
institutionalised environments with which the organisation’s
operations of system 1 according to the safety plans received
operations must deal. These local environments are embedded
from system 3. System 3 needs to ensure that the reports received
into the total environment of the SSMS as illustrated in Figure
from system 1 reflect not only the current status of the system 1
418.1. For example, organisations are embedded within a wider
operations, but are also aligned with the overall objectives of
socio-economic and physical structure that will constrain the
the organisation. The audit activities should be sporadic (i.e.
way they can develop. There are various important socio-
unannounced) and they should be implemented under common
economic and physical characteristics that need to be taken into
agreement between system 3* and system 1.
account. These characteristics can be segregated thus; first
physical characteristics, such as the geography of the area, for
System 4, safety development, is concerned with safety research
example the North Sea oil and gas fields, weather conditions and
and development (R&D) for the continual adaptation of the
public utilities. Second, economic characteristics such as oil and
organisation. By considering strengths, weaknesses, threats,
gas markets, level of employment, other oil and gas operators

Issue 30 - October 2001 Page 13

Research and Development

Figure 418.1 A Systemic Safety Management System (SSMS) for an oil and gas organisation

Page 14 Issue 30 - October 2001

 Research and Development

and other types of industry and commerce, and finally, socio- Recursive Structure and Autonomy
political characteristics, such as regulators, and social
According to Beer[1], in a recursive organisational structure any
organisations. The demands and needs inherent in these
viable system contains, and is contained in, a viable system.
characteristics will suggest and condition patterns of structural
This means that the organisational structure of the SSMS for
organisation of the SSMS. Organisations need to pay more
the organisation as a whole is replicated in each operation of
attention not only to these characteristics, but also to the
system 1. That means that the SSMS model is intended to
complexity, stability or uncertainty of changing technologies.
manage safety of an organisation at three levels of recursion, as
shown in Figure 418.1 (The three levels should be seen in the
Apart from confronting demands for its products, an organisation
context of Figure 418.2). The top right hand side broken line
faces an environment upon which it is dependent for finance,
square box is the management unit of system 1 of the next higher
work force and materials, that is, for its resources. The
level of recursion. The operations of system 1, on the other
organisation’s total environment has a certain pattern of resource
hand, represent the SSMS for the level of recursion next below,
availability to which the organisation has to relate. The supply
depicted at 45 degrees in Figure 418.1. The SSMS for the
of resources to the organisation changes over time forcing it to
organisation as a whole is replicated for every operation of system
make organisational adaptations. These adaptations may involve
1.
merging departments, changing the location of decision making,
introducing new procedures, and so on. These changes may
Very little attention has been given by both academe and
have significant impacts on the safety performance of the whole
practitioners to understanding the appropriate degree of
organisation. Similarly, local or institutionalised environments
interdependence amongst the parts that constitute an
also are characterised by the socio-economic and physical
organisation in order to design an effective SMS. In addition,
characteristics of the organisation’s total environment. These
the impact of the organisational structure on the effectiveness
characteristics can be segregated into a) physical characteristics,
of the SMS, as well as on the subsystems of the SMS, is not well
for example a specific oil and gas production field, local weather
understood. The SSMS is organised in recursive levels, which
conditions; b) economic characteristics, for example other oil
