fireandblast.com UKOOA / HSE
Fire and explosion guidance Part 2: Avoidance and mitigation of fires FINAL DRAFT
Main comment review completed
Document number 152-RP-48 Revision
Date
A
1 Mar 05
B
21 Jun. 05
0
3 July 05
Issued for comment to sponsors, authors and peer review
1
02 Feb 06
Issued following review of main comments
2
06 Feb 06
Issued for use
fireandblast.com ltd 8-10 High Street Laurencekirk Scotland AB30 1AE
Reason for Issue Initial build All received material to date
+44 (0)1561-378383
[email protected] http://www.fireandblast.com
fireandblast.com
Foreword This document has been prepared by fireandblast.com limited by compiling contributions from a selection of industry experts in various aspects of fires on offshore installations. This document has been prepared by fireandblast.com limited under a joint industry project sponsored by UKOOA and the UK HSE. The production of the initial text was undertaken by a number of organizations and individuals, principally:
David Galbraith and Ed Terry
fireandblast.com
Steve Walker
MSL Engineering
Barbara Lowesmith
Loughborough University
Terry Roberts, Stefan Ledin and Stuart Jagger Health and Safety Laboratory Bassam Burgan
Steel Construction Institute
John Gregory
Risk Management Decisions
Theresa Roper
Aker Kværner
Bob Brewerton
Natabelle Technology
Graham Dalzell
TBS cubed
Denis Krahn
Mustang Associates
This document is part of a series being produced by UKOOA and HSE on fires and explosions, the full series being: Part 0 Hazard management (formerly FEHM) Part 1 Avoidance and mitigation of explosions Part 2 Avoidance and mitigation of fires Part 3 Detailed design and assessment guidance
152-RP-48 Rev 02, Feb 2006
Page 2 of 261
fireandblast.com
Contents 1.
Introduction
1.1 1.2 1.3 1.4 2.
History ................................................................................................................................. 5 Objectives ........................................................................................................................... 6 Fire and explosion hazard management............................................................................. 7 Overview of the guidance.................................................................................................... 8 Fire hazard management philosophy
2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 3.
4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 5. 5.1 5.2 5.3
10
Overview ........................................................................................................................... 10 Understanding the fire hazard........................................................................................... 13 Hazard management principles ........................................................................................ 24 Hazard management systems .......................................................................................... 25 Legislation, standards and guidance in the UK................................................................. 28 Inherently safer design...................................................................................................... 31 Risk screening................................................................................................................... 38 Risk reduction ................................................................................................................... 41 Human factors................................................................................................................... 43 Fires on offshore installations
3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 4.
5
44
Introduction ....................................................................................................................... 44 Fire types and scenarios ................................................................................................... 44 Fire prevention methods ................................................................................................... 47 Gas and fire detection and control methods ..................................................................... 50 Methods for mitigating the effects of fires ......................................................................... 60 Performance standards..................................................................................................... 66 Methods and approaches to structural analysis................................................................ 69 Particular considerations for floating structures, storage and offloading systems ............ 78 Particular considerations for mobile offshore units ........................................................... 82 Particular considerations for existing installations............................................................. 90 Particular considerations for accommodation and other areas for personnel ................... 95
Interaction with explosion hazard management
96
General ............................................................................................................................. 96 Fire and explosion prevention methods ............................................................................ 97 Fire and explosion detection and control methods............................................................ 98 Fire and explosion mitigation methods............................................................................ 101 Combined fire and explosion analysis............................................................................. 106 Safety conflicts ................................................................................................................ 108 Fire and explosion walls.................................................................................................. 110 Decks .............................................................................................................................. 111 Feedback from explosion testing at Spadeadam ............................................................ 112 Derivation of fire loadings and heat transfer
113
Introduction ..................................................................................................................... 113 Fire characteristics and combustion effects .................................................................... 113 Fire and smoke loading................................................................................................... 123
152-RP-48 Rev 02, Feb 2006
Page 3 of 261
fireandblast.com 5.4 5.5 6. 6.1 6.2 6.3 6.4 6.5 6.6 6.7 7. 7.1 7.2 7.3 7.4 7.5 8. 8.1 8.2 8.3 8.4 8.5 8.6 8.7
Estimating fire and smoke loadings ................................................................................ 127 Heat transfer ................................................................................................................... 136 Response to fires
154
Properties of common materials in use offshore............................................................. 154 Effects of fire and nature of failures ................................................................................ 156 Acceptance criteria.......................................................................................................... 164 Methods of assessment .................................................................................................. 166 Attachments and coat-back............................................................................................. 172 Process responses.......................................................................................................... 173 Personnel ........................................................................................................................ 180 Detailed design guidance for fire resistance
194
General ........................................................................................................................... 194 The design sequence – minimising fire hazards throughout the design ......................... 195 Best practice for fire protection systems ......................................................................... 207 Human factors – man / machine interface ...................................................................... 219 Industry & regulatory authority initiatives ........................................................................ 222 References
225
Section 1 ......................................................................................................................... 225 Section 2 ......................................................................................................................... 225 Section 3 ......................................................................................................................... 225 Section 4 ......................................................................................................................... 225 Section 5 ......................................................................................................................... 225 Section 6 ......................................................................................................................... 225 Section 7 ......................................................................................................................... 225
Annex A
Acronyms, abbreviations etc.
226
Annex B
Glossary
227
Annex C
Details on legislation, standards and guidance
247
Annex D
Review of models
252
Annex E
Checklists
261
152-RP-48 Rev 02, Feb 2006
Page 4 of 261
fireandblast.com
1. Introduction 1.1 History Following the Piper Alpha disaster a large Joint Industry Project called ‘Blast and Fire Engineering for Topsides Structures (Phase 1)’ was carried out between May 1990 and July 1991. The main deliverable from this project was the Interim Guidance Notes (IGNs) [1.1] and 26 background reports [1.2 to 1.27] written by the participants and published by the Steel Construction Institute (SCI) in November 1991. These background reports are available as free downloads from the HSE web site [1.28]. The development of the Interim Guidance Notes was a major step forward which consolidated the then existing knowledge of fire and explosion hazards. At about this time the Fire and Blast Information Group (FABIG) was set up and has subsequently issued a number of Technical notes on specific aspects of fire and explosion engineering [1.29 to 1.36], of the eight published Technical Notes, five deal with fire hazard issues. The hazards, characteristics and physical properties of hydrocarbon jet fires were appraised in the Phase 1 reports of the Joint Industry Project on ‘Blast and Fire Engineering of Topside Structures’ (OTI 92 596/597/598) [1.37]. The main source of detailed information on the characteristics of jet fires covered in the reports on the programme of jet-fire research was co-funded by the European Community. This programme studied single fuel natural gas and propane jet fires (Bennett et al, 1990) [1.38]. A further project funded by the CEC, looked at the hazardous consequences of Jet Fire Interactions with Vessels (JIVE), this project covers the modelling of jet fires, large scale natural gas/butane jet fires and taking vessels to failure in jet fires and some results of jet flame impingement trials are reported in OTO 2000 051 [1.39]. Phase I of the JIP (OTI 92 596/597/598) [1.40, 1.41, 1.42] also included a review of open hydrocarbon pool fire models. Three types of model (current at the time) were evaluated, semiempirical proprietary models, field models (e.g. CFD models) and integral models (falling between semi-empirical and field models). Compartment fire modelling looked at two types of code, zone models and field models. At that time, the zone models (typically used for modelling fires within buildings) encountered severe limitations in the modelling of large offshore compartment fires. Three further phases of the Blast and Fire Engineering Project JIP were conducted from 1994 to 2001, Phase 2 [1.43], Phase 3a and Phase 3b [1.44] consisted mainly of experiments to define and determine explosion overpressure load characteristics under a range of conditions and to provide a basis against which load simulation software may be validated. However, Phase 2 did produce notable gains in knowledge in the area of unconfined crude oil jet fires and confined jet fires (compartment fires). Two other separate but widely supported JIPs were also conducted around this period which focussed on offshore fire hazards. One studied the effectiveness of water deluge on jet and pool fires and the second JIP studied jet fires involving ‘live’ crude containing dissolved gas and water. The Phase 2 JIP also focussed on horizontal free jet fires of stabilised light crude oil and mixtures of stabilised light crude oil with natural gas and the main findings are listed below. •
The free flame releases, of crude oil only, were not able to sustain a stable flame and one of the mixed fuel releases was also unstable.
•
All the flames were particularly luminous compared with purely gaseous jet flames and generated large quantities of thick black smoke, mainly towards the tail of the flame.
•
All the flames were highly radiative, with maximum time averaged surface emissive powers (SEPs, heat radiated outwards per unit surface area of the flame) ranging between 200 kWm-2 to 400 kWm-2.
152-RP-48 Rev 02, Feb 2006
Page 5 of 261
fireandblast.com •
The incident total heat fluxes (radiative and convective) measured on the pipe target were significantly higher for the mixed fuel tests than for the crude oil only tests, by a factor of two in many cases. Typical values were in the range 50 kWm-2 to 400 kWm-2.
Phase 2 of the JIP included a fire model evaluation exercise. This considered three jet-fire scenarios, but no pool-fire scenarios. However it did generate high quality data that were considered suitable for future pool fire model evaluation. Other valuable work, mostly executed in Norway and following the probabilistic approach, has resulted in the NORSOK guidance documents [1.45, 1.46]. Both references were among the source documents for Part 1 of this Guidance, it can be seen that the guidelines for risk and emergency preparedness will support emergency response for fire hazards as well.
1.2 Objectives The primary objective of this document is to offer guidance on practices and methodologies which can lead to a reduction in risk to life, the environment and the integrity of offshore facilities exposed to fire hazards. Risk is defined as the likelihood of a specified undesired event occurring within a specified period or resulting from specified circumstances. Preventative measures are the most effective means of minimising the probability of an event and its associated risk. The concepts of Inherently Safer Design or ‘Inherent Safety’ are central to the approach described in this document both for modifications of existing structures and new designs. This document consolidates the R&D effort from 1988 to the present day, integrates fire type and scenario definition, fire loading and response development and provides a rational design approach to be used as a basis for design of new facilities and the assessment of existing installations. This Guidance is intended to assist designers and duty holders during the design of, and in making operational modifications to, offshore installations in order to optimise and prioritise expenditure where it has most safety benefit. An additional intent of this Guidance is to move the decision-making processes within the fire and explosion design field as much as possible towards a ‘Type A’ process from ‘Type B or C’ as defined in UKOOA’s document on decision-making, the key figure of which is illustrated in Figure 1-1 below [1.47]. Due to the nature in which fire and explosion hazards are closely linked, reference should be made to Part 1 of this guidance when developing concepts and solutions to a “Type A” decision.
152-RP-48 Rev 02, Feb 2006
Page 6 of 261
fireandblast.com
Figure 1-1 The UKOOA decision making framework The framework in Figure 1-1 defines the weight given to various factors within the decision making process, ranging from those decisions that are dominated by purely engineering matters to those where company and societal values predominate. A substantial number of installations will lie in Areas A or B of the chart resulting in an approach which involves codes and guidance based on experience and ‘best practice’ (as described in this document) and supplemented by risk based arguments where required. This Guidance will look to build past experience of the development of fire scenarios and the prediction of design fire load cases and their timelines as part of the “Type A” approach.
1.3 Fire and explosion hazard management A thorough understanding of all hazards and hazardous events, including fires and explosions, is at the heart of the Safety Management System (SMS) and it should be proactive to reduce risks. A commonly adopted overall process is outlined in the OGP “Guidelines for the Development and Application of Health Safety and Environment Management Systems”. This Guidance adds more detail to this process and applies it to fires and explosions. For these hazardous events the management process is given below: •
identification of the hazardous events (coarse assessment);
•
analysis and assessment of the hazardous events (type, areas affected, magnitude of the consequences, duration, likelihood, etc.);
•
reduction of the risks from fires and explosions through inherently safer design;
•
design to reduce the likelihood, scale, intensity, duration and effects of each hazardous event;
•
identification and specification of the particular prevention, detection, control and mitigation measures needed for each hazardous event;
•
confirmation of the suitability and effectiveness of each of the measures selected;
152-RP-48 Rev 02, Feb 2006
Page 7 of 261
fireandblast.com •
specification of the measures adopted;
•
communication and implementation;
•
verification;
•
documentation.
The hazard management process should be employed in a timely manner and in accordance with the type, severity and likelihood of each hazardous event, that is, it should be a risk-based process. Therefore, in order to obtain most benefit, the hazard management process should start in the feasibility study phase It is essential that all parties who can contribute to the reduction of hazards particularly design engineering disciplines and those who will have to operate and maintain the plant, understand the hazards and are involved during the appropriate stages of the lifecycle. The lifecycle approach shows how to prepare and implement a strategy for the management of fire and explosion on an offshore installation throughout its life, i.e. from design through commissioning and operations to decommissioning. This is developed firstly by inherently safer design (elimination of hazards), followed by prevention of identified fire and explosion hazardous events and then by the selection of detection, control and mitigation measures. The fire and explosion assessment process is used in the lifecycle to provide information on which to base decisions and the design of systems. Thereafter, it is used to assess these arrangements to make sure that the high level performance standards have been achieved. The FEHM process can be applied to new or existing installations. •
For new installations it should start during feasibility studies and be fully developed during detail design. The results should then be communicated to personnel operating the installation to ensure that they know the purpose and capability of all the systems, can operate them properly and that adequate maintenance schemes are in place;
•
For an existing installation the process should be applied to current arrangements and modifications. These should be assessed to determine if the high level performance standards are achieved and that risks are as low as is reasonably practicable.
The management of hazards to reduce the risks involves many interests which may often appear to conflict with each other. The process is a multi-disciplinary activity, involving all levels of personnel from senior management to junior staff from a number of different organisations. It is important that the input and activities of these personnel are fully coordinated and managed. The SMS of each organisation should identify the relevant roles and responsibilities. A more comprehensive and homogeneous view of the role of fire and explosion hazard management within the overall Hazard Management System (HMS) can be found in Part 0 of this Guidance, “Part 0 Fire and explosion hazard management”. More information on specifically the philosophy of fire hazard management can also be found in Section 2 of this Part 2 of the Guidance.
1.4 Overview of the guidance Generally, the Guidance has been developed to consolidate current best practice in the industry and research community and sets out to present this information in a coherent manner of use to industry practitioners. The collation of existing information and the endeavour to relate the information into the form of “Type A” decisions (see Section 1.2), is intended to assist practitioners by providing a set of “Rules of Thumb” by which to carry out work effectively and quickly.
152-RP-48 Rev 02, Feb 2006
Page 8 of 261
fireandblast.com Section 2, ‘Fire hazard management philosophy’, describes the steps to be taken and the base information to be considered in understanding fire hazards and outlining some of the key considerations in managing them. This section sets out the principles, the process and the implementation steps required when deciding what has to be done in any particular context and the factors that have to be taken into account. The principles of ‘Inherent Safety’ are presented. Section 3, ‘Fires on offshore installations' discusses the various scenarios that can occur in hydrocarbon installations and provides assistance on the prevention, control and mitigation measures available to combat them. The appropriate methods of analysis dependent on the expected risk level are introduced. The tasks identified are linked with the relevant phase of a design project or the stage in the life of the installation. This section also gives .particular considerations for particular installations and parts of installations Section 4, ‘Interaction with explosion hazard management’, identifies situations where fires may precede or follow an explosion and deals with common areas of fire and explosion management, potential conflict between the management of these hazardous events and potential areas of combined analyses. Section 5, ‘Derivation of fire loadings and heat transfer’ describes how appropriate design thermal and smoke loads are derived. The section discusses eight fire types and the impacts of the associated heat transfer and considers the manner in which loadings are estimated for the purposes of use within a QRA. Section 6, ‘Response to fires’ discusses the effects of fire and the manner in which structures fail and links these concepts to definitions of acceptance criteria from national and international standards. The section also reviews potential failure definitions and failure modes of process equipment and impact effects on personnel. Section 7, ‘Detailed design guidance for fire resistance’, brings together the approaches identified in the other sections and incorporates additional design and operations experience to provide guidance on methods of detailed design. The guidance is presented in the context of best practice and identifies other industry initiatives which have generated detailed design and operating practice guidance. The subject area will be revisited in more detail in Part 3 of the guidance. The annexes provide summary and supplementary material.
152-RP-48 Rev 02, Feb 2006
Page 9 of 261
fireandblast.com
2. Fire hazard management philosophy 2.1 Overview 2.1.1 General In general terms a release of hydrocarbon with immediate ignition will result in a fire; release of an inflammable vapour or gaseous mixture followed by later ignition (i.e. when the cloud of vapour or gas is adequately large) may result in an explosion. Consequently some of the probabilities, causes, methods of prevention and control of releases are identical for both the fire and explosion hazard. Indeed, many of the hazard management principles and practices apply to both hazards. This aspect is explored more in Section 4.
2.1.2 Hazard philosophy In this, the second part of the Guidance, goals which should be achieved in designing for and managing the fire hazard are identified. The legislative basis is reviewed and some high level performance standards are given. The features of an effective Safety Management System (SMS) are identified and the choice and management of detection, control and mitigation systems is discussed. The main characteristics of the fire hazard are also identified. The techniques of inherently safer design described in Section 2.6 are fundamental to the most effective approach to eliminate, prevent and mitigate the fire hazard particularly for new designs. The advantage of an inherently safer design or the ‘Inherent Safety’ design approach is that it attempts to remove the potential for hazards to arise. It does not rely on control measures, systems or human intervention to protect personnel. In order to focus effort where it is most needed, a risk screening method is described in Section 2.7.4 which classifies installations and compartments according to the level of their fire risk. The measures for frequency and consequence severity are based on process complexity and the exposure potential for people on board. These measures are combined in a risk matrix to give low, medium and high risk categories. The risk level is an indication of the level of sophistication to be used in the fire assessment process. Nominal loads for jet and pool fires have been available since the publication of the Interim Guidance Notes (IGN) [2.1] in the form of heat fluxes for engulfed objects in open conditions. A number of alternative values have since been published including nominal fire loads for confined and ventilation controlled fires [2.2, 2.3]. Updated guidance on the selection of fire loads is given in Section 5.4 with recommendations on the limits of applicability. The overriding requirements for hazard management philosophy are to: •
protect personnel in the TR;
•
minimise injuries and fatalities from the initial event;
•
provide escape to TR and other means of escape/evacuation.
152-RP-48 Rev 02, Feb 2006
Page 10 of 261
fireandblast.com The philosophy should ensure that: •
the hazard scenarios are addressed;
•
suitable accidental loads are developed (either risk based and/or prescriptive);
•
plant and equipment minimises escalation, personnel within the TR do not continue to be threatened by the incident, until such time as the hazard has dissipated to a safe level via shutdown, blow down, or other means;
•
personnel are able to escape to a safe location away from the hazard.