may have a significant impact not only in designing a more
and gas field operations, and c) socio-political characteristics,
effective SMS, but also a SMS including health, safety and
such as government regulations, for example, the safety case
environment. The SSMS for the whole organisation is replicated
regulations.
in each operation of system 1, as illustrated in Figure 418.1. The
SSMS is intended to be able to maintain risk within an acceptable
Whenever a line appears in the Figure 418.1 representing the
range at each level of recursion, but this safety achievement, at
SSMS model, it represents a channel of communication, except
each level, is conditional on the cohesiveness of the whole
for the lines that connect the balancing loop that connects
organisation. The SSMS contains a structure that favours
systems 4 and 3. The zigzag lines connecting the operations of
autonomy and local safety problem-solving capacity. Autonomy
system 1 indicate inter-dependency, which may be strong or
means that each operation of system 1 of the SSMS is responsible
weak according to the degree of interdependence amongst the
for its own activity with minimal intervention of systems 2, 3, 4,
operations. For example, in the case of an oil and gas offshore
and 5. The organisational structure of the SSMS allows decisions
production field, the operations might stand for offshore platforms
to be made at the local level. Decision making is distributed
OIA, OIB and OIC (see Figure 418.2). A succession of processes
throughout the whole organisation. This means that distributed
feeding each other with oil/gas in normal operation may be
decision making involves a set of decision makers in each
regarded as strong physical inter-dependence. A weak inter-
operation of system 1 and at each level of recursion. These
dependence may be the case when the three offshore platforms
decision makers should be autonomous in their own right and
do not feed each other with oil/gas as part of normal operation
act independently based on their own understanding of safety
but there is a physical connection which might allow it. For
and their specific tasks. However, it should be recognised that
example in the Piper Alpha disaster there was a physical
they have interdependence with other decision makers of other
connection between the Piper and Claymore platforms which
operations of system 1. Therefore, each operation of system 1
allowed unintended passage of gas; i.e. during non-normal
should be endowed with autonomy so that the organisational
operation. There is a particular concern in the SSMS about the
safety policy can be achieved more effectively. These aspects
nature of these channels and the information which flows in the
of organisational structure, which have a role in making
communication channels. These channels of communication
organisations more rather than less effective, are poorly
obey four organisational principles. These organisational
understood in safety literature.
principles are understood as responding appropriately to the
weaknesses and strengths, threats and opportunities as
Communication and Control in the SSMS Model
presented in the wider and local environment of the SSMS; the
channels of communication, and the necessary transducers Pro-active Commitment to Safety
translating information when it crosses boundaries of systems An organisation’s safety approach can be reactive or pro-active
must be designed according to the requirements of Ashby’s law and less or more committed to safety. Additionally, organisations
of requisite variety[1,2,3] and these principles must be put into may focus on technical aspects of incidents or accidents. For
effect without time-lags (see Appendix A). The bi-directional example, passive and active fire fighting systems have been
arrows represented in the SSMS total environment indicate the developed with the purpose of controlling and mitigating fire
interactions among the local environments, as well as the incidents. However, the degree of risk in an organisation or system
interaction of these local environments with the total is an emergent property resulting from the interrelated activities
environment. of people who design it, manage it, and operate it. Humans,