The identification of key SCE’s and corresponding Performance Standards provide the demonstration that such a philosophy has been met.
2.1.3 Prescriptive vs. Performance based design Prescriptive design against the fire hazard can be a valid alternative, for example for low risk installations. This method is based on standardized guidance or requirements, without recognition of site-specific factors. The size of the facility, hazards posed or specific water demand is not considered. Prescriptive approaches to fire design generally are a result of compliance with regulations, insurance requirements, industry practices, or company procedures. These are generalized approaches largely based on past incidents. Performance or scenario based design adopts an objective based approach to provide a desired level of fire and explosion performance. The performance based approach presents a more specific prediction of potential fire hazards for a given system or process. This approach provides solutions based on performance measured against established goals or performance standards rather than on prescriptive requirements with implied goals. Solutions are supported by a Fire Hazard Analysis (FHA) or, in some cases, a fire risk assessment.
2.1.4 Hazard management A fire risk assessment takes account of more than just the consequences, and includes the likelihood or frequency of the fire and explosion scenarios occurring. A performance based approach looks at determining the need for fire and explosion design on a holistic basis. Performance objectives and measures allow the designer of fire systems more flexibility in meeting requirements and can result in significant cost-savings as compared with the prescriptive approach. Conversely, for small projects, the cost of performance based design may not be costeffective. In a scenario or performance based approach release scenarios are postulated and their consequences and probabilities of occurrence determined. For existing installations, reliable estimates of fire loads, extents and durations may be available from previous assessments. The most severe fires from the point of view of initial rate of release may be less frequent and less durable than fires of lesser severity and hence may present a smaller risk. Although the initial extent of the engulfed region may be greater, the lower duration may result in lower quantities of heat being delivered to those equipment items and structural members within the affected region. However, it is important to account for apparently small fires that on initial evaluation do not appear to have the potential for escalation. Dismissing such ‘small events’ can distort the Installation’s risk profile. The scenarios considered, should be sufficiently varied to cover the following:
152-RP-48 Rev 02, Feb 2006
Page 11 of 261
fireandblast.com •
severe, but unlikely cases which give short duration fires with the potential for the maximum number of immediate fatalities
•
small long duration scenarios which still have sufficient size to cause local escalation.
•
intermediate scenarios which have the greatest potential for escalation or platform impact whilst lasting long enough to realise this potential.
Design or Dimensioning fire scenarios are selected on the basis of the risk they present and should be accommodated by the safety critical elements (SCEs) of the installation which will include parts of the structure, piping and equipment. It will be necessary to consider the effect of non-availability of mitigation measures such as shut down, blow down, venting, deluge or barriers in the construction of design scenarios. Some scenarios may also assume a prior explosion has occurred with fire being an escalation event. The identification of the common-cause failure modes that may defeat several mitigation measures should needs to be carried out in a rigorous manner. Multiple or coincidental failures can lead to events moving from Minor or Controllable to Extreme (see Section 2.2.2); for example, fires that disrupt the UPS or auxiliary power supplies or common Installation air supplies. It is suggested in this guidance, that the number of SCEs which need to be considered in detail is reduced by classification into criticality categories with respect to the fire hazard. The direct consequences of fires are immediate fatalities or delayed fatalities by the blockage of access ways by radiation or the development of a hot gas layer, smoke and fume generation, structural weakening and possible collapse. Further escalation through subsequent release of inventory may occur. The consequence measures of relevance to fires are: •
intensity, that is heat flux and temperature;
•
extent, that is the area or volume occupied by flame, affected by radiation or by combustion products;
•
duration;
•
frequency, that is the probability of occurrence depending on the probability of immediate or delayed ignition;
•
mitigation effectiveness will depend on detection, inventory isolation and deluge activation together with the probabilities that these measures will be initiated;
•
radiation thresholds for personnel safety and escape, the integrity of equipment and supporting structure.
Reducing risks to ALARP must be demonstrated in all cases, both through the justification of the choice of design scenarios and from a determination of the impairment frequency of the SCEs under the fire loads. An acceptable level of risk can be identified within the ALARP framework, which identifies the acceptable frequency of exceedance of the severity of the design or dimensioning scenarios. Typically this frequency of exceedance will be of the order of 10-4 to 10-5 per year depending on the risk to people on board, the impact on the SCEs and the overall individual risk including that from other hazards. Following NORSOK [2.4], ISO [2.5] uses a threshold probability of exceedance level (10-4 per year) below which individual contributing scenarios may be eliminated from further consideration if the 152-RP-48 Rev 02, Feb 2006
Page 12 of 261
fireandblast.com impact on personnel is low enough (i.e. numbers of personnel affected). Events with probabilities above this level are considered to be ‘dimensioning’, and require further analysis to determine the size and extent of the resulting loading and subsequent effects. The UKOOA Part 1 document [2.6] proposes a similar approach, albeit couched in different terms. An (explosion) event will be considered depending on whether the event impinges directly on the Temporary Refuge with probability of exceedance > 10-5 per year. Events directly affecting other regions where a barrier may be present to prevent impingement on the TR are considered if the probability of exceedance is greater than 10-4 per year.
2.2 Understanding the fire hazard 2.2.1 General Understanding the risks from fire hazards is the key to their minimisation. This applies at all levels of an organisation from the directors to those designing and operating the facilities. This knowledge should be used to inform people making critical decisions both in design and operation. It should not be acquired after these decisions have been made in order to retrospectively justify them. In other words, the knowledge should be used proactively to reduce risk. The type of understanding differs according to the level of people in the organisation and the responsibilities that they hold. •
Senior Management: They need to know the overall level of risk for the facilities to decide if the design is viable or if existing operations may continue.
•
Project or Facilities Management: They need to know the pattern of risk by facility and the proportion of that risk which comes from different hazards such as fire. This will allow them to decide how the facilities are to be designed and operated. It will also allow them to provide sufficient resources.
•
Discipline Engineering and the Supervision of Operations: They need an overall understanding of all the hazards for which they have responsibility. The understanding of the causes, severity and consequences will allow them to decide how each of the hazards will be managed and the measures needed to do so.
•
Designers, Operators and Technicians: They need to understand the hazard characteristics so that they may design, operate and maintain critical elements to suit the needs of the hazards.
It is essential that the information gained from hazard and risk studies is distilled, documented and communicated so that every level and person is kept informed. It must also be kept up to date. It is a living picture which becomes progressively more detailed and accurate as the design progresses. It also changes throughout the life of the facilities as different activities take place and the fields mature.
2.2.2 Classification of fire hazards It may be helpful to classify fire hazards according to their potential for harm. This may be done by assessing what is in place either in a design or an existing facility and determining the classification. It is preferable to actively manage the fire hazards such that steps are taken to actively lower their classification by reducing the severity of the effects. This may be done by following the principles for inherently safer design (see Section 2.6) or by applying or optimising hazard management measures to minimise the size of releases, their location, effects on the facility, the rate of release and the duration. One method of classification follows.
152-RP-48 Rev 02, Feb 2006
Page 13 of 261
fireandblast.com •
Catastrophic: As the name suggests, these events would overwhelm an installation and it would be impractical to counteract the effects such that the lives of those on board could be saved. This type of event should be designed out or very high integrity preventative measures provided such that the likelihood is minimised.
•
Evacuation/Extreme: This type of event would have a major impact upon a large part of the installation such that the effects upon people, both physical and psychological, would be such that evacuation would be necessary. It would also apply to those events where the potential for escalation is widespread including structural, process, safety systems or the impairment of muster and escape routes. Typically these events are those which would give prolonged effects beyond the source module, in particular external flaming and dense smoke effects. In some cases it may be possible to suppress the widespread effects of these fires reducing the categorisation to the lower, controllable, level. If not, the effects must be fully understood and premature catastrophic escalation delayed, and personnel protected from smoke and heat until evacuation has been completed. By their nature these are inherently low frequency events, requiring a significant sized release from a major inventory and/or its combination with safety system failures such as ESD.
•
Controllable: These events have the potential for local fatalities and may also be capable of escalation to a scale requiring evacuation. However, the moderate scale of the effects should allow these events to be controlled such that further escalation is prevented and evacuation is not essential to preserve life. Typically, the prolonged effects of these events will be limited to one module or process area and will be of finite duration. They would be associated with smaller releases from moderate inventories. In these cases effective control of the source inventory and the prevention of escalation will be critical. It may be practical to extinguish some of these events but in other cases, this may not be possible or may be dangerous in which case, they should burn out under controlled conditions.
•
Minor: These events are of a very small scale. They may cause local injuries but would not have either the scale or duration to cause critical escalation. They may lead to damage to plant causing financial loss but not major loss of life. These events can be managed by limiting the size of the event and allowing it to burn out. Protection would only be needed for asset protection.
2.2.3 Causes and likelihood of hydrocarbon releases The causes of hydrocarbon releases are numerous and it is essential that a full causation is carried out so that effective preventative measures can be put in place. These causes can generally be broken down into three categories: •
human or procedural error;
•
plant or equipment failure;
•
systemic failure; i.e. inherent weaknesses in the business processes and infrastructure supporting design and operation.
Lack of maintenance, particularly over long periods may distort the understanding of the underlying causes of failures. Effective maintenance regimes are essential to determining the likelihood of plant failures. The likelihood of an event is a function of the propensity of the causes; e.g. the corrosivity of the fluids, the number of times containment is deliberately breached or the number of weak points such as flanges or tappings. It is also a function of the understanding of those causes and the effectiveness of measures which are put in place to manage them. Statistical data is a good start point from which to list causes and to determine likelihood. This should then be augmented with the knowledge of engineers, technicians and operators to give a more accurate picture for each 152-RP-48 Rev 02, Feb 2006
Page 14 of 261
fireandblast.com facility. HAZOP procedures will give a rigorous identification of process causes but the overall examination should be sufficiently broad to address external and human effects. This examination should be fully documented so that there can be assurances that preventative measures are suitable and sufficient. For statistical data, the most frequent sources of the hazard as given by the history of releases experienced to date are documented as follows. The HSE document OTO 2001 055 [2.7 states that for the UK sector of the North Sea: 61 % of all releases are from pipework systems 11 % of all releases are from small bore piping 15 % of all releases are from flanges 14 % of all releases are from seals and packing Of the causes; 11 % are due to incorrect installation 26 % from degradation of materials (excluding corrosion and erosion) 11 % of all releases are due to vibration/fatigue 19 % of all releases are due to corrosion and erosion It is considered that 40 % of equipment related releases are attributable to poor design and 38 % to inadequate inspection and condition monitoring. Avoidance of potential leak sources in design therefore needs to consider these above issues in particular. The importance of operational aspects is also shown in proportion of leaks attributable to poor inspection and monitoring. Sources of release data include WOAD [2.8], OREDA [2.9] release statistics published annually by the HSE [2.10] and the HSE/UKOOA publication on the subject [2.11]. The Minerals Management Service (MMS) of the US also publishes data on incidents on the Gulf of Mexico [2.12]
2.2.4 Ignition causes and probability The probability of ignition will depend upon the following factors. •
The rate and duration of the release and the size of the consequent gas cloud
•
The location of the release
•
The type of fuel and the proportion of gas or volatile vapours which is generated in the short term
•
The nature of the release; whether high or lower pressure. The turbulence caused by high pressure gas releases will cause effective mixing with the air to give a well defined flammable cloud. High pressure liquid releases will encourage fine droplet formation and increase the vaporisation of any light ends.
152-RP-48 Rev 02, Feb 2006
Page 15 of 261
fireandblast.com •
The flammability characteristics of the gases and vapours. Each different gas or vapour has a specific flammability range, from a lower flammability limit; through stoichiometric and rising to a higher limit above which ignition should not occur. Very large releases may have a non flammable rich core but will be surrounded by a flammable region which may engulf ignition sources as it spreads away from the point of release. Each gas or vapour will also have a specific auto ignition temperature ranging from 200 – 550 °C. such that contact with hot surfaces such as an exhaust turbocharger would cause ignition
•
The dispersion characteristics; whether there are heavy vapours which will descend or lighter gases which should rise.
•
The confinement of the escaping vapours and gases by floors, ceilings or walls. These may also cause flammable gases to be directed towards areas without flameproof equipment
•
The ventilation characteristics in the areas, whether forced or natural and the variation of those characteristics with wind strength and direction
•
The characteristics of the fluid and its release, where this might build up static
•
The presence of sulphurous impurities in the fluids which might lead to the formation of pyrophoric scale
•
The number of fixed ignition sources and the standard of their maintenance, if designed for use in flammable atmospheres, including the presence or not of Ex equipment.
•
The proximity of the release to areas which are classified as “safe” and therefore are not fitted with flameproof equipment.
•
The gas detection philosophy and the local and wider shutdown of ignition sources upon detection
•
The detection of gas ingress at the air intakes to enclosures such as accommodation or equipment rooms and the closure of dampers.
•
The hot work philosophy on the facility, the number of these activities and the effectiveness of their control.
•
The possibility of ignition being caused by the action of personnel carrying out emergency response actions such as plant shutdown causing sparks at electrical breakers.
Ignition probabilities have been widely studied and this work is summarised in recent work for UKOOA studying ignition probabilities [2.13]. The probability of ignition should be determined using that guidance together with an assessment of the characteristics listed above. As with the likelihood of release, it is possible to influence the probability of ignition by design, good maintenance and operational controls.
2.2.5 Fire hazards: Understanding the source 2.2.5.1 General It is essential that the source of the hydrocarbons is examined and fully understood in order to examine the fire hazard effects resulting from a release. Key parameters would include the range of release rates and characteristics which can originate from any part of the plant. Each parameter would be associated with a failure causing a specific hole size. The release rate would then vary with time depending upon the source conditions of fluid, pressure, inventory, location within the hydrocarbon system and the functional characteristics 152-RP-48 Rev 02, Feb 2006
Page 16 of 261
fireandblast.com (or the failure) of control systems such as ESD, depressurisation, and drainage. A detailed picture of the source terms from each inventory will allow the identification of the cases requiring analysis of the fire characteristics. If hazards are being classified as described above, it will give an initial indication which hazards fall into each category. It would show for example the process events which simply do not have sufficient inventory to realistically cause escalation, those which should be controllable and the events which require evacuation. For individual hazardous inventories, it would show the approximate conditions of hole size and control system operation which would determine whether it was controllable or require evacuation. 2.2.5.2 Reservoir hazards Direct releases from the reservoir may occur due to well intervention such as drilling or workover. In these cases the releases are likely to occur within the drilling facilities; typically at the bell nipple. These are likely to be of indefinite duration if the primary well control and blowout prevention systems have failed. Such releases may also contain drilling fluids, cuttings and other debris. In the case of blowouts from an oil reservoir with delayed ignition, the oil may build up over much of the top deck leading to a particularly hazardous and unpredictable situation when it ignites. Reservoir and drilling engineers should be consulted to identify the fluid composition and calculate the realistic flow rates. In most cases, the releases should be near the top of the platform with the flames rising above it. This will lead to rapid collapse of the derrick and severe radiation onto the top deck. It the release is below the drilling rig structure, this may collapse onto the wells leading to progressive escalation. A shallow gas blowout is another case in which a pocket of shallow gas is controlled by venting through a diverter. Diverters can fail due to erosion giving a large gas release of prolonged but finite duration within or below the drilling facilities with possible escalation as described above. Again drilling and reservoir engineers should be consulted to determine the possible flowrates and their likelihood. Large continuous releases from the Christmas Trees are much less likely due to the multiple valve isolation. They may occur during wire lining but only if there are multiple failures of the barriers. A more realistic scenario is a release from the lubricator via leakage through the valves and wireline BOP. In gas-lifted wells, it is possible that the gas within the annulus could backflow into the wellbay with typical inventories and pressures of up to 10 tonnes and up to 130 bar. The potential for escalation to other wells should be examined but is unlikely if they are fitted with effective downhole isolation or have a heavy-duty integrated Christmas Tree valve assembly. Flowline releases are considered to be part of the process hazards as they are downstream of the well isolation valves. Completion failures may result in leakage from the reservoir into the well annuli or around the cement such that oil or gas may surface round the outside of the well at the seabed. This may arise during the initial completion of the well. It may also arise in later life due to seismic action or the deterioration of the well bore, for example by corrosion. Well completion engineers should be consulted about the possibility of this occurrence, the potential flow rates and the locations at which hydrocarbons may be released. The effects of fires on or under the sea are discussed in Sections 5.2.5 and 5.2.6 2.2.5.3 Process hazards The process plant can have up to 40 sections which are segregated by ESD valves. Each of these is a source with individual characteristics of the fluids, pressures and volumes. Typically, the processing will include;
152-RP-48 Rev 02, Feb 2006
Page 17 of 261
fireandblast.com •
Production fluids manifolding and mixing: The manifolds collect the reservoir fluids from the wells via the flowlines, mix the fluids and direct them to the appropriate separators. They contain well fluids (see below) which may be a mixture of oil, condensate, gas, water and other materials such as sand. The inventory will be based on the combined volumes of these pipes. It will range from less than 500 kg in a mature, low pressure gas field up to 5 tonnes of oil for a new field. In oil facilities running at low pressures or using gas lift, the fluid can be three phase with a relatively low density. It may also have a high water cut giving small inventories which may not have the potential for escalation if rapidly isolated. The process conditions, aggressive nature of the fluids and the complexity of the piping give a relatively high probability of a release, particularly large bore flowline failures which may be caused by corrosion or erosion. Potential process backflows of gas and 2-phase fluids from the gas lift inventories into topside blowdown systems also needs to be addressed when analysing topside hazards.
•
Water, gas and oil/condensate separation: This takes place in large vessels, generally over 2 – 3 stages. The liquids have a 3 – 10 minute residence time. Typically, these vessels have total volumes up to 100 m3 and operate at pressures from 70 down to 3 bar. The flammable liquid inventories can be up to 30 tonnes but this may be divided in half by weirs which can reduce the amount which can realistically be released by half. There are relatively few release points providing that there is effective isolation at the outlet. Typically these are tappings for instruments and the possibility of corrosion in the body or welds of the separator vessel. These liquid inventories have the potential to overwhelm a moderate sized platform with a large fire lasting long enough to cause major escalation, particularly if the separators are located lower down in the topsides. They may have less of an impact if located on an open deck such as an F(P)SO as the smoke and flames can freely rise above the rest of the facility. The potential for harm is governed by the release pressure; see below under liquid fires. If these vessels are depressurised, the fires become much more controllable and the time to depressurise is critical. If they can brought below this pressure before escalation can occur or evacuation is required, this may reduce the classification of these hazards to the controllable level, at least for moderate sized holes.