Issue 30 - October 2001 Page 15

Research and Development

Figure 418.2 Recursive structure of an oil and gas industry

Page 16 Issue 30 - October 2001


individually, in teams and in organisations decide the technical
aspects. People who are involved in the product, service, or
process life cycle, such as product and plant designers,
constructors or manufacturers, operators or users and
maintainers make decisions which effectively contribute to
creating the risk. Furthermore, there is the need to look at the
people responsible for designing and managing the organisation
or system itself. These factors, which are the potential, but not
obvious or explicit causes of incidents or accidents, are known
here as latent factors. It is claimed elsewhere[6] that common (i.e.
common-place) causal failures form part of an “incubation
process” in a sequence of disaster development. Moreover, latent
factors accumulate unnoticed until a precipitative event or trigger
leads to the onset of the incident, accident or disaster[7]. (In
addition to latent factors as described above, i.e. in the sense of
human/organisational factors, there may also be long-term
physical factors such as a very slowly developing crack.)
Traditionally, organisations may not be aware of latent factors,
but they look for immediate causes of incidents or accidents
after they have taken place. Both academe and practitioners
tend to divide them into separate objects and events. This
division is, of course, useful and necessary to cope with risk,
but is not a fundamental feature of a real safety situation.
Immediate causes of incidents or accidents as readily observed
or understood are known here as immediate factors. The
“incubation”[6] period of a “latent failure” before the immediate
failure appears is known as the “latent period”. It is contended
here that all parts that constitute an organisation can be seen as
interdependent and inseparable parts of the organisation as a
whole. Moreover, these constituents are all interconnected,
interrelated and interdependent in that they cannot be
understood as isolated entities, but only as integrated parts of
the organisation as a whole. Loss is therefore seen as a systemic
failure, not a result of a single cause. Clearly, addressing latent
failures is as important as focusing on apparent failures or
incidents or accidents.
In addition to latent and immediate factors, the distinction
between technical and human factors should be emphasised so
that realistic safety objectives, plans and measures of
performance can be set. This distinction should replace the
emphasis on unique causes and isolated technical explanations
of failure of systems. This will require knowledge about the degree
to which the technical and human factors are committed to safety
and linked together into a coherent whole. Moreover, the way in
External Commitment
Tasks in the organisation are defined by others
The behaviour required to perform tasks with an
acceptable degree of risk is defined by others
Safety performance goals are defined by the
organisation's management or others
Others define the importance of the safety performance
goals.
Table 418.1 Internally and Externally Committed Systems
Issue 30 - October 2001
Research and Development
which they are implemented into a particular organisation’s
operations should be clearly understood. These two aspects
are known here as Internally Committed Systems (ICS) and
Externally Committed Systems (ECS). The distinction between
these two aspects may be a source of insight into the ways
safety can be approached, as well as the ways in which these
two aspects differ from each other. Table 418.1 illustrates some
characteristics of ICS and ECS.
ECS refers to the safety performance of systems that are
committed to a particular purpose, function, or objective based
on external reasons or motivation. This definition addresses both
technical aspects and humans. For example, production
installations are designed to accomplish a well-defined objective,
whilst the production operations’ procedures are formulated by
process designers to be followed by production personnel. Here,
the performance of production machines satisfy the purpose of
product designers and the production personnel satisfy the
production process designer’s purpose. Traditionally,
organisations tend to address safety by seeking the direct or
immediate causes of incidents or accidents after they have taken
place. An inquiry or assessment process is conducted to
determine the immediate causes so that the existing
understanding is adjusted to fit the newly gained understanding
of safety. Goals for improvement are defined to address the newly
found failure so that the same failure will not occur again.
Moreover, very often it is assumed by organisations that the
absence of incidents or accidents or other negative outcomes is
an indication of good safety management. For example, some oil
and gas organisations, like many others, traditionally use lost
time injuries (LTI) and deaths as the basis to measure the
effectiveness of their safety management.
Organisations need to address safety pro-actively. However,
often they still tend to comply with external safety objectives,
that is, existing regulations, standards or procedures in a narrow
way. It is generally accepted that safety is better assessed and
managed by addressing in advance the hazards of the
organisation’s operations. This is usually done through i) a
systematic identification of hazards, ii) assessment of the
significance of hazards, and iii) hazard management by
prevention, control, and mitigation. However, organisations are
often still only committed to complying with existing regulations,