The free gas inventory will range from 200 kg for a very low pressure vessel to 5000 kg for a very high pressure vessel with high molecular weight gas. Typically it will be in the 1000 – 2000 kg range. However this may be doubled by additional gas released from the liquids as the vessel depressurises. This inventory has the potential to cause local escalation but is unlikely to overwhelm a medium sized facility. Its potential for harm may be minimised by depressurisation. • Stabilisation and final dewatering: Some oil production platforms have a final stage of stabilisation or dewatering. These require large vessels which are filled with virtually stable oil plus a small quantity of water in the bottom. They operate at 2 – 6 bar and can contain up to 200 tonnes of oil. These lower pressures would result in a pool fire which would only be a threat to the platform if there were no arrangements to bund the release, minimising the size of the fire and further arrangements dispose of the oil and firewater. • Oil/condensate pressurisation for export: Export pump arrangements may use one or two pumps in series. These pumps are usually duplicated with manifold arrangements. These complex piping arrangements can give an isolated inventory of up to 15 tonnes for a field with large throughput. The most likely releases are at the pumps themselves but the study of available inventory should carefully examine how much could realistically be released, taking into account the operating philosophy standby arrangements for off line pumps and the provision of valves and check valves. The pump pressures will range from 40 – 120 bar depending upon the pressures within the pipeline infrastructures. Transfer pumps to export tankers will run at much lower pressures. These pressures will drop to the vapour pressure of the oil on shutdown, giving a continuous rate of release until the available inventory is exhausted. The pump seals and the complex jointed piping leak to a high likelihood of a release. The inherent design of the plant requires the pumps to be located close to the lowest level of the platform, often beneath the separators. This will lead to a low level 152-RP-48 Rev 02, Feb 2006
Page 18 of 261
fireandblast.com source with the potential for low level external flaming, smoke affecting most of the topsides and escalation to the inventories above. Shutdown of the pumps and careful management of the inventory which can be released will help to reduce the impact but it may still require evacuation in some cases. • Gas compression including gas liquids condensing and knockout. Gas from the various stages of separation is progressively compressed and cooled allowing liquids such as ethane, propane, butane and water to be condensed and returned to the liquids system. Typically several compressors will be required with the final discharge pressures of 50 – 60 bar. It is likely that the compressor sections and their associated condensers and knockout pots will be sectionalised with ESD valves. This reduces the gas inventories to 1000 – 2000 kg. As with separation, this has limited potential for local escalation and this can be minimised with depressurisation. The major risk is that to personnel in the immediate area from flash fires or from explosions if the area is congested. There is a moderately high possibility of a gas leak arising from the compressors and associated vibration. The liquids which are condensed and collected in the gas knockout pots may be either liquefied gases or water. The gas-liquid inventories should be less than 2 tonnes and in many cases, just a few hundred kg. Only the larger inventories will have the potential for escalation. However, there is a major exposure to flash fires or explosions as these liquids are very reactive, will have a high release rate and the vapours may not disperse easily. The likelihood of release should be low as there are few release points in the liquid sections of these process plants. • Gas drying: This will use either glycol units or molecular sieves and can operate at up to 60 bar. The largest inventory is likely to be a contactor with up to 3 tonnes of gas. Again, this has a limited potential for local escalation and can be minimised using depressurisation. • High pressure export, gas lift and reinjection compression: A typical pressure for these systems is 150 bar. However it can be as high as 400 bar for some reinjection requirements. Again, the inventories will be moderate; typically 1 – 3 tonnes with the potential for local escalation. However, the high pressures can give high release rates from moderate hole sizes, increasing the risks from flash fires and explosions. • Oil and gas metering: Metering is generally carried out using inline flowmeters. From a hazard’s point of view, they are equivalent to piping with additional potential release sites at the instruments. The hazards are similar to the export pumping and compression respectively and may be part of the same inventory. Identification of the inventory of each process section should be carried out to determine the conditions and inventory during operation and immediately after shutdown. The behaviour of each section should be modelled using simple calculations to determine the gas and liquid release characteristics from a range of hole sizes. The intent is to build up a picture of the types of events that can occur in each part of the platform. These scenarios and associated hole sizes should reflect the failures which have been identified during the causation analysis. They should be sufficiently varied to cover the following; those large but unlikely cases which give short duration fires with the potential for the maximum number of immediate fatalities; those small long duration cases which still have sufficient size to cause local escalation; and those intermediate cases which have the greatest potential for escalation or platform impact whilst still lasting long enough to realise these effects – typically a 10 minute duration. 2.2.5.4 Import and export risers Risers may contain any of the fluids mentioned above, from well fluids to stabilised oil or dry clean gas. They may be connected to a major pipeline infrastructure or be small infield flow lines from satellite wells or for gas lift. The risers may be rigid steel or flexible. The releases may range from pinholes due to corrosion up to a full shear. The location of a release may be as follows:
152-RP-48 Rev 02, Feb 2006
Page 19 of 261
fireandblast.com • Immediately under the platform; • Closer to sea level where they may be exposed to ship damage or chafing and corrosion; • Sub sea or at the sea bed where it may be subject to internal corrosion. The location will affect the release characteristics and the ignition probability. Release rates from these pipelines may initially be modelled using simple calculations [2.14], the Sintef and Scandpower fire calculations for the process industry or using more sophisticated methods. They should be based upon the hole sizes which could realistically occur as identified in the causation analysis. The modelling should cover cases with and without the operation of subsea isolation valves or confirm where these are fitted or considered. They should take into account time delays in the operation of ESD valves and their operability with a high differential pressure following a major riser failure. Data such as valve closure times and internal leak rates should be derived from platform specific datasets. Information from incoming ESD valve trips, routine tests and maintenance will give a more accurate picture of equipment performance than generic information from generally available databases. ESD valves would not respond quickly enough to prevent the immediate fatalities rising from a major gas riser failure unless there was delayed ignition. The characteristics of pipeline releases from two phase fluids or liquids with dissolved gases should take into account the variation in release characteristics caused by; gas and liquids separation, slug flow, the elevation of the release point relative to the main inventory on the sea bed, and effervescence as gas separates carrying with it liquids in aerosol form. In some cases such as subsea releases, the fires may burn on the sea surface, see Section 5.2.6.
2.2.6 Types of fire hazard: - Liquids Liquid fires generally have a greater potential for harm than gas fires for the following reasons: • They have greater isolated process inventories arising from the higher densities of between 600 and 850 kg/m3. Typically these can be up to 20-30 tonnes in separators. • The release rates will be much greater than gases for the same hole sizes and pressures. • The heat fluxes from pool fires will be lower than gas jets but pressurised oil or gas liquids, particularly with dissolved gas can give the same or greater radiative heat flux. • A moderate sized oil leak of 20 mm at 20 barg would have a flame volume of 4500 m3 and this has the potential to completely engulf a medium sized process module and cause some external flaming. A 20 tonne inventory would sustain this fire for 30 minutes assuming a constant release rate. • This confinement with a roof and/or walls will also cause high radiative heat fluxes, even with pool fires. • Liquid fires can also be the source of overwhelming quantities of smoke. • Liquids tend to be located at the lower levels of a platform which causes the fire source to have a greater impact on the facility, engulfing the levels above and to the sides in flames and smoke and also leading to the exposure of structures, people and plant above it. • Liquid releases can be difficult to detect if there is only a small gas content and this can lead to a build-up of oil on the floor, possibly spreading to lower levels prior to ignition. This can exacerbate the effects by increasing the total fuel quantity, the initial fire size and its spread into more vulnerable locations.
152-RP-48 Rev 02, Feb 2006
Page 20 of 261
fireandblast.com • The effect of increased water cut of the hydrocarbon from the reservoir on fire hazards should be considered carefully to avoid over-conservatism in the fire risk analysis. For example, some researchers consider that water cuts above 60% make the oil very difficult to ignite. These potential effects can give liquids the potential to overwhelm a platform giving many cases which could be classified as evacuation/extreme, even with moderate pressures and hole sizes on a poorly laid out facility. The fire characteristics will vary according to the release pressures and the fuel type. Most oil is only partially stabilised; i.e. it will have some dissolved and liquefied gas within it. It will also be pressurised; by the inherent state of the fluid (its own vapour pressure); by the pressurised gases above the liquid as in separators; or through pumping. The pressure will determine the release rate and the management of that pressure after the fire is detected is a key component of managing these hazards. This may be achieved by isolating the pumps or by depressurisation. The release rate is proportional to the square root of the pressure and will reduce as these actions come into effect. Equations for calculating release rates are given in the Handbook for Fire Calculations and risk assessment in the process industry, by Sintef and Scandpower [2.16], reference should also be made to the Phase 2 Blast and Fire Engineering for Topside Structures [2.17]. The pressure will also determine how the liquid will burn, for example, as a spray or a pool. The heat fluxes will drop with the pressures and this allows deluge systems to become more effective both in protecting exposed plant and in suppressing the fire itself. This is discussed in Section 7. Lighter liquids such as condensate will have lower transition pressure. Gas liquids; ethane, propane and butane will be pressurised and it is unlikely that their operating temperatures will ever be low enough to allow them to burn as a pool. They are only likely to be found in moderate quantities of 1 – 2 tonnes within the gas compression and drying facilities. An additional issue to be considered is the potential escalating effect of flaming “rain out”; this can occur at ambient temperatures, especially with butane (also propane) and especially for the scenario of jet flame impingement on an obstruction, Section .2.2.7 discusses further detail of jet fires.
2.2.7 Types of fire hazard: Gas jet fires Gases will give rise to an intense jet flame with high localised convective and radiative heat fluxes. The radiative content will increase both with the molecular weight and as the jet encounters obstructions. They are generally not large enough or sustained by a sufficiently large inventory to be significantly affected by confinement within a roofed module except where they directly impact the ceilings or walls. This makes their potential for escalation highly directional and this is likely only to affect a small number of critical items such as a single structural member, part of a vessel or some piping. Only very large inventories would have the potential for more widespread simultaneous failure. These large inventories require both high pressures and large volumes within the process plant or an isolation failure to a primary source such as a riser or well. Gas jets have moderate release rates unless there are very large hole sizes and/or high pressures. A 20 mm hole at 20 barg would give a methane jet of approximately 10 – 12 m and a flame volume of 100 m3. With a source of 40 m3 in volume, typical of the gas content in a separator, this would reduce to a jet of 7-8m and a flame volume of 25 m3 within 10 minutes of the ESD operating. If the separator was depressurised, this would decay even faster but this may be offset by the disassociation of dissolved gas in the oil.
2.2.8 Types of fire hazard: Confinement and ventilation control The presence of walls, ceilings, floors and obstructions will significantly affect the way in which air can mix with the fuel. They will also affect the flame shape. These two factors will change the heat fluxes, the efficiency of combustion and the density of smoke. The air requirements for stoichiometric burning of hydrocarbon fires are between 15 and 17 times the mass burn rate of the fuel. In most cases, this is the release rate unless there is containment of a pool fire to reduce the burn rate. Most modules have good ventilation and venting to minimise 152-RP-48 Rev 02, Feb 2006
Page 21 of 261
fireandblast.com gas build-up and explosion overpressures respectively. The air input rate through a single opening in a wall is calculated using the formula Ma = ½A √H where Ma is the air input rate in kg/sec, A is the area of the opening in m2 and H is the height of the opening in m. With openings in the floors and ceilings or multiple openings in the walls of different heights, this becomes a complex calculation. Typically the fuel burn rate that can be sustained by a module with one open wall of 30m by 8m is 21kg s-1. It is unlikely that severe ventilation limitation will occur unless there is a very high release rate and this is sustained for several minutes. If it does occur it is likely to involve a major liquid inventory rather than gas fires. If the ventilation is severely limited, then the combustion characteristics within the modules will be affected with reduction in heat fluxes, reduced liquid vaporisation rates, combustion instability, very dense smoke with high concentrations of carbon monoxide. Unburnt vapours may also burn as they leave the module giving the external flaming described below. It can take a few minutes before the fire becomes ventilation controlled as the air inside is used up. It is more likely that a large fire will not be ventilation controlled but that its size will simply exceed that of the module. Once the flame volume reaches 1/3 of the free volume in a module (i.e. that volume up to the top of the highest opening and excluding the volume in between the ceiling beams), then the flames will spread across the ceiling and begin to extend beyond the module. In the initial stages of these fires, the flames build up across the ceilings with a hot flame layer slowly descending across the whole module. This is the neutral plane at which air entering the module mixes with the vapours. This can descend to 2/3 of the way down the openings in the walls with significant flame velocities as they travel towards the openings. These areas will have high radiative and moderately high convective heat fluxes. These will be highest near to or above the source of the fire but will provide a relatively uniform heating of all structures, piping and upper parts of vessels above the neutral plane. This is likely to lead to multiple failure of this equipment. These high fluxes will occur both with pool and spray fires but gas jets are less likely to develop this module engulfment for the reasons described above. The area between the ceiling beams becomes stagnant with high radiative but lower convective heat fluxes. It either the fire is ventilation controlled or the fire size reaches that described above, then external flaming will occur. With large external flame volumes the width of the base of the flame can be much wider than the opening. If it originates from the lower modules, it can engulf the whole side of the platform with wind causing it to tilt, possibly towards the accommodation or TR. This effect is graphically illustrated in Ref Piper Alpha Inquiry Report part 2 plates14b through to 18a [2.18]. This will have a major impact upon the whole installation and it is likely to require evacuation if it is sustained for more than a few minutes. There is only limited understanding of this external flaming and there are few if any predictive tools to quantify it accurately. Its characteristics may be similar to a large pool fire, with the flames subject to tilt in high winds [2.16].
2.2.9 Fires on the sea Fires on the sea will be affected by a number of factors; the fuel, release characteristics, release rate, the sea and weather conditions. It requires a fairly large release and benign sea and weather conditions before the fire has a major impact on the facility. This could lead to structural or riser failure, smoke engulfment of the topsides or the impairment of evacuation. All of the contributing factors must be examined to determine the risk of failures and benign conditions occurring simultaneously. This may be very low in the North Sea but not in other parts of the world. Some development information was prepared in 1992 for the HSE and amongst the treatment of other fire types; a review of pool fires on liquid was undertaken [2.19].
2.2.10 Consequences This guidance will generally consider both consequences and impacts, where; Consequences are the outcome of an accident expressed in physical phenomena such as gas concentration, thermal radiation level, explosion overpressure, and impacts are the effect of 152-RP-48 Rev 02, Feb 2006
Page 22 of 261
fireandblast.com accidents on people, structures and equipment. They are undoubtedly linked and the terms may be occasionally interchangeable. Fires may result in any of the following consequences and impacts: • Direct injury or loss of life to personnel exposed to the immediate effects of fire, particularly flash fire effects; • The impairment of the ability of people to make rational decisions and to preserve their own lives, either through the effects of smoke or the psychological effects of the incident; • Impairment of escape routes and entrapment of personnel so that they cannot return to a refuge; • Impairment of the accommodation or temporary refuge; • Impairment of critical control and communication centres; • Impairment of evacuation routes and means of evacuation or escape from the platform; • Further escalation through the failure of process plant, well containment or risers; • Catastrophic rupture of pressure vessels or containers, both containing flammable and non flammable fluids; • The release of toxic materials and the generation of toxic fumes through their combustion; • The loss of critical safety and communication systems; • Weakening of the primary structure leading to progressive structural collapse; • Weakening of secondary structures leading to any of the hardware failures listed above; The probability and timing of these failures is dependent upon the following: • The intensity of the exposure. Greater heat fluxes or more dense smoke concentrations will lead to more rapid failures; • The degree of exposure: Localised exposure rather than complete engulfment will reduce the probability and increase the time to failure. The time dependent size of fires such as decaying gas jets should be taken into account when making this assessment; • The duration of the exposure; • The inherent mass, strength and stresses on exposed plant; • The presence of any protection or insulation which could realistically reduce the rate of heat transfer;
2.2.11 Developing a set of representative scenarios There is an almost infinite range of events which can occur on an offshore facility. A representative selection of scenarios should be selected from each of the hazards which are considered to have the potential for a major accident. An initial hazard identification and expert judgement will identify those hydrocarbon sources with the greatest potential for harm and those with a high probability. These should be subject to more intense scrutiny than lesser risks and any modelling should be
152-RP-48 Rev 02, Feb 2006
Page 23 of 261
fireandblast.com based on platform specific parameters not generic fire scenarios with particular attention paid to the uncertainty surrounding two-phase releases. The events chosen for analysis should reflect the installation’s design features as much as possible and encompass the following cases • Those with the greatest potential for escalation; i.e. the largest events with sufficient duration to cause failure • Those events which could realistically occur; i.e. those with clearly identified causes giving failures of an identified maximum size; e.g. the largest tapping size or the dimensions of typical corrosion failures • Those events of a critical duration such as the time to cause evacuation • The characteristics of the events whenever critical control systems such as ESD fail to operate The examination of these hazards should be used to build up a complete picture of all of the hazards; their causes and probability, the range of sizes, location and duration, the possible rates and timings to escalation and the effects when such escalation does occur. This should be documented so that everyone with a part to play in their management can see the whole picture. Once it is in place, the effectiveness of systems to counteract the effects can be assessed and the future management of these hazards can be planned as described in Section 2.4.3. The analysis is a living process and should be capable of future use to examine different cases or the optimisation of control systems such as depressurisation both during design and operation.
2.3 Hazard management principles • Management responsibilities need to be accurately defined and clear boundaries for roles and responsibilities set out. • All fire hazards shall be identified, analysed and understood by everyone with a part to play in their management. • Every opportunity to minimise fire risks at source shall be identified, considered and where practicable, implemented. This shall cover minimising the likelihood, severity and the exposure of people and plant. • A practical strategy to manage each of the hazards shall be identified, documented and implemented. • An appropriate combination of prevention, detection, control and mitigation measures shall be put in place to implement the chosen strategies. • A strategy should take account of sensitivity of the installation’s overall risk profile to fire hazards and should weight the mitigation and control measures accordingly. • All of these measures, including people, processes and plant shall be documented, have clear ownership and shall have minimum performance standards • All causes shall be identified, understood and sufficient effective prevention measures shall be implemented. Where the effects of failure could require evacuation of overwhelm the installation, these measures shall be specifically identified and shall be of high integrity.
152-RP-48 Rev 02, Feb 2006
Page 24 of 261
fireandblast.com • The operating limits for the whole facility shall be identified and clear instructions as to the continued operation of the facility or use of additional controls whenever they are exceeded. • The systems provided to detect fires shall be suitable for the hazard types and the environmental conditions. They shall provide sufficient information to warn personnel and to allow an assessment of the hazards to be undertaken without hazardous personnel exposure. • There shall be effective isolation of all major external sources of hydrocarbons including pipelines and the reservoir. This isolation shall be designed to survive all reasonably foreseeable fire hazards on the facility. • The characteristics of those hazards which may require evacuation shall be carefully studied so that the severity and potential for escalation may be reduced, thereby minimising the need to evacuate. • Personnel shall be located so that their exposure to fire hazards is minimised • The systems provided to protect personnel, plant, structures and safety system shall be suitable for the fire hazard effects. • Areas required to shelter personnel from fire effects and their supports shall remain viable until either the incidents have been brought under control or full controlled evacuation has taken place. • A minimum provision of routes, systems and arrangements to allow evacuation shall remain viable under the effects of every incident which may require them • All reasonably practical steps to reduce the risks from fires shall be taken, concentrating first on prevention and thereafter in descending order on control, the prevention of escalation and evacuation.