standards or procedures in a narrow sense and this is basically
reactive mentality. Of course, a regulation may demand or imply
a pro-active approach, however only complying with externally
Internal commitment
Employees participate in defining tasks
Employees participate in defining the behaviour
required to perform tasks with an acceptable degree of
risk
Organisation's management and employees jointly
define safety performance goals
Employees participate in defining the importance of the
goals
Page 17
Research and Development
imposed regulations or existing standards does not necessarily
mean that an organisation’s operations will be ‘acceptably safe’.
Moreover, organisations still tend to focus on immediate factors
and have very little understanding and appreciation of latent
factors and ICS.
The idea of ECS may produce important insights into the ways
safety can be addressed, but it is fundamentally incomplete.
There is growing evidence that human factors have quite
dramatic safety consequences; this requires a fundamentally
different approach. It seems that there is a substantial gap
between safety objectives as defined by regulators, standards
or procedures, or the organisation’s management and what may
be achieved in a real-world situation. It is necessary to introduce
the idea of ICS. An ICS is a system that is committed to a
particular purpose or objective based on its own reasons or
motivation. In other words, an ICS refers to the critical awareness
of self-reflective human beings regarding their purposes and
the implications of their actions for all those who might be
affected by the consequences. This means that all those involved
in the life cycle of the organisation’s operations should be
committed to addressing safety pro-actively and anticipating
incidents or accidents, motivated by their own objectives or
purposes. This freedom to achieve safety objectives is, however,
limited by the organisation’s safety policy, plans, standards and
procedures. Individuals, teams, groups, and departments that
perform an organisation’s operations should not only be
assigned tasks but they should have both authority and
responsibility by their understanding of safety and their specific
tasks. They should be endowed with authority in their daily
tasks by their knowledge to perform their tasks properly and in
an acceptable way with regard to risk. This knowledge involves
their knowledge of risk itself and the skills required to perform a
specific activity. In other words, individuals, teams, groups and
departments that constitute an organisation should have more
involvement with safety in their daily tasks. Top and line
management should encourage the development of ICS. The
more the organisation’s management wants internal commitment
from its employees, teams, and departments the more it must try
to involve employees in defining safety objectives, specifying
what these are and how to achieve them, and setting safety
targets. There is no safety vision, strategy or policy that can be
achieved without able and committed employees. However, it is
unrealistic to expect the management of an organisation to allow
total autonomy to employees. The degree to which internal
commitment is plausible is certainly limited.
Conclusion
A SSMS model for an oil and gas organisation has been created
based on a systemic approach. The model elucidates an
alternative way of managing safety. It is hoped that this approach
will lead not only to more effective management of safety, but
also to more effective management of health and the environment
for any organisation.
References
[1]
Beer, S., The Heart of Enterprise, John Wiley, Chichester,
1979.
[2]
Beer, S., Brain of the Firm, John Wiley, Chichester, 1982.
Page 18
[3]
Beer, S., Diagnosing the System for Organisations, John
Wiley, Chichester, 1979.
[4]
Fortune, J. and Peters, G., Learning From Failure - The
Systems Approach. John Wiley, Chichester, 1995.
[5]
Santos-Reyes, J., and Beard, A. N., A Systemic Approach
to Offshore Fire Safety Management, FABIG Newsletter,
Issue No. 24, June 1999.
[6]
Turner, B. A., “The Organisational and Interorganisational
Development of Disasters”, Administrative Science
Quarterly, September 1976, Vol. 21, 1976, 378-397.
Appendix A
The First Principle of Organisation (from Ashby’s Law[1])
“Managerial, operational and environmental varieties, diffusing
through an institutional system, tend to equate; they should be
designed to do so with minimum damage to people and to cost.”
(i.e., for a viable system).
An example could be an evacuation system designed to save
lives in the case of a fire or explosion on an offshore platform;
then the number of lifeboat spaces must be at least as great as
the number of possible evacuees.
The Second Principle of Organisation (derived from
Shannon[1])
“The four directional channels carrying information between
the management unit, the operation, and the environment must
each have higher capacity to transmit a given amount of
information relevant to variety selection in a given time than the
originating subsystem has to generate it in that time.” (As shown
in Figure 418.A1).
Example, the channels carrying procedures of evacuation must
have enough specificity so as to reduce ambiguities or eliminate
unclear instructions.
Figure 418.A1 The basic elements of a viable system,
illustrating the 4 key information channels
The Third Principle of organisation
“Wherever the information carried on a channel capable of
distinguishing a given variety crosses a boundary, it undergoes
transduction; and the variety of the transducer must be at least
equivalent to the variety of the channel.”
Issue 30 - October 2001
 Research and Development