2.4 Hazard management systems 2.4.1 General A structured approach to the management of fire hazards shall be put in place by all organisations responsible for the design or operation of offshore facilities. This shall ensure that the principles outlined in Section 2.3. are implemented throughout the lifecycle. It shall fit within the overall safety management system for that company and shall show the company safety policy is to be implemented. The management of fire hazards is a complex process: It requires contributions from a very wide range of people, plant and processes. These may be required to prevent, detect control, protect or evacuate. It is not acceptable simply to manage each one in isolation to default standards and to presume that this will give an effective hazard management system. It in necessary to have a fully integrated process that ensures that all hazards have the necessary components in place and that they all work together effectively. This may be based upon the generic frameworks outlined in HSG 65 [2.20], API RP 75 [2.21] or ISO 14001 [2.22]. These all use the 5 step process as described in Sections 2.4.2 to 2.4.6. All of these elements need to be underpinned by a commitment to safety from the organization’s management at the highest level, with effective leadership to ensure that the above elements are diligently carried out. The management needs to be aware of the safety policy and aims and provide the necessary resources to ensure that these aims are fulfilled. 152-RP-48 Rev 02, Feb 2006
Page 25 of 261
fireandblast.com
2.4.2 Policy Each company should have a coordinated set of policies which cover the principles listed above and the means by which they are implemented and assured. Policies may be considered at four levels of increasing detail and specific application: • Corporate policies: These should set the overall ethos of the company, its overall stance with respect to HSE and its public expression of commitment to the protection of its personnel and those with whom it interacts. It should set an overall standard of risk tolerability. This may be an expression of individual risk covering all types of exposure including occupational and major hazards risk. The organisation may also choose to set tolerable risk criteria for major hazards which may result in multiple fatalities. Most organisations should also demonstrate a commitment to continuous improvement. Corporate goals may also be set stating how the business should be organised and run in pursuance of their risk criteria. It may also set minimum standards relating to design and operations such as the requirements for the use of codes and standards. • Regional or business policies: These should apply the overall corporate criteria to that business or region and set minimum standards. This will relate to the development of risk assessment processes and the criteria for acceptance in a wide range of activities from discipline engineering applications such as structural assessments and instrument criticalities to operational criteria such as SIMOPs or task risk assessments. They should also set the framework for management systems, and set the minimum technical and operational standards which apply across that whole region of business. • Facility: Specific policies and standards may be required for an individual facility. This would result from the assessment of the facility and would apply controls or set minimum technical requirements so that the risks are kept within the criteria. This may apply to operational or technical limits • Specific requirements: These would be the minimum standards for specific items of plant, competence, or any systems needed to manage hazards effectively.
2.4.3 Planning Planning covers five specific items and these apply both in design and in operation; • Identification of the hazards and the analysis to give the understanding outlined in the principles listed in Section 2.3; • The development of strategies to manage each of the hazards, identification of the people, plant and procedures needed to manage them and the setting or confirmation of the minimum standards for those elements; • The assessment of the risks from the hazards based on the chosen strategies and the performance of the elements chosen to reduce risks to ALARP; • The assessment of the business infrastructure and resources needed to implement the strategies both initially and thereafter to maintain them; • The documentation and communication of the hazard knowledge, the strategies and the measures needed to implement them; The planning process itself needs to be organised so that the requisite information is available to promote proactive hazard management; i.e. the understanding of hazards needs to be in place before key decisions are made rather than using it to retrospectively justify them. In design, this requires the early development and resourcing of the risk assessment and management process 152-RP-48 Rev 02, Feb 2006
Page 26 of 261
fireandblast.com through the use of an HSE plan. It also needs commitment from the project managers to ensure that this proactive culture flourishes and that everyone uses this information to optimise the design. This includes the discipline engineers, particularly process and layout who have the greatest opportunities to maximise the inherent safety. The specialist risk and safety engineers should act in support of these disciplines in furtherance of a safer design rather than as a discrete and independent group providing data for regulatory compliance. Operations should be well represented both to provide their knowledge of the causes and risks and to agree the hazard strategies. Typically the HSE plan will include each of the following activities for each of the project stages: Concept development and selection: • Identification of the primary generic risk drivers; i.e. those that will apply whichever concept is chosen; • Identification of different viable concepts; • Hazard identification and qualitative risk ranking; • Comparison and selection of the concept. Front end engineering design, (FEED): • Update and more thorough hazard identification; • Initial characterisation of the hazards; cause severity, consequence and escalation; • Use of the hazard knowledge to optimise the inherent safety during the early process and layout design; • Selection of the strategy and primary systems to manage each hazard; • Selection of scenarios and detailed hazard characterisation (HAZOP, fire analysis, escalation analysis, vulnerability studies, evacuation and emergency response analysis); • Setting of the performance standards for each system; • Risk assessment (This may be quantitative where required but is not essential). Detail design: • Design of the systems to meet the performance standards; • Preparation of the operational procedures.
2.4.4 Implementation This is the process of putting the hazard decisions into practice and maintaining the minimum standards throughout the lifecycle. It requires the provision of a business infrastructure both within direct operations control and to support these operations. This may include but not be limited to design engineering, integrity management, procurement, HSE, training, emergency response. Each part of the organisation will make specific contributions to the management of each hazard. The requirements arising from the planning process should be embedded into each of these business processes. This should include the identification or cross referencing of critical elements to the hazards and the assurance that the required performance is correctly documented.
152-RP-48 Rev 02, Feb 2006
Page 27 of 261
fireandblast.com The operational procedures and controls should be fully developed in conjunction with the operators. This should cover both procedures to prevent accidents and those to manage the incidents if they should occur. The emergency response plans should be written in the full knowledge of the hazards and the timeline of their development.
2.4.5 Measurement Measurement covers a range of activities. At the higher level, it is the verification that the hazard identification, analysis and management process is thorough, complete and is of adequate quality. Thereafter, there should be confirmation that it is working; i.e. that there is a widespread understanding of risks and hazards, that the linkages between hazards and critical elements are in place and that the resourcing and infrastructure is sufficient. At a more detailed level it is the confirmation that the design of the plant is adequate and that the minimum standards of performance for people, processes and plant are being met.
2.4.6 Review and improvement Periodic review should examine trends from the measurement processes. It should be carried out at the levels described, from considering how the overall risks are changing down to the specific performance history of plant or changes in personnel and their competence. It should then give structured proposals for investment in future risk reduction.
2.5 Legislation, standards and guidance in the UK 2.5.1 General framework This section details the major legislation covering risks arising due to fire related hazards. It is not exhaustive as any legislation covering general safety or requiring a safety risk assessment to be performed, will be relevant where the potential for a fire exists. Legislation may be added or amended during the lifetime of this Guidance. The primary UK legislation governing safety in the workplace is the ‘Health and Safety at Work Etc. Act 1974’ (HSAWA) [2.23], this imposes a responsibility on the employer to ensure the safety at work for all employees. Employers have to take reasonable steps to ensure the health, safety and welfare of their employees. Various regulations are enacted under the HSAWA. These include the ‘Management of Health and Safety at Work Regulations 1999’ [2.24], which places an obligation on the employer to actively carry out a risk assessment of the workplace and act accordingly. Risks assessed will include those from fire and explosion. It should be noted that the Management of Health and Safety at Work Regulations were amended at the start of 2005 to address issues of employee consultation and are now referred to as SI 2005 [2.25] Management of Health and Safety at Work and Health and Safety (Consultation with Employees) (Amendment) Regulations 2005 [2.26]. All technical issues relating to hazard management are unchanged within the regulations.
2.5.2 Offshore regulations More specifically related to fire and explosion risk are the Prevention of Fire and Explosion and Emergency Response on offshore installations (PFEER) [2.27] regulations which place on the Duty Holder the requirement to take appropriate measures to protect persons from major hazards including fires and explosions. These measures include identification of fire and explosion hazards and the evaluation of their consequences and likelihood (Regulation 5). Regulations 9 to 12 specify the types of measures which are required for prevention, detection, communication and control of emergencies. The regulations also require mitigating measures to be specified and put in place and for performance standards to be set for safety critical measures to prevent, control and mitigate explosion hazards. 152-RP-48 Rev 02, Feb 2006
Page 28 of 261
fireandblast.com The Duty Holder must ensure that effective evacuation, escape recovery and rescue will occur in the case of an explosion event (Regulations 14 to 17). The Safety Case Regulations (SCR) [2.28] require all installations in UK waters to have an acceptable Safety Case. Information regarding the following issues is required to be addressed in the Safety Case: • Identification of major hazards; • Evaluation of risks associated with the identified hazards; • Details of appropriate measures taken to reduce these risks to as low a level as is reasonably practicable; • Details of the Duty Holder’s (Safety) Management Systems. The Design and Construction Regulations DCR [2.29] amended the SCR by placing a responsibility on duty holders to prepare a suitable verification scheme for their installations to ensure independent and competent evaluation of those elements of the installation which are critical to safety (known as safety-critical elements, SCEs). Performance standards are used to define the functionality and integrity of these safety critical elements. They will define how these SCEs are expected to function during and after explosion events.
2.5.3 APOSC The ‘Assessment Principles for Offshore Safety Cases’ document (APOSC) [2.30] provides open guidance for Duty Holders on the basis by which HSE inspectors would assess safety cases. The APOSC provides clarifications on issues which may not have been clear from the regulations and associated ACOP where available. The APOSC document advises that the following should be demonstrated for Major Accident Hazard assessments to an HSE inspector’s satisfaction: Acceptable safety cases will demonstrate that a structured approach has been taken which: • Identifies all major accident hazards (paragraphs 38-48); • Evaluates the risks from the identified major accident hazards (paragraphs 49-74); • Describes how any quantified risk assessment (QRA) has been used and how uncertainties have been taken into account (paragraphs 75-82); • Identifies and describes (paragraphs 83-89);
the
implementation
of
the
risk
reduction
measures
• Describes how major accident risks are managed (paragraphs 90-112); • Describes the evacuation, escape and rescue arrangements (paragraphs 113-144). The structured approach listed above is generic, so that there are no specific requirements for how an assessment of fire hazards should be carried out.
2.5.4 Fire and explosion strategy The HSE have recently compiled and published issue 1 of a Fire and Explosion Strategy [2.31] to illustrate their approach. The overall objective of the document is to identify the areas which OSD has identified as requiring possible future work to address significant areas of uncertainty in fire and explosion issues on offshore installations. The document covers a number of areas of relevance to this guidance, the topics covered briefly in the strategy document are: 152-RP-48 Rev 02, Feb 2006
Page 29 of 261
fireandblast.com • Fluid characteristics (often referred to as “Source Terms”); • Ignition; • Fire and gas detection; • Dispersion and ventilation; • Fire and explosion hazard assessment; • Fire and explosion consequence assessment; • Prevention, control and mitigation of fires and explosion. The more detailed scope covered by the strategy document is as follows: • Provide an introduction to each topic area, e.g. describing the scope of the review, the nature of the hazard etc (as appropriate to the topic area); • Describe the significance of the topic with regard to the risk of major accidents on offshore installations; • Summarise current knowledge of the topic (i.e. reference to completed and on-going research, standards, codes of practice, design guidance etc); • Summarise existing modelling capabilities (as appropriate to the topic area); • Based on the results of the knowledge summary and the model capabilities above, identify areas of uncertainty; • Summarise current industry practice (i.e. reference to approaches taken in Safety Cases, extent of implementation of existing codes, guidance etc, awareness of issues); • Summarise areas identified to potentially be carried forward as part of OSD 3’s strategy development. The strategy document emphasises that individual topics are subject to continuous change and their priority is not addressed in the strategy document.
2.5.5 Codes, standards and guidance Guidance documents are available from the Health and Safety Executive for the legislation mentioned above. However there is little guidance, apart from ISO 13702 [2.5] and PFEER [2.27], relating specifically to the design of installations against fire hazard events. The most relevant are the Interim Guidance Notes (IGN) [2.1]] for which this Guidance represents an updated publication. Various codes, standards and guidance are available covering elements related to the fire hazards, (it should be noted that explosion incidents will often be followed by fire, hence the guidance below incorporates some references to explosion hazards as well). Some of the widely used standards are listed below. For ignition prevention and Hazardous Area Classification: • Institute of Petroleum, ‘Area Classification Code for installations handling flammable fluids’, August 2002, (IP15) [2.32];
152-RP-48 Rev 02, Feb 2006
Page 30 of 261
fireandblast.com • The ATEX (Atmospheric Explosion) Directives 94/9/EC [2.33] and 1999/92/EC [2.34]cover electrical and mechanical equipment and protective systems, which may be used in potentially explosive atmospheres; • BS EN 60079-10. ‘Electrical apparatus for explosive gas atmospheres Part 10. Classification of hazardous areas’, [2.35]; • For equipment in hazardous areas ‘BS EN 1127-1: 1998 Explosive atmospheres [2.36]. • BS 5958: 1991 ‘Code of practice for control of undesirable static electricity’, [2.37]. These documents only cover operational leaks rather than accidental releases. They do not define the extent of hazardous areas from the point of view of explosion and fire risk. Alongside UK legislation, EN ISO 13702 [2.5] also addresses the need to develop a fire and explosion strategy (FES) which describes the role, essential elements and performance standards for each of the systems required to manage possible hazardous events on the installation. Guidance on the demonstration of ALARP is available throughout this Guidance and from the following sources: • Policy and Guidance on reducing http://www.hse.gov.uk/dst/alarp1.htm;
risks
to
ALARP
in
Design
[2.38],
• Principles and Guidelines to Assist HSE in its Judgement that Duty Holders Have Reduced Risk as Low as Reasonably Practicable [2.39]. http://www.hse.gov.uk/hid/spc/perm12.htm: HSE Books have published a guide which sets out an overall framework for decision taking by the HSE (“Reducing Risks, Protecting People”), which is available in hard copy form [2.40] and as a free download from http://www.hsr.gov.uk/dst/r2p2.pdf: HSE guidance relating to Gas Turbine enclosures is relevant as the principles mentioned are applicable to explosions in general: • ‘Control of Risks at Gas Turbines Used for Power Generation’, Guidance Note PM84 HSE, [2.41]. Further details on legislation, standards and guidance can be found in Annex C.
2.6 Inherently safer design 2.6.1 Introduction Having determined the installation concept it is necessary to manage fire and explosion risk within the constraints imposed by the subsequent offshore layout. The advantage of an inherently safer design or the ‘Inherent Safety’ design approach is that it attempts to remove the potential for hazards to arise. It does not rely on control measures, systems or human intervention to protect personnel. All control systems have the potential for failure to operate as intended – generally expressed as the probability of failure on demand. Critical loops are designed according to their criticality in mitigating personal, environmental or commercial risk by setting a Safety Integrity Level (SIL). In setting a SIL it is acknowledged that there is failure potential although this is designed to be inversely proportional to the importance of the loop in risk mitigation.
152-RP-48 Rev 02, Feb 2006
Page 31 of 261
fireandblast.com There is always the potential for the systems to be damaged in a hazardous event. Inherent safety avoids this potential by aiming for prevention rather than protection and the preference for passive protection over active systems. It is particularly important to follow Inherently Safer Design principles where the consequences of process release or system failure are high. Where it is possible to reduce the reliance on engineered (active or passive) safety systems or operational procedures this should be done. The Inherently safer design approach is contrasted with the process design spiral in Figure 2-1 . The result of the application of the Inherently Safer Design approach is reduced complexity and a reduced requirement for human intervention, resulting in a simpler more robust system.
152-RP-48 Rev 02, Feb 2006
Page 32 of 261
fireandblast.com Enhanced Monitoring Requirement
More Complexity more leak sources
More Maintenance Intervention
Duplication to increase redundancy
More Instrumentation Automation More Safety Systems
Process Design Spiral Reduced Monitoring Requirement Less instrumentation Less Automation Reduced Complexity fewer leak sources Reduction reduced inventories Less Maintenance Less Intervention Attenuation Substitution Increased Robustness
Inherently safer Design Cycle Figure 2-1 Comparison between the process design spiral and the inherently safer design cycle
2.6.2 Goals of inherently safer design The goals of inherently safer design [2.42] are to avoid the hazard and maintain safe conditions through inherent and, where appropriate, passive design features; and to minimise the sensitivity of the plant to potential faults as far as can be reasonably achieved.
152-RP-48 Rev 02, Feb 2006
Page 33 of 261
fireandblast.com This implies that the plant response to the fault should satisfy the following criteria in order: • The response produces no operational response or results in a move to a safer condition; • Passive or engineered safeguards should be continuously available and should make the plant safe; • Active engineered safeguards activated in response to the fault should make the plant safe.
2.6.3 Approaches to achieve the goals of inherently safer design In Inherently Safer Design the following processes are commonly employed [2.43]: • Reduction – reducing the hazardous inventories or the frequency or duration of exposure; • Substitution – substituting hazardous materials with less hazardous ones; • Attenuation – using the hazardous materials or processes in a way that limits their hazard potential, e.g. storage at lower temperature or pressure; • Simplification – making the plant and process simpler to design, build and operate hence less prone to equipment, control failure and human error. The application of the above principles should result in: • Fewer and smaller hazards; • Fewer causes; • Reduced severity; • Fewer consequences; • More effective management of residual risk. In order to implement the principles, contributions will be required from all levels of the project team. Managers should show leadership in the focus on safety, discipline engineers will be involved in concept choice, plant layout, and engineering detail and safety specialists must make the options visible and available to designers and document the process.