Example, in the case of means of escape for offshore employees,

a transducer might be a fire instruction notice. This would
‘transduce’ between the person making up the evacuation rules
and the workers the rules are aimed; then the notice must be
comprehensive and clear.

The Fourth Principle of Organisation

“The operation of the first three principles must be cyclically
maintained through time, and without hiatus or lags.” (That is,
they must be adhered to continuously).

Further information
For further details, please contact:

Dr Alan N. Beard or Jaime Santos Reyes

Department of Civil and Offshore Engineering
Heriot-Watt University
Edinburgh EH14 4AS
United Kingdom

Tel: +44 (0) 131 449 5111

Fax: +44 (0) 131 451 5078
E-mail: a.n.beard@hw.ac.uk

Issue 30 - October 2001 Page 19

Research and Development
R419 NEW GUIDELINES ON PRESSURE RELIEF
In 1996, members of the Aberdeen Branch of the Institute of
Chemical Engineers proposed that a study should be initiated
with the aim of developing a reference document containing
current industry practices for the design and operation of relief
systems for offshore oil and gas facilities. A large joint industry
project was formed and, after nearly 5 years of work, the Institute
of Petroleum (IP) has recently published Guidelines for the safe
and optimum design of hydrocarbon pressure relief and
blowdown systems [1], which was edited by Professor Geoff
Hewitt.
The drafting of the Guidelines and experimental work was carried
out under contract to the IP as managers for the Relief and
Blowdown Systems (RaBs) Joint Industry Project. This project
included participation by several companies involved in the oil
and gas industry, and also the UK Health and Safety Executive.
Colin Weil, an independent consultant, acted as project co-
ordinator throughout.
These guidelines are intended primarily for process engineers
who are familiar with the basic principles and calculation
techniques involved. They were developed to supplement the
industry’s codes and standards and include sections discussing
overall system design philosophies, sizing methodologies and
the advantages and disadvantages for various types of
frequently used hardware. There is also an extensive review of
real incidents, their causes, and observations to minimise the
risk of recurrence.
Pressure Relief
The requirement for providing over-pressure protection is
mandatory in all pressurised systems. Most commonly, relief
and blowdown valves or bursting discs are fitted to protect
vessels, and their associated piping, by discharging to a suitable
receiver or to vent or flare. The American Petroleum Institute
(API) recommended practices have been widely used in the sizing
of such devices for releases of hydrocarbon gas or liquid.
Figure 419.1 Comparison of various methodologies for
sizing an orifice for two-phase flow
For many years industry has used an addition of areas method
to size relief systems operating in two-phases, that is where
liquid and vapour coexist in the fluid being relieved. This method
calculated the cross sectional area required to relieve the liquid
content of the fluid and this was added to that area required for
the gas. In recent years the adequacy of this approach has been
Page 20
questioned. During the 1990’s the American Institute of Chemical
Engineers’ DIERS group (Design Institute for Emergency Relief
Systems) investigated the methodologies available and
concluded that the addition of areas method could significantly
under predict the required relief area. The plot in Figure 419.1
from an investigation undertaken by Imperial College, London
in 1995[2] graphically illustrates the variations in different
methodologies for a typical two-phase fluid. It compares predicted
orifice flow rates with upstream gas mass fraction for three
methods, the Homogenous Equilibrium Method (HEM), the
Homogenous Frozen Method (HFM) and the then industry norm
of the (API) addition of areas method.
In the latest (7th) edition of API RP 520 Part 1 (January 2000), the
recommendation for sizing gas-liquid releases has been changed
from the addition of areas method to sizing based on the
homogeneous equilibrium model (HEM). The HEM assumes
that the gas and liquid move at the same speed and are in
thermodynamic equilibrium. API RP 520 includes an
approximation known as the omega method to perform the
calculations, but in practice many engineers may find it is as
simple to undertake a full HEM calculation. API RP 520 Part 1
does, however, note that the methods have not been validated
by test.
In order to validate HEM for hydrocarbon fluids, Professor
Stephen Richardson, Dr Graham Saville and colleagues at Imperial
College in London, undertook an extensive series of experimental
tests at the Advantica (formerly BG) Spadeadam test site in
Cumbria. The studies, including the results of the experimental
work, have been fully written up in the IP guidelines.
Spadeadam Tests
The Spadeadam tests were conducted using a specially designed
and constructed rig. Three typical hydrocarbon fluids were used:
l natural gas (essentially methane with some ethane);
l commercial propane (essentially propane and butane with
some ethane);
l condensate (essentially pentane to nonane with some decane
to dodecane).
Figure 419.2 Part of the test rig, showing the mixing and
monitoring piping upstream of the orifice
Issue 30 - October 2001