152-RP-48 Rev 02, Feb 2006
Page 34 of 261
fireandblast.com Table 2-1 summarizes the major ‘inherent safety’ and control features necessary to achieve the goals stated above: Table 2-1 Inherent safety features to achieve goals Goal to minimise fire risk Benefits of good layout (including partitioning effects or not)
Minimisation of Potential Leak Sources/Release potential
Minimisation of Ignition Potential
Minimisation of POB Exposure to Fire Effects
Minimisation of Hazardous Inventory
152-RP-48 Rev 02, Feb 2006
Inherent safety features to achieve goal •
place equipment, utilities and personnel areas along a clear hazard gradient
•
where possible use as much segregation as possible to limit escalation
•
avoid congestion in process areas
•
place safety critical equipment in uncongested areas where possible (limits vulnerability to high explosion loads)
•
use height between floors to provide ventilation space (cheap volume)
•
identify measures required by fire and explosions and balance benefits from measures for each hazard category
•
minimise number of pipe joints
•
maximise welded pipe joints
•
minimise invasive instrumentation
•
eliminate/minimise small bore pipework
•
minimise offshore processing and process complexity
•
minimise vibration
•
minimise corrosion/erosion
•
ensure effective inspection
•
ensure there are no naked flames in live plant
•
audit and review safety management system with respect to hot work procedures
•
insulate hot surfaces (where inspection is not critical)
•
ensure effective earth bonding
•
implement hazardous area zoning (area classification)
•
ensure an effective maintenance regime
•
separate quarters and non-operational personnel from process areas
•
minimise maintenance requirements
•
remote operation of processes
•
simplify the offshore process
•
introduce separate accommodation platforms
•
use fully rated fire barriers and protect non-redundant primary structure
•
provide multiple escape routes from each hazardous area
•
introduce structural redundancy
•
simplification/minimisation of offshore processing
•
use of small isolatable inventories
•
effect isolation from large inventories upon gas/leak detection
•
ensure effective blowdown of inventories
Page 35 of 261
fireandblast.com Goal to minimise fire risk Minimisation of potential release mass and severity of consequences
Monitoring and maintenance of SCE integrity/functionality
Maintain Effective Management of residual risk
Inherent safety features to achieve goal •
minimise inventory pressure and potential leak rate
•
minimise hazardous inventory
•
minimise module size, segregation of release sites from ignition sources and personnel – compartmentalisation
•
Minimise congestion and the possibility of obstructed fires
•
Improve natural ventilation (to reduce ignition probability, avoid re-circulation and external flaming)
•
Consider the use of subsea completions
•
implement an effective inspection programme
•
introduce effective maintenance procedures
•
minimise the exposure of the TR and SCEs to smoke and heat
•
improve SCEs resistance to thermal effects
•
protect SCEs from severe vibration effects
•
protect SCEs from structural displacement effects
•
separate process areas from critical non-hazardous areas
•
safety leadership and focus
•
implement an effective safety management system
•
pursue prevention rather than protection
•
use passive systems of control and mitigation in preference to active systems
The above table details inherent safety and control features that minimise the potential for fires to occur, or if a fire should occur, that minimise the consequences and risk to personnel. These features should ideally be built into the early design of the installation, rather than being included as mitigation measures at a later date. Inherent safety practices must be maintained throughout the life of the installation continuing through the operational phase by adherence to effective inspection and maintenance regimes and by ensuring that management systems and related procedures are followed. The benefits of the inherently safer design approach are that hazards and risks are tackled at source. There is an opportunity for cost effective risk reduction (at an early project phase). The approach will normally result in easier and more reliable plant and often results in reduced through life costs.
2.6.4 Effective management of residual risk The risk which cannot be eliminated or prevented by the application of inherent safety methods is referred to as residual risk. Inherent safety methods can also be applied to the management of the residual risk by consideration of the general principles indicated below: CONTROL is better than MITIGATION is better than EMERGENCY RESPONSE. As regards systems to reduce risk; PASSIVE systems are more reliable than ACTIVE systems are more reliable than OPERATIONAL systems are more dependable than EXTERNAL systems 152-RP-48 Rev 02, Feb 2006
Page 36 of 261
fireandblast.com
This indicates that the use of passive rather than active control and mitigation systems is preferred and that reliance should not be placed on personnel to prevent, control or mitigate hazards if avoidable. This process is illustrated in Figure 2 - 2 below.
Understand Hazards
Cause & Likelihood
Severity
Escalation
Exposure
M inimise each at source Strategy ?
Prevent Control M itigate Evacuate
System Choice?
Passive Active Operational External
System Performance?
Role, Functionality, Criticality, Survivability
Risk
No
Is it good enough?
Yes Proceed with Detailed Design
Figure 2 - 2 Risk Reduction Flowchart
2.6.5 Constraints and limitations of inherent safety Ideally the inherently safer design approach should be applied throughout the project duration and continue throughout the life of the installation. At the concept choice stage the selection of a safer concept should be paramount. At the preliminary engineering phase layout should be designed with the intention of reducing the severity and consequences of major hazards. At the detailed engineering stage systems should be designed to reduce the likelihood and severity of the hazard. If the method is not applied from the start then it may not be possible, cost effective or effective in risk reduction terms to modify the plant to conform to the ideals of inherently safer design. Intervention may give rise to an additional hazard which must be assessed and should not compromise the gains to be achieved by the modifications.
152-RP-48 Rev 02, Feb 2006
Page 37 of 261
fireandblast.com It may not be reasonably practicable to apply retrospectively to existing plant, what may be demanded by reducing risks to ALARP for a new plant and what may have become good practice for every new plant. The overall individual risk and the TR impairment frequency (TRIF) from all hazards must still be less than 10-3 per year. If risks are in this intolerable region then risk reduction measures must be implemented, irrespective of cost. There may be some conflict between the various approaches employed to improve inherent safety. For example, increased compartmentalisation will generally reduce the size of a potential ignitable gas cloud and the number of potential ignition sources, however this may decrease the potential for natural ventilation, increase confinement and give rise to obstructed or ventilation limited fires. The balance between such features needs to be considered. Corrosion under insulation is a major cause of line failure and high operational cost; hence insulation may be inappropriate as an ignition source reduction measure and as a process protection measure. Insulation may actually increase the temperature of enclosed inventory or the surfaces being protected. There will also be a balance to be struck between reduced complexity and redundancy/duplication of systems. Economic requirements may make such duplication necessary and may actually reduce the required intervention. Whilst it is generally beneficial to reduce in-line instrumentation, instrumentation associated with autonomous systems such as deluge and leak detection systems should not contribute to the likelihood of a release and hence this instrumentation is bound to be beneficial, unless the maintenance requirements and instrumentation failure consequences increase the risk. A strict adherence to the principles of inherently safer design may, in some circumstances, increase the overall risk.
2.7 Risk screening 2.7.1 General The higher the life safety risk (or risk to life) on an installation or within a compartment/module the greater should be the rigor that is employed to understand and reduce that risk. Where the risk associated with an outcome is low, any inaccuracies in determining that risk will also be low in absolute terms. The effort expended should be proportional to the risk. It is important therefore to have a means of early estimation of the risk level of an installation to determine the appropriate approach to be used in installation fire assessment. The approach to fire assessment needs to be decided early in the design process when absolute values for release frequency and detailed consequence analysis are not available. Risk is the product of consequence and frequency of occurrence. This risk can be calculated as a numerical value expressed as individual risk (IR) or in terms of a value for the installation such as Potential Loss of Life (PLL). Where quantitative values are not available a qualitative measure of risk can be estimated to a degree of accuracy sufficient to make a decision on the assessment approach to be adopted. Likelihood is a more appropriate term in this context where a qualitative assessment is being performed, the terms probability and frequency imply that numerical values are available. At a later stage in a design project a 5 x 5 risk matrix may be appropriate for risk acceptance. However at an early project phase the increased number of boundaries between consequence and likelihood classes may be difficult to identify and assign. 152-RP-48 Rev 02, Feb 2006
Page 38 of 261
fireandblast.com A simple approach which is frequently adopted for qualitative risk assessment uses a 3 x 3 matrix of potential consequence versus likelihood of a fire event is described in this section.
2.7.2 Consequence severity The consequence side of the matrix comprises an assessment of the effects of credible fire scenarios including escalation. A major risk lies in effects such as oxygen depletion and radiation from flames and the emission of hot gases. It is more likely that the major consequences will involve escalation, such as: • Fires resulting from loss of inventory from damaged equipment, supports, pipework and vessels; • Structural failure; • Inaccessibility of means of escape and/or evacuation. For a long duration fire there is a risk to those who attempt to tackle the fire. For the installation under consideration the direct and indirect effects of fires should be identified. This should be achieved by assessing parameters such as: • The vulnerability of Safety Critical Elements to thermal loads; • Occupancy of the area immediately affected; • Vulnerability of people in adjacent areas; • The relative location of the TR; • The suitability of the layout; • Hazardous inventories, both isolatable and non-isolatable; • The operating and control philosophy influences the extent of operator intervention and the potential for human error and inventory loss. Low consequence outcomes would be predicted where the radiation levels are predicted to be relatively low and immediate and delayed consequences are also low. The fire extent and duration may also be predicted to be small. The equipment count would probably be low, being limited to wellheads and manifold with no vessels (i.e. no associated process pipework) resulting in low inventory and congestion. Segregation should separate release sites, people and ignition sources with low confinement and good access. Manning would be consistent with a normally unattended installation with a low attendance frequency, for example, visiting less frequently than 6-week intervals, such visiting intervals by maintenance or intervention crews, results in an occupancy rate of about 1 %. A medium consequence installation would be typically a platform or compartment which is well segregated with a low manning level consistent with a normally unattended installation. Congestion, typified by the amount of equipment installed, will be greater than for the low consequence case. Manning would be consistent with a normally unattended installation with a moderate attendance frequency, more frequent than 6-weekly. Alternatively, a medium consequence installation may be a processing platform necessitating permanent manning but with low escalation potential to quarters, utilities and control areas which are located on a separate structure.
152-RP-48 Rev 02, Feb 2006
Page 39 of 261
fireandblast.com A high consequence installation would encompass remaining installations and compartments where there is significant processing on board leading to significant congestion (high equipment count) and potential confinement with populated areas within the consequence range of escalation scenarios. This may typically be characterised by a PDUQ/PUQ installation (jacket, semi-sub, jack-up or F(P)SO) with quarters on the same structure as the process. Where there is doubt regarding the category into which an installation should fall, it is recommended that the category with next higher consequence is used.
2.7.3 Likelihood The likelihood of a significant fire will depend upon the likelihood of occurrence of a large release and ignition. The following parameters will influence the potential likelihood of a fire: • Hazardous inventory complexity, i.e. the number of flanges, valves, compressors and other potential leak sources; • The type of flanges, valves or pipework. Some generic types of flange tend to have lower leak frequencies associated with them, e.g. hub type flanges; • The number of ignition sources within the flammable region of a potential spray release, gas or vapour cloud; • The ventilation regime; • The equipment reliability and the maintenance philosophy. The likelihood considerations tend to align closely with the consequence factors in that the low consequence installations will tend to be small and therefore less complex. Large installations will have more potential leak and ignition sources and therefore a greater requirement for intervention and maintenance. Low event-likelihood installations and compartments will have a low equipment count. The frequency intervention period of 6 weeks or more is also recommended as a criterion as this will be a surrogate for equipment count and reliability as well as a measure of maintenance risk with respect to an ignited release. Medium event-likelihood is suggested by an NUI with equipment count greater than for the ‘low’ case. Similarly, where the planned frequency of maintenance/intervention is greater than a 6weekly basis then this suggests a higher or less reliable class of equipment with medium level of potential for an ignited release. Where the complexity of the process in a compartment requires a permanently manned installation this suggests a high equipment level, high congestion and therefore potentially a fire event of high likelihood, a large number of potential leak sources and high ignition potential. Where there is doubt regarding the category into which an installation should fall, it is recommended the category with next higher likelihood is used.
2.7.4 The risk matrix Continuing with the Low, Medium and High basis, the risk categories can be assigned for the installation is assigned using a 3 x 3 risk matrix, as shown below:
152-RP-48 Rev 02, Feb 2006
Page 40 of 261
fireandblast.com Consequence Low
Medium
High
Medium risk
High risk
High risk
Medium
Low risk
Medium risk
High risk
Low
Low risk
Low risk
Medium risk
High Frequency/ Likelihood
Figure 2-3 Risk matrix – determination of risk category The risk category determines the level of sophistication required for the assessment (low, medium or high). Levels of structural analysis are discussed in Section 3.7. The level of risk screening discussed above is scenario independent. The risk level for each scenario may be made using the risk matrix if representative ranges of frequency and severity can be attached to the likelihood and consequence categories.
2.8 Risk reduction Risk management and reduction is an integral part of the Health, Safety and Environmental Management System (HSEMS) of any organisation or project. The HSEMS provides the overall framework within which all risks (not just fire related) should be managed. To assess and manage the risks arising from a specific operation especially with respect to a specific hazard category it is necessary to recognise the requirements of the HSEMS on the risk management process (e.g. in determining acceptable levels of risk) and to implement the processes that contribute to the risk management. As part of the processes contributing to risk management, an assessment and implementation programme for dealing with risk reduction measures should be in place. The risk reduction measures include preventative measures (i.e. likelihood reducing) and mitigation measures (i.e. consequence reducing). The detailed definition and specification of these measures form significant components of design codes and standards. Where appropriate, risks can also be significantly reduced by the adoption of inherently safe designs as discussed in Section 2.6. In identifying candidate risk reduction measures, consideration should be given to the full range of measures involving inherently safer design, prevention, detection, control and mitigation. The risk reduction measures considered may range from items of equipment and physical systems through to operational procedures, managerial structures and planning. It is worth emphasising that the UK regulator will expect to see the following demonstrations for risks lying below the maximum tolerable, but above the broadly acceptable level: • That the nature and level of the risks are properly assessed and the results used to determine control measures; • That residual risks are not unduly high and have been kept ALARP; • That the risks are periodically reviewed to ensure that they still meet the ALARP criteria. Duty holders should not assume that if risks are below the maximum tolerable level, they are also ALARP. This should be demonstrated through the application of relevant good practice and sound engineering judgement; and the consideration of further measures that can be adopted to reduce risks to ALARP. The degree of rigour of the ALARP demonstration should also be proportionate to the level of risk associated with that hazard category on that installation. 152-RP-48 Rev 02, Feb 2006
Page 41 of 261
fireandblast.com A number of example risk reduction measures that have been used in submitted safety cases (data collected up to 2001) has been tabulated in the HSE publication, “Fire, Explosion and Risk Assessment Topic Guidance”, Issue 1, February 2003. This table is reproduced below. For full document see http://www.hse.gov.uk/foi/internalops/hid/manuals/pmtech12.pdf Table 2-2 Examples of risk reduction measures implemented on existing installations Type of measure Prevention (i.e. reduction of likelihood)
Description of measure Leak prevention 1. Removal or strengthening of small bore pipework connections 2. Isolation of disused wells at production header as well as Xmas tree and venting of flow lines back to tree 3. Decommissioning of redundant equipment 4. Improvements to systems of work 5. Implementation of competence management and assurance system 6. Improvements to PTW system 7. Improvements in integrity assurance Ventilation 8. 9.
Removal of wind walls Enhancement of HVAC in process modules
Ignition control 10. Monitoring of gas turbine exhaust system temperature Detection (i.e. transmission of information to control point)
Control (i.e. limitation of scale, intensity and duration)
Gas detection 11. Installation of ultrasonic leak detectors 12. Installation of additional IR beam detectors Fire detection 13. Installation of additional fire detectors Emergency shutdown (ESD) systems 14. Installation of high integrity check valve on gas re-injection header Blowdown and flare systems 15. Installation of additional blowdown valves Explosion control 16. Initiation of water deluge on detection of gas 17. Removal of redundant equipment
Mitigation (i.e. protection from effects)
Active fire protection – Replacement of deluge system piping Passive fire protection – Uprating of fire walls Blast protection – Uprating of blast walls Temporary Refuge – Re-location of Main Control Room to TR – Re-definition of TR – Enhancement of mustering facilities – Protection of external staircase – Provision of airlock doors – Provision of dedicated HVAC system for TR Evacuation and escape – Installation of additional emergency lighting on escape route – Provision and maintenance of proper training in the use of evacuation and escape facilities – Provision of alternative escape routes
152-RP-48 Rev 02, Feb 2006
Page 42 of 261
fireandblast.com Type of measure Mitigation (i.e. protection from effects) contd.
Description of measure Fire-fighting equipment – Installation of new foam monitors Manning – Reduction of POB
2.9 Human factors The influence of Human Factors in the control of and response to fire hazards and fire hazard management systems is significant and must be considered in the assessment of hazards and the design of control and mitigation systems. The Human Factors issues covered within this guidance document summarise two areas of application; reference should be made to Section 6.7 “Personnel”, covering the impact of fires on people and Section 7.4 for “Human Factors - Man/Machine Interface”. The response of personnel to fires covers the effects of heat, radiation, smoke and other toxic or debilitating products of combustion. These issues are discussed in detail in Section 6.7 along with a summary of the timeline of the harm criteria that develop along with the escalating hazard. The ability of the workforce to safely and effectively manage and maintain the detection and mitigation systems for fire hazards is described in more detail in Section 7.4. The considered design of the man machine interface for these safety critical systems is a major contributor to success in meeting a hazard. The issues of ergonomics, working environment and clarity of supplied information are discussed along with some indications of appropriate analysis techniques to assist the designers and operators.
152-RP-48 Rev 02, Feb 2006
Page 43 of 261
fireandblast.com
3. Fires on offshore installations 3.1 Introduction In order to successfully implement the appropriate protective mechanisms for fire hazards, it is essential (and obvious) to understand what element or area is being protected and what event the designer is protecting against. Therefore, the protective measures can only ever be effective when an assessment is carried out of the potential fire hazards. This step is required by the fire and explosion risk analyses (FERA). Some preliminary guidance on describing the unfolding scenarios is given in the following sections.
3.2 Fire types and scenarios 3.2.1 Release events To establish which fire scenarios should be considered as part of a QRA of an installation, it is first necessary to consider the range of incidents that may lead to an uncontrolled release of flammable material which, if ignited, would give rise to a fire. In this context, relevant questions concerning potential release scenarios are: • WHY did the release occur? • WHAT is released? • WHERE did it occur? The answers to these questions combine to determine the type of fire that may result, the likely size of the fire and its potential impact on people and the installation. Considering each in turn: WHY: The answer to this question will establish the size of the leak and influence the likelihood of ignition. For example, has the leak occurred due to a leaking flange joint or as a result of a preceding explosion event? A range of sizes should be considered from small leaks at flanges and fittings up to major failures of vessels and risers which result in very high release rates. The leak rate may also change with time and may have a limited duration. Failure frequencies for different sizes of event should be taken into account; generally small leaks will be the most common. Release failures should be based on platform specific information where possible, and Duty Holders are encouraged to collect, analyse and use failure rate data based on their own maintenance systems and practices. The reason why a failure is being considered may also influence the likelihood of ignition, for example, if a vessel failure is being considered as a result of a preceding explosion or fire attack then ignition is almost certain, whereas a small leak of high pressure gas generated as a result of a leaking flange may not interact with a potential ignition source. Ignition probabilities also depend on fuel type, for example, a spillage of diesel onto a cold surface is not readily ignited. WHAT: The nature of substance being released will also influence the type of fire that results. A non-volatile liquid spillage may result in a pool fire whereas a high pressure gas release may produce a jet fire. Apart from process fluids, other flammable substances are likely to be stored and used on an installation for use in service roles. Potential fluids to be considered are: • Natural Gas – dry or containing condensate and/or water; • Condensate – unstable or stabilized; • Live crude –possible including a significant amount of water; 152-RP-48 Rev 02, Feb 2006
Page 44 of 261
fireandblast.com • Transport fuels - Aviation fuel, Diesel; • Process fluids – Methanol, Ethylene Glycol; • Lubricants and hydraulic fluids. In addition, some of the gas and oil streams may include hydrogen sulphide, which may require special consideration because of its potential to produce toxic products or be toxic if unignited. WHERE: Where the leak occurs will also influence the type of fire that results. In particular, is the fire likely to be in an open or confined area and what is the potential for the fire to impact onto pipework or vessels that may also contain flammable material, or indeed other critical targets (e.g. other safety critical elements, control systems etc.)? The latter question is important with regard to the potential for incident escalation. Some fires may occur at a location away from the source of the leak, for example, liquid spills which may spread to other areas or even spill onto the sea. The location of the fire will also influence its likely consequences; hence fire scenarios at a range of key locations should be addressed in the QRA. In particular, fires that are close to where people work, which could affect escape routes, Safety Critical Equipment, the Temporary Refuge or key structural components. Having selected and defined a release event giving rise to a fire, this fire and its effects may well change and develop with time depending on the prevailing circumstances. The following factors may affect fire behaviour and/or the consequences: • ESD: Assuming the ESD operates the volume of the isolatable volumes will affect the duration of the larger leak scenarios and result in a transient fire size, reducing with time. • Blow-down: Similar to ESD operation, this could result in a transient release rate. Additionally, blow-down may reduce the consequences of the fire scenario by depressurising a vessel or pipework onto which a fire is impacting, thereby preventing escalation. • Confinement: Fires in confined areas with limited ventilation may change over time, for example, become progressively more severe as ‘external flaming’ occurs, when the fire moves through the ventilation openings. • PFP: The use of passive fire protection may not affect the nature of the fire but will affect the response of objects subjected to fire attack and delay or prevent incident escalation. • Deluge: Depending on the fire type, active water deluge systems (area and dedicated) may affect both the nature of fire and the thermal loading to engulfed objects and in most cases will be beneficial to escaping personnel.
3.2.2 Ignition The likelihood of ignition is clearly an important factor to consider for any QRA and will also be dependent on the answers to the WHY, WHAT, WHERE questions above. Some fuels are more easily ignited than others and the manner of spillage may affect its flammability (for example oil spills onto the sea are often not readily ignitable and additionally are likely to be distant from common ignition sources on an offshore installation. Ignition sources such as electrical fault, electrical arcs (for example across switch contacts), sparks, high temperature surfaces, flames and electrostatic discharge should be considered and the proximity of such sources will vary at different locations on an installation (see also Section 2.2.4)
152-RP-48 Rev 02, Feb 2006
Page 45 of 261
fireandblast.com
3.2.3 Fire scenarios Given that ignition has occurred, the answers to the WHY, WHAT, WHERE questions above also determine the nature of the initial fire and how the fire may subsequently develop. Typical answers to these questions include:
WHY 1.
2.
WHAT
WHERE
Leaking flange, small fitting or valve
High pressure gas
In open module in open area or congested region
Pipework failure from impact or corrosion or preceding event
Pressurised volatile liquid
In confined area
Pressurised gas/liquid mixture
Spillage onto sea
Non pressurised, non volatile liquid
From subsea source
3.
Equipment failure
4.
Vessel rupture or collapse following explosion, structural collapse or fire event
By considering combinations of these answers the fire type can be determined. Further detail of this interrogation process can be found in Sections 2.2.3 and 2.2.5. Three examples are as follows:
WHY
WHAT
WHERE
FIRE TYPE
1
Leaking flange joint
High pressure natural gas
In an open sided module
Jet fire with potential impact onto pipework and vessels
2
Fire attack on pressurised vessel leading to failure
Gas and volatile liquids
On the installation
BLEVE - fireball
3
Storage vessel failure
Non-volatile liquid
On the installation but liquid spills onto sea
Potential pool fire on the sea
Considering a range of generic cases, such as those above, the following six fire types are proposed: 1.
Gas Jet Fire – originating from a pressurised gas release on the installation.
2. Two-Phase Jet Fire – originating from a pressurised release of a flashing liquid or a gas/liquid mixture on the installation. 3. Pool Fire on the Installation – originating from a liquid spillage. May be static or running depending on the drainage paths or bunding around the source. 4. Pool Fires on the Sea – originating from a spillage on the installation falling onto the sea, or failure of a sub-sea liquid pipeline. 152-RP-48 Rev 02, Feb 2006
Page 46 of 261
fireandblast.com 5. Gas Fires on the Sea – originating from failure of a sub-sea gas pipeline. 6. BLEVE – originating as a result of catastrophic failure of a pressurised vessel containing a volatile liquid. It should be noted that the behaviour of these fires may change with time as noted in Section 3.2, for example, due to the effect of ESD, confinement or deluge. The nature of these fires and their behaviour when interacting with confinement and/or deluge is considered in further detail in Section 5.2 “Fire characteristics and combustion effects”. The fire and smoke loadings, issues concerning heat transfer and other details more detail of the fire types are discussed in Section 5.3, 5.4 and 5.5.
3.2.4 Transition between fire scenarios As discussed above, some fire scenarios may change with time, for example, a fire occurring in a confined space may lead to increasing fire severity with time and the movement of the flame through the vent may produce external flaming. Similarly, some fire scenarios may lead to incident escalation and result in a different fire event occurring as a direct consequence, for example, a jet fire impacting onto a pressurised vessel may lead to vessel failure and a BLEVE fireball event. A liquid spillage may start as a pool fire on the installation but drainage of the spill may ultimately lead to a pool fire on the sea. Therefore, it is important that a QRA considers the potential sequence of fire events and that a fully representative set of events is analysed. The QRA should be supported by a thorough HAZID with input from people with experience of the existing or similar plant or processes.
3.3 Fire prevention methods 3.3.1 General The principals of Fire Hazard Management promote a four-part strategy for dealing with the fire hazard, when that hazard cannot be eliminated by inherent safety approaches (see Section 2.6). In order of priority, the remaining steps of the strategy seek to: 5.
Prevent or minimise fires at source
6.
Detect fires early
7.
Control fires
8.
Mitigate against effect of fires
Sections 3.3 to 3.5 give an outline of the methods available in each of these four categories. In reality almost every offshore installation employs a mixture of all four methods. Good design seeks out the best mix of prevention, detection, control and mitigation methodologies for the specific fire scenarios associated with an installation. There are opportunities throughout the design of any installation to minimise the fire hazard using the four strategies above. Every engineering discipline involved in the design process should be aware of the interaction between their specific discipline input and the fire hazard management for the installation. It is the responsibility of the safety engineer in conjunction with the project manager to engage all the engineers in discussion of fire hazards from an early stage so that no costeffective opportunities for improvement are missed. This section outlines the options available for preventing or minimising the fire event at source. Sections 3.4 and 3.5 cover the various options for detection, control and mitigation of fire events once they have already occurred. 152-RP-48 Rev 02, Feb 2006
Page 47 of 261
fireandblast.com
3.3.2 Methods of fire prevention or minimisation at source Given that the principal role of oil and gas installations is to produce large quantities of hydrocarbons, complete removal of the fuel source not an option. However there are opportunities for the designers to minimise the potential for large releases of fuel. These are described in the following sections.
3.3.3 Minimise inventories The biggest inventories are in the reservoir, the pipelines attached to the installations and the process vessels. Engineers need to be briefed to consider minimisation of release potential in addition to consideration of production maximisation and cost. They should aim to: •
Minimise inventories between the wellhead and downhole valves;
•
Provide suitably located topsides and subsea isolation valves on all import and export pipelines. Any non-provision of subsea isolation must be thoroughly justified. Justifications must consider all lifecycle phases (especially for NUIs);
•
Size pipelines, vessels and other process equipment to minimise inventory loss in a leak situation as well as meet process requirements;
•
Provide adequate automatic isolation throughout the process system, backed up where necessary with accessible manual isolation valves;
•
Minimise on-platform storage wherever feasible.
3.3.4 Optimise layout Good layout is essential to the overall safety of the installation. Where separation of people from hazardous areas is not possible, provide protection by segregation behind firewalls and attention to escape/egress routes. Key points are: •
Keep living quarters and evacuation facilities away from the process;
•
Provide diverse egress routes from modules and access platforms/decks back to the TR or provide a suitable protected muster point (PMP);
•
Provide grated deck in process areas to reduce pool fire risks;
•
Wherever possible hydrocarbon containing vessels should be bunded and connected to hazardous drains or vents or flare systems designed to remove flammable liquids from the vessel;
•
Ensure that the hazardous drain arrangements are capable of handling releases from the single largest vessel or source based on the range of reasonably foreseeable events;
•
Locate risers as far as possible from the TR & evacuation point;
•
Locate risers and riser valves where other fires or fire escalation cannot affect them;
•
Review the locations and orientations of flanged joints to minimise the location of targets (SCEs or other flammable inventories) within the range of small and escalating jet fires;
•
Small platforms such as Southern North Sea gas platforms cannot provide separation by distance therefore immediate safe egress/escape provision plus sheltered evacuation points are crucial for safety of personnel.
3.3.5 Minimise the potential for loss of containment events •
Minimise the number of potential leak points in the design, particularly flanges and instrumentation connections. However enough valves need to be left to provide for
152-RP-48 Rev 02, Feb 2006
Page 48 of 261
fireandblast.com safe isolation for intrusive maintenance. Use of newer design of equipment such as high integrity flanges, valves with integral block and bleed and inherently safer wellheads should be considered. •
Design for future sand erosion and corrosion by providing for ease of detection, monitoring and replacement.
•
Where facilities and access for routine test and maintenance are not provided on the understanding that such work will only be done during shutdowns, this should be highlighted on drawings and in manuals.
•
Where emergency manual isolation is provided, make sure it is documented in emergency response plans, unambiguously labelled in the field and accessible in the relevant fire scenarios.
3.3.6 Providing an inert or non-flammable environment •
Determine the degree of containment to confirm whether an inert atmosphere is achievable in the specific application, for example: o Completely contained within a pressurised vessel; o Completely contained but within an open vented atmospheric vessel/tank.
•
Determine the required supply of inerting medium, e.g. the degree of inflow and outflow required for all operating conditions, for example offloading requirements or inerting an area with opening/closing doors (such as filling a Temporary Refuge with lower oxygen content media, see next bullet point).
•
Review the non-flammable media available for application, considering the use of the areas and volumetric flow rate requirements, the media may include: o Nitrogen; o Over-rich (i.e. above Upper Flammable Limit) fuel gas; o Cleaned combustion gas; o Low oxygen content media (such as Inergen, a proprietary product with insufficient oxygen to support combustion but adequate oxygen content to maintain life); o Carbon dioxide.
•
Consider the preferred delivery option, whether the media can be generated on the installation (e.g. Nitrogen Generator) or whether it is desirable to be brought on board.
•
Review the media for their own hazardous effects in the context of the potential applications. Avoid all but the lower oxygen content media in areas where personnel without breathing apparatus may be, ensuring that the lower oxygen content media are suitable for occupied areas. Identify any time limits on occupancy or minimum health and fitness criteria with the media supplier.
•
Confirm that the layout does not contribute to or exacerbate migration of the media to sensitive areas, for example carbon dioxide being heavier than air will flow down hill, therefore, recessed areas for valve or equipment access could capture the CO2, especially where personnel could access as part of recovery work after the emergency.
3.3.7 Minimise the time to ESD and blowdown •
ESD should be designed to occur immediately on detection of a release event. ESD should move the plant to a safer state. Designers need to check whether the ESDV locations minimise ignited release consequences rather than just reducing leak size.
152-RP-48 Rev 02, Feb 2006
Page 49 of 261
fireandblast.com •
Rapid blowdown or draining of topsides process inventories in order to prevent escalation of a fire situation should be provided - unless there are specific good reasons for not doing so (e.g. very small topsides process).
•
The code-based design approach of providing blowdown to 7 barg or half design pressure in 15 minutes should no longer be automatically assumed adequate. Blowdown should be designed in the light of the specific escalation times for each fire scenario and generally be as fast as feasible once activated, (see Sections 6.6.4 and 6.6.5 for more details on blowdown systems).
•
Where only a manual blowdown capability has been used – the designer and Duty Holder must justify the choice of system with respect to the identified major accident hazards, the design and operating philosophy must be clearly recorded for the intended user and all operational and maintenance details must be documented or referred to in the emergency response instructions for the installation.
•
Blowdown must be to a safe location with respect to personnel, bearing in mind the likelihood of spurious blowdown events as well as real emergency events, and designed such that the heat radiation for maximum foreseeable flaring (or ignited venting) rate does not pose a hazard to escape and evacuation.
3.3.8 Minimise ignition sources. •
All electrical equipment in hazardous areas shall be certified. This is to cater for ‘fugitive’ leaks in accordance with hazardous area design codes.
•
The dispersion distances for such leaks, from which the hazardous zones are calculated, do not cater for major accident releases.
•
A gas cloud from a medium or large leak can, and will, drift outside hazardous area limits. Therefore caution must be exercised in locating unclassified equipment such as generator sets, temporary pump skids, heating equipment etc in ‘safe’ open locations around the installation.
•
The ignition-prevention philosophy for the platform should explain how the ignition risk is minimised.
•
Plant should be suitably earthed and all operators trained in awareness of offshore static spark risks (a recurring cause of fires).
•
Equipment which provides an ignition source and is unacceptably close to release sources should either be located inside an enclosure with ventilation ducts that close off automatically on detection of gas, or be provided with some alternative form of protection.
Certified electro-mechanical equipment (e.g. diesel generators) requires careful maintenance in order to retain its certification and is a significant operating expense.
3.4 Gas and fire detection and control methods 3.4.1 Detection of loss of containment events 3.4.1.1 Overview of gas detection options Early detection of loss of containment events is crucial. Detection should always trigger limitation of the leak by rapid automatic isolation it should simultaneously alert personnel to the danger. Since it is difficult to automatically detect liquid oil leaks (although oil mist detectors can detect higher pressure liquid leaks), historically reliance has been placed on detection of the associated gas. Most installations have hundreds of sensitive detectors in place. In order to prevent spurious shutdowns and un-necessary platform alerts, most installations have a two-tier alert system. 152-RP-48 Rev 02, Feb 2006
Page 50 of 261
fireandblast.com Typically, under this system, a single low-gas-level alarm alerts staff in the control room to a potential problem, which is immediately investigated but no shutdown or general alarm is initiated. One single low level gas detection is more likely to be a false alarm than a real gas release. If a second alarm in the same area then occurs or if a high-gas-level alarm goes off, then this is indicative of a real release rather than a false alarm. The fire and gas system voting interprets 2 or more low-level or 1 or more high-level alarms as ‘confirmed’ gas releases. This automatically initiates platform alarms and shutdowns. Confirmed gas detection should always initiate immediate, appropriate executive action in the form of shutdowns and, where applicable, blowdown. Most platforms have between 2 and 5 levels of shutdown, depending on the extent of the detected release. A system which requires operations personnel to walk into a gas-release scenario in order to investigate before initiating shut down of the process system is potentially dangerous and no longer acceptable. Personnel should never be asked to enter a gas-cloud for the purposes of investigation or manual action – they may be rendered unconscious by the un-ignited gas or be engulfed in flame if the cloud suddenly ignites. Where one person is missing, more people are exposed through search and rescues attempts and the evacuation process becomes delayed. The detection system should instead be designed to give remote indication of the development and/or migration of the release thus allowing personnel to stay well away from danger. Once the fire and gas panel shows the situation is sufficiently under control then cautious, upwind approach from a position of safety can be attempted. There are many different types of gas detector available. All have their strengths and weaknesses which are explored in the table below. All installations, modern and old, use a combination of different methods in order to cover the range of duties necessary. The approach to the detection of flammable gas has moved away from trying to detect all leaks and now concentrates mostly on the following three distinct criteria:1.
The detection of gas clouds of a specific size and LEL (i.e. 5 metres, 50% LEL cloud)
2.
The detection of gas leaks also of a specific size (i.e. 0.1kg s-1 to 2.5 kg s-1)
3.
The detection of gas at the HVAC intakes to areas containing potential sources of ignition (TR, turbine enclosures, etc)
The basis for the specific cloud size and gas leak size are established by specialist analysis/modelling of the areas. The systems are generally not concerned with the detection of fugitive gas leaks, except in some special cases. Performance standards are used to set the initial design conditions to be met by the various detectors (see Section 3.6).
152-RP-48 Rev 02, Feb 2006
Page 51 of 261
fireandblast.com Table 3-1 Summary of methods of gas detection Method of Gas Detection
Strengths
Weaknesses
Single point Pellistors These detect the presence of gas when it reaches a detector head. They are good at detecting accumulations of gas.
Well-understood item. Good designs should allow gas clouds to be tracked, as they drift through areas of plant, from the safety of the control room.
Susceptible to ‘poisoning’ of the catalyst by oil-spray and contact with other chemicals. Always check proposed site and contamination issues with manufacturer. They generally require a high level of maintenance due to drift, and recalibration due to poisoning, as these detectors do not automatically provide indication of a faulty pellistor. Very large numbers are required to adequately cover a typical fire zone Not preferred on new or upgraded installations.
Have historically been used for detection of gas in air supply ducts to enclosed areas containing unclassified electrical equipment or other potential sources of ignition but not recommended now IR, beam detectors available.
Location in an air intake duct is an arduous duty for this type of detector Executive action occurs on 2oo3 voting. Access for frequent maintenance and testing is essential. I/R point detector with duct probe or I/R open path detector are now available, and better, for this service. Not very effective for small leaks in open areas. In this situation use in conjunction with acoustic detectors. Susceptible to drifting if not regularly checked and maintained, leading to unnecessary shut-downs. Unless the gas comes into direct contact with the detector head it will not operate so numerous detectors, suitably located are required. Vapours heavier than air require detector location at floor level. For natural gas releases, detectors need a high level location. Must be calibrated and located appropriately for the vapours they are designed to detect. Calibration settings for LNG (methane), LPG (propane), condensate and hydrogen are all different. Heavier or lighter than air gases require increased numbers of detectors and present difficulties positioning to avoid damage at low level and maintenance access at high level.
Note: On older installations where there is heavy reliance on pellistor type detectors, consideration should be given to setting the devices to give initial (low level) alarm at a levels just above the anticipated drift range of the device and high level alarm slightly above that. Operators have found that alarm at 10 to 20% LEL and executive action at 25 to 40% is feasible for a well maintained system. This gives an added margin of safety while avoiding nuisance alarms. Different set points will be necessary for different applications. The suitability of the set point each application should be documented, and not automatically assumed to be 20% LEL for low level and 60% for high level alarm.