Figure 419.2 shows the 3-inch diameter phase mixing section of
the rig. The orifice plate is mounted at the extreme right
downstream of the natural gas and condensate inlets. The
supplies were independently metered (to within 1%), temperature
was measured at 20 locations within the rig and pressure at 10.
Restriction orifices of diameter 5 mm to 15 mm were used and
pressures upstream from these ranged from 10 to 90 bar (150 to
1300 psi). Flow rates were up to about 3 kg/s (10 mmscfd).
Some 50 flow experiments were conducted each covering a range
of flow variables. The tests investigated one-phase gas alone,
two-phase gas/liquid and also one-phase compressed (flashing)
liquid. Figure 419.3 shows the impressive plume of two-phase
hydrocarbons downstream of the orifice. These were ignited to
minimise environmental contamination.
Figure 419.3 Flaring a two-phase hydrocarbon flow
As part of the experiment, investigations were also undertaken
to find out whether or not pre-mixing of the streams had any
discernible effect. This would be critical to the robustness of
any calculation methods.
Results
The main part of the work was the measurement of the discharge
coefficient for flows of two-phase mixtures through an orifice.
However, as a base position measurements were also obtained
for single phase (gaseous) natural gas releases and these showed
discharge coefficients determined for various flow rates through
three different orifices as 0.90.
Various comparisons of the data were undertaken, including
comparing the experimental data against the original (pre 7th
edition) API method and their new methodology. As expected
the omega methodology does give results much closer to those
measured.
Issue 30 - October 2001
Research and Development
Figure 419.4 Discharge coefficients plotted as a function
of liquid mass fraction
It was reassuring to note that the experimental results indicated
that the impact of mixing, or non-mixing, of the phases upstream
of the orifice was negligible and therefore need not be factored
into the design of two-phase orifice sizing.
Conclusions
Values of discharge coefficients for two-phase flow through
restriction orifices were determined by analysis of the results
obtained in the experiments. These results suggested there is a
weak correlation of discharge coefficients against gas fraction
(or quality). This relationship can been seen in Figure 419.4,
which shows the discharge coefficients calculated for tests on
releases of natural gas and propane mixtures. Thus it can be
suggested that if an average discharge coefficient Cd of 0.93 is
used in a fully-implemented HEM, this will give predictions of
flow rate that agree very well with the measurements. The
discrepancy is never more than 5% and is generally less than
2%.
The experiments indicate that use of the API RP 520 omega
method and the API-recommended discharge coefficient Cd of
0.85, will give predictions of flow rate that also agree fairly well
with the measurements. Within the range of the experiments the
discrepancy is never more than 15% and is generally less than
10%. It would be expected the omega method would be less
accurate the more complex the mixture of fluid involved.
However, the advantage of using the omega method over a full
HEM calculation seems marginal as, for most hydrocarbon
mixtures found in practice it would be necessary to use Equation
D.3 of RP520 Part 1. This means that a flash calculation must be
carried out and performing the full HEM calculation is only
marginally more difficult whilst it is certainly more accurate. Thus,
it is recommended that the full HEM method is employed as a
standard, and an algorithm for its use is given within the IP
Guideline.
Page 21
Research and Development

It should be noted, however, that the work did not include

validation of HEM for:

l systems for which the upstream gas fraction (or quality) is

very small;
l systems in which the liquid is of high viscosity (such as,
say, a heavy oil).

References
[1]
Guidelines for the Safe and Optimum Design of Hydrocarbon
Pressure Relief and Blowdown Systems, published by the IP
in August 2001 may be purchased from Portland Press Ltd.,
Commerce Way, Whitehall Industrial Estate, Colchester CO2
8HP, United Kingdom. Telephone: + 44 (0) 1206 796351;
Facsimile: + 44 (0) 1206 799331; E-mail: sales@portlandpress.com
[2]
Two-Phase Pressure Relief Sizing – an assessment study, by
G F Hewitt, S M Richardson, G Saville and C Weil. Imperial
College Consultants Limited [MPS/73], June 1995.