152-RP-48 Rev 02, Feb 2006
Page 52 of 261
fireandblast.com Method of Gas Detection
Strengths
Weaknesses
IR point detectors
Very good at detecting flammable gases at potentially known locations. Very little maintenance or calibration required during the life of the detector (in excess of 5 years). These detectors are least sensitive to methane, so when calibrated for methane will also detect other gases i.e. propane, butane etc more readily. This type of detector is good for confined areas, ducts etc (with a duct probe unit).
Not good as the prime detector type for open process areas as large numbers of detectors would be required.
IR Beam (open path) detectors. These detect the presence of a cloud of hydrocarbon gas between a detector head and its reflector
Very good at detecting gas clouds in open process areas, effectively taking the place of numerous point detectors. Very little maintenance necessary, but this can be achieved by one man with an interrogator tool. Not susceptible to poisoning. Detectors can be sited at the boundaries of modules of fire zones to provide economic coverage of large areas, providing good information on gas migration. Care should be taken when subsequent work is being carried out on the installation, when there might be the potential for blocking beams by scaffolding, sheeting for weather protection or painting.
Some early versions could be activated by adverse weather, especially rain and fog and vibration
Leak detectors (acoustic) These detect the noise made by any significant leakage from a high pressure gas (whether flammable, toxic or inert) system.
Will detect any significant leak in vicinity without contact with gas therefore large numbers of detectors not necessary. Usually only two or three detectors are required in a typical process area.
Area mapping of background noise is necessary to enable the correct alarm setting to be established. These detectors need to be located with easy access for routine testing. These detectors will detect a high pressure leak of any gas, whether hydrocarbon, air, N2, CO2 etc. Hence caution is necessary when arranging the shutdown logic and when placing the detectors, with respect to any regular discharges of air (such as near air compressors). Discussions with equipment vendors should be initiated to understand the frequency range over which the detectors will work.
152-RP-48 Rev 02, Feb 2006
Page 53 of 261
fireandblast.com Method of Gas Detection
Strengths
Note: There has been reluctance by the industry to embrace acoustic detection. It is still regarded with suspicion as ‘new technology’ despite nearly ten years of successful use in the Southern North Sea.
Concerns about spurious activations by background noise can be averted by designing in recognition of other noise signature in vicinity and possible use of pre-set time delays before alarm initiation. Initial calibration of detectors in their designated location is essential.
Manual
Personnel should always be vigilant and report small leaks for Investigation, repair and monitoring. Most small leaks are still detected manually especially on open design platforms
CCTV (see under CCTV in Table 3-2 )
Cheaper and readily fitted especially on large installations or on extensive process areas. Allows operator judgement on how to deal with the situation.
Weaknesses
Visibility of large gas releases depends on numerous process, release and atmospheric variables. Small gas releases would not generally be picked up.
3.4.1.2 Additional notes on detector types 3.4.1.2.1 Infrared detectors An infrared gas detector consists of an infrared source and an infrared detector. When flammable gas passes between the source and detector, the gas absorbs infrared radiation and lower radiation intensity is registered at the detector. Specific gases are detected by measuring the amount of absorbed infrared radiation at specific wavelengths; the difference is related to the concentration of gas present. Infrared detectors will not “poison” and can operate in inert atmospheres. They can be used in confined spaces where oxygen depletion might have otherwise limited the effectiveness of a pellistor detector. Infrared detectors are fail-safe, a detector that is obscured or has failed registers zero infrared radiation and the alarm signal is activated. IR detectors are available in either a fixedpoint format, in which the gas diffuses into the detector or in an open-path format where the source and detector are separated (thus a line of sight detector). 3.4.1.2.2 Pellistor detectors A pellistor detector consists of a matched pair of elements, one of which is an active catalytic detector and the other an inactive compensating element. Flammable gas contacting the catalytic surface of the detecting element is oxidised causing a rise in temperature of the active element, this rising temperature increases the resistance of the active element. There is no such change in the compensating element and the output signal of the detector is based on the imbalance between the two resistances. Pellistor sensors can give accurate readings under adverse environmental conditions as changes in ambient temperature, humidity or pressure will impact both elements. Pellistors can be poisoned or inhibited by silicones, sulphides, chlorine, lead and halogenated hydrocarbons. The detectors require regular cleaning and calibration, (with an impact on maintenance costs). Pellistor sensors also require the presence of oxygen in order to operate.
152-RP-48 Rev 02, Feb 2006
Page 54 of 261
fireandblast.com
3.4.2 Detection of fire events Early detection of fire is crucial. The earlier a fire can be detected the earlier personnel can be warned and steps taken, both automatic and manual for containment and control. There are many types of fire detection device available on the market. No one device covers every fire situation. The uses, locations, strengths and weaknesses of the most common types are outlined below Table 3-2 Summary of methods of fire detection Methods of Fire Detection
Strengths
Weaknesses
Ionisation Smoke detectors detect the visible and invisible products of combustion as they come into contact with the detector.
Widespread use in enclosed areas such as accommodation ceiling voids, electrical equipment and control rooms. The detectors can be wired in series with up to 20 detectors on one loop. These detectors have a high resistance to contamination and corrosion. They are available in a wide range of versions to suit different needs.
Not effective in open modules, as the smoke is usually dispersed before reaching detector. Not advised for use in areas where some smoke is expected in normal operation e.g. above cookers. Care is needed with disposal since they contain a minute radioactive source
Optical Smoke detectors detect only visible smoke and rely on the ‘light scatter’ principle
Widespread use in enclosed areas such as accommodation modules. The detectors can be wired in series with up to 20 detectors on one loop. These detectors have a high resistance to contamination and corrosion and are available in a wide range of versions to suit different needs.
Not advised for use in areas where some smoke is expected in normal operation e.g. above cookers.
Alert personnel to the incipient development of a fire situation e.g. behind instrument panels, especially in unmanned control rooms or in cable routes. These detectors are particularly suitable in areas with high air flow ventilation. The very early warning allows personnel to enter the room to investigate and/or isolate power supplies without undue exposure to risk.
These are being widely used to replace Halon systems removed from control rooms, MCC or switchrooms. They can be alarm only, or wired to the F&G control panel for executive actions and/or shutdowns. These systems are relatively high unit cost and there are additional maintenance requirements for checking and keeping air-sampling tubes clear.
Smoke Detection:
VESDA (Very Early Smoke Detection Alarm) or HSSD (High Sensitivity Smoke Detection) These pull air samples from areas susceptible to electrical fires to a small analyser and check for smoke or pre-combustion vapours.
152-RP-48 Rev 02, Feb 2006
Page 55 of 261
fireandblast.com Methods of Fire Detection
Strengths
Weaknesses
IR flame detection
Widely used and well understood. Used to detect the infra-red wavelengths of hydrocarbon flames. Typically 4 to 16 detectors would be needed to cover a module depending on module congestion and dimension.
Detect ‘yellow’ flames, but weak on bluer flames (e.g. methanol fires). Vision of units can be obscured by smoke or equipment (especially forgotten ‘temporary’ items). Often used in combination with UV detectors where several types of fire can occur in one module. Generally specialist mapping techniques are used to optimise detection and ensure adequate coverage is achieved. To avoid spurious alarms higher numbers of detectors are required to provide voted logic. Spurious alarms may occur from other, non-fire IR sources, so not suitable in areas where ‘black body radiation’ occurs.
UV flame detection
Widely used and well understood. Used to detect the Ultra-violet wavelength of a flame spectrum. Typically installed under turbine/compressor hoods.
Detect the bluer flame types. As for the infra red detectors, solid objects or smoke will obscure the cone of vision, reducing the effectiveness of the detector. The lens of each detection unit needs regular checking for dirt build-up which prevents effective operations of the device.
Video flame detector (makes use of specialist flame imaging technology)
Very good at detecting flaming fires. Sophisticated versions can be set up to mask out known flame sources e.g. platform flare. These can provide conventional alarm signals plus a video image if required. Possibly the way forward for ‘Greenfield’ projects.
Unit cost may be high but fewer units required to cover a typical process area.
Fusible bulbs
These bulbs break at a pre-defined temperature and raise an alarm/ESD. They also usually either release water directly or release air to activate deluge systems. This system does not rely on electrical power for satisfactory operation and deluge release.
A these devices require a heating effect that causes failure, dependent upon their relative location with respect to the fire, they may take significant time to detect a fire (for example compared with optical (IR/UV) detectors). By the time the bulbs operate, significant damage may have been done. The bulbs may also subject to physical damage and corrosion which could lead to false alarms. An extensive pipe network is required (linking the bulbs to the detection system) to provide coverage of full module.
Fusible links
These melt at pre-defined temperatures to raise an alarm/ESD by breaking a circuit. Some directly initiate release of hydraulic fluids to close safety valves on wells or risers.
As above for fusible bulbs.
Fusible plugs
These melt in fire situations to send an alarm signal and release hydraulic fluids thus closing well and riser safety valves.
As above for fusible bulbs.
Flame Detection
152-RP-48 Rev 02, Feb 2006
Page 56 of 261
fireandblast.com Methods of Fire Detection
Strengths
Rate of heat rise
Detects rapid temperature change. Useful in areas with temperature fluctuations. Highly reliable as a single detector, confirmed fire signal.
Rate of heat rise - Rate Compensated
Detects temperature change. Highly reliable as a single detector, confirmed fire signal
Fixed
Detects a pre-set high temperature. Based on thermocouple design. Highly reliable as a single detector, confirmed fire signal. Gaining in popularity and reducing in price with time.
Conventional CCTV used to supplement traditional fire and gas detection devices
Weaknesses
Not as fast reacting as the rate-of-rise detectors.
Systems with good coverage can be expensive to install and maintain.
Particularly good for checking alarms in remote areas such as column bases on semi-subs. Allows escape routes from TR to evacuation points to be checked and state of fire development in process areas without exposing emergency response personnel to danger.
The reliability of the fire and gas detection system needs to be designed in at the outset of design and then maintained at a high level of reliability and availability throughout the platform’s operational phase. Best practice for new designs relies on good levels of redundancy in the electronic system architecture (usually dual or triple redundancy) and will include the following characteristics: •
Electrical fault monitoring to detect any electrical discontinuity faults which have occurred in the system. Fault alarms should not be cleared until the fault is investigated and removed;
•
Significant redundancy in field devices;
•
Fire and explosion survivability for detectors and cabling;
•
Uninterruptible power supply.
The required target reliability of the Fire and Gas detection system must be specified by the Project team to the manufacturer at the outset of the system design (if not already specified in the invitations to tender). It will be difficult (and extremely expensive) for anyone but the manufacturer to produce the reliability figures once the system is already built. As part of the current application of IEC 61508 [3.1] or IEC 61511 [3.2] (the latter being the requirements and assessments of safety instrumented systems in the process industries sector), the reliability and failure modes of instrumented safety systems must be considered along with hazard probabilities and demand rates. Guidance on assessment techniques and avoidance of failure modes can be found in this document.
3.4.3 Control methods Where fires cannot be prevented, they can be controlled (once detected) to reduce the size, duration, and escalation potential of the fire. The following control methods are commonly in use offshore. All platforms are different, but many of these control methods will be relevant to most installations. Note that extinguishants and manual 152-RP-48 Rev 02, Feb 2006
Page 57 of 261
fireandblast.com firefighting are considered below as control methods. Deluge systems and passive fire protection methods are classed as mitigation methods because they generally protect against the impact of an existing fire rather than working to control the fire itself. The mitigation methods are addressed in Section 3.5. Some typical fire related operational and design considerations are provided for each control method in Table 3-3 below. Table 3-3 Summary of methods of fire detection Control Method
Control Mechanism
Fire Related Design Considerations
Process Emergency Shut Down Valves (ESDVs)
Automatic - Reduces inventory available to leak or fire by isolating process into separate, smaller, segments.
Ease of testing and maintenance. Regular test of process ESDVs often neglected. Specify and justify test interval and acceptable leak rate as part of design. Record in performance standard documentation In fire situations several ESDVs plus adjacent pipework may be engulfed at one time, releasing several inventories to prolong fire. ESDVs are frequently used at module boundaries to prevent inventories from one module feeding a fire in another, these divisions then match the designated fire areas and their associated firewater coverage. Where no such boundary isolations are in place, it becomes possible for hydrocarbon which is stored in one module to be released into another module and fuel escalation of further fires..
Riser ESDVs – (Topsides and subsea)
Automatic - Isolates platform from pipeline inventories at the topsides. Note that riser ESDVs are a requirement in the UK Continental Shelf under the Pipeline Safety Regulations.
Topsides valves to fail close Locate away from process fire areas wherever possible. Protect valve and exposed riser sections against foreseeable fire scenarios Always consider benefits of subsea pipeline isolation, even a simple NRV may provide significant risk reduction. Justify and record basis of decision.
Sub-sea Isolation Valves (SSIVs)
Automatic - Isolates platform from pipeline inventories at a defined distance.
Topsides valves to fail close Locate away from supply vessel routes, incoming jack-ups and other potential sources of dropped objects or dragging anchors. Locate the valve such that uncontrolled events just the far side of the SSIV will not pose a radiation problem for the installation, distances are often of the order of about 250-350m.
Well head and downhole isolation valves
Automatic - Isolates platform from reservoir inventories
Surface and downhole valves to fail close on confirmed fire or gas release event.
General Platform Alarm (GPA)
Automatic - Removes people to place of relative safety
Any prolonged fire necessitates evacuation as a precaution OIM and deputies must understand escalation mechanisms and timeframes for all emergency scenarios in order to be able to make competent decisions.
152-RP-48 Rev 02, Feb 2006
Page 58 of 261
fireandblast.com Control Method
Control Mechanism
Fire Related Design Considerations
Blowdown and blowdown valves (BDVs)
Automatic or manual Removes gases to flare or cold vent See also Section 6.6 for a general review of Process Responses See also Sections 5.5.3.3/4/5 and 6.6.2/3/4/5 for details on how the approach described in API 521 impacts blow down rates and subsequent consequences.
BDVs to be fail-open, unless this endangers helicopter operations and pre-warning not feasible. Automatic facility recommended. Any manual arrangements need clear and detailed instructions for operation to offshore staff. Appropriate blowdown time to be developed from escalation scenarios
Process facility
drain
Automatic or Manual Removes main liquid inventories from vicinity of fire to a safer location (e.g. cellar deck surge tanks)
Usually manual facility Consider vulnerability of dump line route Consider time required for draining
fire
Manual fire intervention with hydrants, fire hoses, foam monitors, extinguishers etc
Appropriate for very small fires - Immediate intervention on discovery of small fire can prevent fire taking hold. All personnel trained for small fire intervention. Fire fighting, equipment cooling and helideck fire control only possible where trained fire teams available. Effectiveness depends on understanding of installation-specific fire and escalation scenarios and plus realistic offshore exercises. Note that even with training, fire fighting teams that remain to fight a fire will be at greater risk. Comparative risk issues must be understood and precise criteria defined to limit fire fighting team’s exposure.
Remote manual fire fighting
Initiation of fixed or oscillating fire monitors, with or without foam.
Often used on helideck or open upper or weather decks. May be affected by strong winds.
Inerting agents
Prevents fire from starting/taking holds by rendering the atmosphere inert – Inergen ©, CO2 etc.
Useful in enclosed, remote spaces difficult to access in fire situations (e.g. pump rooms in semi sub or ship hulls) Static discharge may ignite atmosphere, causing explosion – check potential with vendor. Inerted atmosphere may not be breathable so warnings and pre-discharge alarms required.
Extinguishants
Stops fire burning by preventing oxygen reaching fuel, removing heat, or otherwise interfering with combustion process – water-mists, foams, some types of deluge etc
Useful in enclosed spaces such as machinery enclosures Deluge and fuel/water wash-off needs weight-control consideration, particularly on floating installation.
Foam application
Reduces evaporation of vapours. Creates film/foam to prevent oxygen reaching liquid fuel thus reducing, or extinguishing pool fire.
Suitable for contained liquid fires. Less effective on running pool fires, not effective on jet fires
Manual fighting
152-RP-48 Rev 02, Feb 2006
Page 59 of 261
fireandblast.com Control Method
Control Mechanism
Fire Related Design Considerations
Dirivent systems
Disperses very small leaks to prevent flammable cloud buildup.
Only effective for fugitive (very tiny) leak scenarios System shuts down on in major release scenarios as may spread leak and mix release to flammable concentrations.
Other systems
Provides air exchange within an enclosed area to prevent or slow flammable cloud build-up.
System needs special attention to be able to provide adequate air flow rates and be safe, i.e. to not introduce any ignition sources and also not move the fuel/air mixture to other areas hitherto safe within the context of the originating accident.
Bunds
Control releases
liquid
While bunds can contain a liquid release/fire, they can also concentrate a fire around the equipment in the bund and should be used in conjunction with foam. Design must ensure deluge does not cause bund overflow by being sized for maximum foreseeable liquid volume release.
Drains
Remove liquid and deluge releases to drain system.
Small releases are usually within drain system capacity. The drain capacity needs to be capable of removing maximum foreseeable liquid volume release although the effects of burning liquids in the drain system must be checked. Sea-fire possibilities and consequences need checking In emergency scenarios environmental issues become secondary to preservation of life.