Further information
If you require more information on the RaBs project, information
for purchase of the Guideline is included in the references or for
additional information contact:

Sjoerd Schuyleman
Upstream Operations Manager
Institute of Petroleum
61 New Cavendish Street
London W1G 7AR
United Kingdom

Tel: +44 (0) 20 7467 7132

Fax: +44 (0) 20 7255 1472
E-mail: sfs@petroleum.co.uk

Page 22 Issue 30 - October 2001

 Conferences
R420 CONFERENCES, SEMINARS AND COURSES
Conferences
Title Dates Venue Contact Tel/Fax Number

Post Seminar Workshop: 2 Jury’s Great Russell Patricia Harris, +44 (0) 1932 893 857
Identifying Human Errors Nov 2001 Street Hotel, London IBC Global Conferences +44 (0) 1932 893 893
cust.serv@informa.com
http://www.ibcglobal.com/is1167

Confined Explosions and 6 University of Leeds, Alison Whiteley, +44 (0) 113 233 2494
Detonations Nov 2001 Leeds University of Leeds +44 (0) 113 233 2511
cpd.speme@leeds.ac.uk
http://www.leeds.ac.uk/fuel/shortc/sc.htm

Vapour Cloud Explosions 7 University of Leeds, Alison Whiteley, +44 (0) 113 233 2494
Nov 2001 Leeds University of Leeds +44 (0) 113 233 2511
cpd.speme@leeds.ac.uk
http://www.leeds.ac.uk/fuel/shortc/sc.htm

Blast Prediction and Blast 8 University of Leeds, Alison Whiteley, +44 (0) 113 233 2494
Response Nov 2001 Leeds University of Leeds +44 (0) 113 233 2511
cpd.speme@leeds.ac.uk
http://www.leeds.ac.uk/fuel/shortc/sc.htm

Blast Prediction and Blast 9 University of Leeds, Alison Whiteley, +44 (0) 113 233 2494
Response (CFD) Nov 2001 Leeds University of Leeds +44 (0) 113 233 2511
cpd.speme@leeds.ac.uk
http://www.leeds.ac.uk/fuel/shortc/sc.htm

Major Hazards Offshore 2001 27 - 28 The Paragon Hotel, Emma Gardner, +44 (0) 1372 367 064
Nov 2001 London ERA Technology +44 (0) 1372 377 927
emma.gardner@era.co.uk
http://www.era.co.uk

OTC 2001 6-9 Houston, TX http://www.spe.org

May 2002 USA

OMAE 2002 23 - 28 Oslo, http://www.omae.org/omae2002/omae2002.htm

June 2002 Norway

Seminars
Title Dates Venue Contact Tel/Fax Number

Process Integrity and its Role in Dec 2001 London Martin Homer, SCI +44 (0) 1344 623345
Mitigating Fire and Blast (Location to be fabig@steel-sci.com +44 (0) 1344 622944
confirmed) http://www.fabig.com

Process Integrity and its Role in Dec 2001 Aberdeen Martin Homer, SCI +44 (0) 1344 623345
Mitigating Fire and Blast (Location to be fabig@steel-sci.com +44 (0) 1344 622944
confirmed) http://www.fabig.com

Issue 30 - October 2001 Page 23

 Feedback

R421 FABIG CONTACT INFORMATION AND FEEDBACK FORM

Please use this form to update SCI on your mailing details (e.g. change of address
or telephone number), change of personnel (e.g. someone leaving your company
or a new recipient) or to provide feedback on FABIG deliverables.

CONTACT INFORMATION
Title: Initials: Forename: Surname:
Job Title:
Direct Tel: Direct Fax:
E-mail:

Company:
Address:
Town
County: Postcode:
Country:
Switchboard Tel:
Switchboard Fax:
Web Site Address:

 Please inform me of forthcoming FABIG Technical Meetings

 Please delete me from your mailing list
 Please amend my details

FEEDBACK ON FABIG DELIVERABLES

Comments/Further details:

Please address any comments, queries or updated contact details to:

The FABIG Administrator
The Steel Construction Institute
Silwood Park, Ascot, Berkshire, SL5 7QN, UK
Tel: +44 (0) 1344 623345 Fax: +44 (0) 1344 622944
Alternatively you can E-mail us at: fabig@steel-sci.com
Or visit our Web Site at: http://www.fabig.com