HVAC
spread
of
3.5 Methods for mitigating the effects of fires 3.5.1 Firewalls Dedicated firewalls are often used to physically separate fire areas. The basis of the separation and the specification of the firewall are dependent upon both the fire types and severities identified in the “fire hazard” area and the vulnerabilities of the equipment, systems or personnel in the area being protected. There are several grades of pre-defined firewalls and a fire risk analysis will generally choose an acceptable defined standard rather than develop a bespoke standard (unlike designing a blast wall for explosion hazards). Some of the general terms for firewall specifications are described below. Firewalls’ continued performance is highly dependent upon the preceding and succeeding events, not least how their integrity is maintained following an explosion event. These issues are discussed further in Section 4, where interactions with explosion hazard management are discussed in more detail. 3.5.1.1 Class A-0 division A division formed by a bulkhead or deck that is constructed of steel or an equivalent material and suitably stiffened. It should prevent the passage of smoke and flame after 60 minutes of exposure to a standard fire test. 3.5.1.2 Class A-60 division A division similarly constructed as A-0 and is additionally insulated with non-combustible materials so that, if either side is exposed to a standard fire test, after 60 minutes the average temperature on the unexposed face will not increase by more than 139°C above the initial temperature and also
152-RP-48 Rev 02, Feb 2006
Page 60 of 261
fireandblast.com that the temperature at any point on the unexposed face, including any joint, will not increase by more than 180°C above the initial temperature. 3.5.1.3 Class B-15 division A division formed by a bulkhead, ceiling or lining that is constructed and erected entirely from noncombustible materials and prevents the passage of flame after exposure to a standard fire test for 30 minutes. It is insulated so that if either face is exposed to the first 30 minute period of a standard fire test, the average temperature on the unexposed face will not increase at any time during the first 15 minutes (of that test) by more than 139°C above that initial temperature. The temperature at any point on the unexposed face, including any joint, will not increase by more than 225°C above the initial temperature after exposure for 15 minutes. 3.5.1.4 Class H-120 division A division similarly constructed as A-0 and is additionally constructed to prevent the passage of smoke and flame after exposure to a “hydrocarbon fire test” for 120 minutes. It is insulated with non-combustible material so that, if either face is exposed to a hydrocarbon fire test, after 120 minutes the average temperature on the unexposed face will not increase by more than 139°C above the initial temperature and also that the temperature at any point on the unexposed face, including any joint, will not increase by more than 180°C above the initial temperature. 3.5.1.5 The “standard fire test” The "standard fire test" is a test conducted in accordance with Regulation 3.2 of Chapter II-2 of International Maritime Organization International Conference on Safety of Life at Sea [3.3]. 3.5.1.6 The “hydrocarbon fire test” The "hydrocarbon fire test" is a test in which a specimen division which resembles as closely as possible the intended construction and includes (where appropriate) at least one joint and has an exposed surface of not less than 4.65 m2 and a height or length not less than 2.44 m, and is exposed in a test furnace to temperatures corresponding approximately to a time-temperature relationship defined by a smooth curve drawn through the exposed test temperatures (indicated below), measured above the initial furnace temperature.
Temperature Point
Time interval (N minutes after start of test)
Exposed Test Temperature (increases in °Celsius)
1
3
880
2
5
945
3
10
1032
4
15
1071
5
30
1098
6
60
1100
7
120
1100
3.5.1.7 Penetrations and closures in firewalls Where a firewall of any class is pierced for the passage of electric cables, pipes, trunks or structural elements or for other purposes, the “penetration” must be arranged so that fire resistance standard of the division is not impaired. Similarly, any openings such as doors or other access 152-RP-48 Rev 02, Feb 2006
Page 61 of 261
fireandblast.com hatches must match the integrity of the division when closed and in the case of doors be selfclosing.
3.5.2 Passive fire protection methods Passive methods are preferred where specific protection of critical process or structural items is needed in order to prevent escalation. Widespread application to process and structural items is not generally feasible due to weight, inspection and maintenance/replacement issues. Modern design philosophy is to identify specific areas or items of concern (usually structure or piping which on failure would escalate the initial event) and target these items for PFP application. PFP is preferred over deluge in such situations since it is immediately available and has no moving parts to fail and prevent operation. If properly applied/installed it is highly reliable in service. However it has also been the cause of problems in the past so current best practice concerning the design and application of such systems, is discussed below. Passive fire protection (PFP) comes in many forms, but the object is always to provide some sort of heat insulating barrier between the fire and the item to be protected. PFP can be designed for use on vessels, pipework, structural members, boundary walls or individual items of safety critical equipment. The objective is to prevent the protected item heating up and either losing strength, losing function, distorting or producing noxious fumes. Previously the design emphasis was on application of codes and rules. For example, accommodation block were given A60 walls regardless of the fire risk to the accommodation. Now, best design is to design all PFP systems to be appropriate to the specific fire scenario for which the PFP is required. PFP can be effective in protecting against high pressure jet fires whereas deluge is not The system is usually designed by the PFP supplier’s engineers to the scenario-based specification of the relevant discipline engineer (process, structural, mechanical or instrument as appropriate for the item being protected) and the safety engineer. For any of the systems outlined below it is up to the designer to demonstrate initial suitability of the PFP system to the IVB and HSE, and the duty holder to maintain the protection throughout the lifecycle. For some of the common systems initial suitability is easy to demonstrate since the manufacturer will have a standard fire test certificate (such as A60, B15, or H120) for the proposed system. However for some of the newer products, or existing products in severe or novel applications such classification is not easy to obtain and the demonstration of suitability will have to be via specially devised fire tests or research. Some considerations around standard fire tests are discussed in Sections 6.2.1 and 6.3.2 of this guidance. The following types of PFP are in current use and their uses and drawbacks are discussed in the paragraphs below and further in Sections Sections 4.4 and 4.5. 3.5.2.1 Cementitious or vermiculite type These are heavy mineral-based based coatings which can be applied to walls, structure or pipework in a wide variety of ways from spraying or trowelling to bolting-on of pre-formed sections. They have been used extensively offshore since the 1970s. There are many different types available. The thickness of the coating principally determines the time it takes to transfer the heat through the coating and the mechanical strength of the compound or sometimes an extra outer shell, determines whether the coating will withstand the physical impact of the fire, for example erosion from jet fire impingement or pressure waves from explosions. Since the properties of cementitious or vermiculite coatings are well researched and many applications have been extensively tested, classification of the protection is relatively easy to 152-RP-48 Rev 02, Feb 2006
Page 62 of 261
fireandblast.com obtain. Some systems have been tested and found capable of withstanding the impact of high pressure jet fires. In the 1980s and early 1990s the biggest problem with use of these coatings was that the offshore installation process was carried out poorly. Many poorly applied coatings fell off after a few years. Deluge water found its way beneath coatings and the fixing pins or protected items (particularly where they were warm) corroded rapidly. Some coatings just disintegrated with time. Products have improved significantly since the early 1990s and recent experience has demonstrated that provided these systems are installed in full compliance with the manufacturers’ instructions, there are few problems. However it is difficult to exercise control over application in the offshore environment, especially in exposed areas and below main deck levels. Therefore, wherever possible for new designs, coatings should be installed onshore under controlled conditions before float out. Removable PFP, in the form of enclosures or blanket wraps can be removed to allow corrosion checks and inspection/maintenance of protected equipment. However, removable systems are not practical in many places, being generally heavy, costly and requiring space. 3.5.2.2 Intumescent coatings: Intumescent paints and coatings work by expanding to many times their original thickness on exposure to high heat or flame to produce a fire resisting, thermally insulating coating or ‘char’. Like the mineral-based coatings discussed above they are available in a variety of forms to suit a wide variety of applications from protection of deck undersides to sealing of piping or cable transits. The possibility of corrosion under PFP coatings is a major concern for designers. For new builds it is possible to plan for future inspection through the coating, out as explained below. Retrofitted systems remain problematic. Although intumescent coatings can now be applied in fairly thin layers, use in underdeck or other exposed areas and particularly in the splash zone usually requires a thin neoprene layer under the coating and another on top to prevent external corrosion and protect the coating. Any such thick or composite coating makes subsequent NDT inspection results extremely difficult to interpret. It would be possible to plan for such NDT inspection if the designer specified at the outset that sample pieces of steel were taken and kept, coated and uncoated, for calibration purposes. This would allow results to be interpreted with more confidence. For retrofitted systems, without these calibration aids, effective NDT through PFP coating systems is not practically achievable at present. Research continues but no viable methods exist at present. Wet-applied intumescent coatings often shrink slightly as they dry out, and they usually give off toxic gases when they intumesce. The effects on adherence to substrate plus the migration of toxic gases to affect personnel need taking into account during design. As for the cementitious PFP, proper preparation of surfaces to be coated with intumescent PFP is essential for long-term performance. Intumescent systems can be specified to provide fire protection for anything from minutes to hour, and many systems have been through fully documented testing. Both cementitious and intumescent coating systems are continually changing and developing so details are best obtained directly from the manufacturer. Further discussion of common types of PFP application, such as PFP in firewalls, enclosures, flexible wrap systems etc is provided in Section 7.3.2 on Fire Protection Design. 3.5.2.3 Weathered and cracked PFP Since much of the PFP in existence on offshore installations at the current time is suffering from ageing, 2 separate projects have been initiated. HSE and HSL are continuing a programme started by Shell which will report on the effects of 10 years of weathering (and ageing) on the fire resistance of PFP. A joint industry research project is underway by MMI to determine which types of damage to PFP are most critical and what are the most effective repair methods. 152-RP-48 Rev 02, Feb 2006
Page 63 of 261
fireandblast.com Both projects were set to report in late 2005. In addition, ageing, weathering or plain damage to PFP can cause a loss of water-tightness and thus lead to water penetration and potential corrosion. This in turn creates difficulties for the maintenance teams to inspect and monitor potential corrosion points under PFP.
3.5.3 Active fire protection methods 3.5.3.1 Mitigation by deluge water application Deluge works mitigates the effects of fires principally by providing cooling both to the fire and to equipment exposed to radiant heat from the fire. In addition it can wash away liquid fuel fires to drain systems or overboard. Protection of all the equipment in a module by application of PFP is rarely practical, so the alternative is to deluge a whole module or section of structure with large quantities of water. The water acts to: •
Cool the general area by evaporation of the smaller water droplets ( see also Section 5.2 where the effects of deluge on different fire types are is described)
•
Provide a running film of water onto equipment in the area in order to cool it
•
Provide a screen of water droplets as a barrier to radiant heat, thus reducing the heat load on structures and equipment
•
Provide a screen of water droplets as a barrier to radiant heat exposure of people
•
Retard the movement of the flame front through a module and consequently reduce explosion overpressures to some degree (see Part 1 of the Guidance).
For general area cooling the key factors are application rate and water droplet size. If the water droplets are too small, they evaporate rapidly in a severe fire or can be blown away if the area is exposed. If the droplets are too large there is less evaporation from fewer droplets and the cooling is inefficient for the amount of water used. The droplets however are less affected by wind, will reach the floor, cool and wash liquid spills away and can provide a running film of water over equipment to keep it cool. Larger droplets however require bigger pumps, more power, and more AFFF so the cost of the system has to be balanced against its effectiveness. The deluge rate depends on both the fire scenario and the escalation potential, but the general rules are: General deluge only protects equipment exposed to flame or/and radiant heat from pool fires or radiant heat from jet fires providing there is a sufficient deluge rate to provide a film of running water over the equipment. Where a jet-flame actually engulfs equipment, however, much of the film is likely to be displaced by the jet flame and the cooling effect lost. Directed water deluge using high velocity nozzles may be used as trials have indicated an increased effectiveness against jet fires, Sections 5.2.2 and Section 5.5.2.3 discuss deluge protection options in the context of jet fires.4.1 discusses this design option in more detail. •
Areas shielded from deluge but exposed to the fire will receive some limited protection from the heat attenuation of the deluge droplets falling between the location of the fire and the location of the equipment. Objects subject to thermal radiation from fires (but not direct fire impact) receive benefit from attenuation of the water sprays active between the location of the fire and the object (see Section 5.2 and 5.4).
•
Suppression of combustion and cooling of the high heat layer in the roof of a burning module (where the module is partially enclosed) is known to be achievable by spraying of very fine droplets at roof beam height. At the present time there is no method for calculating the protection provided by this mechanism,
•
The deluge rate and droplet size must be suitable for the cooling mechanism appropriate to the type of fire. Where there are several different scenarios, the
152-RP-48 Rev 02, Feb 2006
Page 64 of 261
fireandblast.com deluge rate for the worst-case scenario, should be used as this should cover all lesser cases. Therefore in the case of enclosed modules with potential for serious, pressurised oil, gas or condensate fires deluge rates of 20 to 24 l min-1 m-2 would be needed, with rapid activation and water coverage especially at roof-level where the high heat will concentrate, However, deluge of high pressure gas jet fires within enclosed spaces will very likely result in extinction of the fire and could lead to an explosion hazard. •
Vessel deluge
Further details on appropriate flow rates and other design issue for deluge systems are provided in Section 7.3.2.4. 3.5.3.2 Mitigation by Sprinkler Systems These are usually potable water filled systems and provided in areas where the fire-risk is nonprocess related and therefore less severe, for example inside accommodation modules. They are activated by frangible bulbs, which release water directly from the sprinkler piping as soon as the bulb is broken by the heat of the fire in the area. Design is straightforward by comparison with deluge systems and is usually in accordance with the applicable NFPA standards. 3.5.3.3 Watermist systems Water-mist systems are now commonly being used in turbine, generator or pump enclosures to replace Halon protection systems which are no longer permitted for use. The fine mist is injected intermittently from pressurised water reservoirs/ cylinders, in roughly 15 second bursts. The mist provides cooling and suppresses the combustion, which will be also be controlled by lack of air into the enclosure (provided there is no explosion on ignition). In enclosed spaces, protection systems need to take account of manning regimes and hence should include warning systems to evacuate personnel as the mist systems are being armed. Enclosure type fires tend to be non installation-threatening (but always need due consideration within the fire and explosion review process for the installation) The protection is usually automatic and provides immediate control, however there are a limited number of mist-injection cycles available from the water reservoir and instruction/training for follow-up action by the platform personnel e.g. fire team action and/or evacuation needs to be covered in platform emergency response plans. 3.5.3.4 Gaseous systems Gaseous systems have been a common replacement to Halon systems. Whereas Halon systems actually disrupted the combustion process, not all replacement media have the same effect. Replacement gaseous systems are: •
Carbon Dioxide (CO2);
•
Replacement low oxygen alternatives (e.g. Inergen ©);
•
Replacement Halon alternatives;
These alternatives function primarily by displacing the oxygen from the fire, although in addition, the CO2 option generates a low temperature upon release which has a cooling effect on the fire. The fire extinguishing media can themselves present hazards, most notably CO2 which is a powerful asphyxiant which causes hyper-ventilation exacerbating the hazard.
152-RP-48 Rev 02, Feb 2006
Page 65 of 261
fireandblast.com Inergen © has specifically been design to provide a “safer” fire-fighting medium within which personnel can survive, providing only just oxygen to sustain breathing (with some difficulty) but not enough to sustain a fire.
3.6 Performance standards 3.6.1 Application of performance standards The fire and gas detection and protection systems on an installation are generally categorised as safety critical systems, or ‘safety critical elements’ (SCEs) for the installation. In order to pass on the understanding of the design and operation of each system to those who operate and maintain the installation, the key features of the systems are recorded for all to see and understand in the form of ‘Performance Standards’. The Performance standards for SCEs should contain precise information relating to the functionality, availability, reliability and survivability of the system in question It is rare for platforms to have only one type of device within such systems. The ‘Fire and Gas Detection’ or the ‘Active Fire Protection’ SCEs for example will have many different aspects, parts or subsystems. While the ‘goal’ of the overall system will be the same, the Performance Standards for each part of the SCE will probably be different and needs to be specified separately within the documentation.
3.6.2 Functionality issues As can be seen from Section 3.4, there are many different types of equipment available for the purposes of detecting fires and gas releases, and for protecting against fire. The principals of operation of the various sub-systems vary widely, as do the availability and reliability requirements of the equipment involved. It is important that the Performance Standard captures all the key information, not just part of it. In addition it should provide cross references to the various codes, standards, analyses and guidance documents which have a bearing on the performance. Some examples of different functionalities within the same SCE Performance Standard are shown in Table 3-4 below: Table 3-4 Typical safety critical element functionality descriptions Typical derivation/ supporting documents
SCE
Sub-item
Functionality
Gas detection system Goal: Detect loss of containment events.
1. Gas detection at inlets to enclosed areas containing non-certified electrical equipment
Detect low-level gas at 10 % (alarm) and high-level at 25 % (ESD 1, close dampers, S/D fan). 3 IR Point detectors in each duct on 2oo3 voting
Fire and Detection Philosophy
2. Gas detection in open hazardous areas
Detect 50 % LEL gas cloud of radius 5m or more using paired IR beam detection in process modules. Confirmed beam-pair detection initiates ESD 2.
Fire and Gas Cause and Effect Drawings
3. Acoustic detection
152-RP-48 Rev 02, Feb 2006
leak
Detect gas leaks of 0.1 kg s-1 and above in process modules. Executive action only on coincident gas detection (by beam detectors) in same area.
Gas
Installation Safety Case In-house Vendor Design Code for Acoustic Detection
Page 66 of 261
fireandblast.com
SCE
Sub-item
Functionality
Active Fire Protection
1.Water deluge with AFFF in Process Modules including communicating mezzanine and deck levels
12 l min-1 m-2 general area coverage in LP separator and oil metering modules with at least 3 % AFFF to cool equipment in vicinity of oil pool fires and prevent consequent leakage from other inventories. Activated on confirmed Flame detection (2ooN) voting.
2. Water mist application in Generator Rooms A and B
Water mist injection to generator rooms to provide suppression and cooling. Activated on confirmed smoke or heat detection in generator room.
1.H120 firewalls
Firewall at gridline 2, process area boundary, providing protection to TR and TEMPSC embarkation areas
2. J15 passive fire protection on First Stage Separator
Fire protection of gas space of First Stage Separator to protect against jet fire impingement from gas export system and potential BLEVE.
Passive Fire Protection
Note that a jet fire rating has been proposed in the latest draft version of the ISO (22899-1) on the jet fire test. This is specified as: Type of application / Critical temperature rise ( °C) / Type of fire / Period of resistance (minutes).
Typical derivation/ supporting documents Firewater design philosophy Installation Fire and Explosion Analysis and Assessment In-house vendor design code for Water Mist Systems Safety Case Passive Fire Protection strategy Document. Installation Fire and Explosion Analysis and Assessment Vendor design Code for PFP suitable for Jet Fire impingement
3.6.3 Availability issues These are often given limited consideration in Performance Standards. It is important to understand the availability issues for any Performance Standard. A significant factor in generating a systems’ availability is obtaining an estimate of the level of unrevealed failure modes the system may be subject to. Just as there are different functionalities there are differing availabilities associated with different methods or types of protection equipment. Availability is not the same as reliability. The availability is the fraction of time the equipment is available to perform its intended function. A passive coating for example is available 100 % of the time (assuming it has not been damaged or degraded in service). A passive fire protection enclosure or removable cladding on a vessel however may be removed for several weeks in the year to allow inspection of a valve or NDT of a significant part of a vessel. Similarly, automatic Fire and Gas detection systems might be keyed out, making them only partially available during maintenance or project related activities. It is important that the person responsible for devising the Performance Standard also documents the assumptions made regarding availability, so that the design intent is correctly understood and upheld throughout the life cycle of the installation by the operations and maintenance personnel. Some example maintenance arrangements for safety critical equipment are given below. •
F&G detection system – During period of unavailability of fire and gas detection in an area due to essential maintenance, local manual surveillance for fire/gas events will be provided at all times.
152-RP-48 Rev 02, Feb 2006
Page 67 of 261
fireandblast.com •
Evacuation Systems -- Due to jet fire exposure potential, a standby vessel will be on close standby whenever the installation (normally unmanned) is manned. Manning will only be allowed within documented weather operating limits (2 m significant wave height) for Skyscape© evacuation system.
3.6.4 Reliability issues Reliability and availability are two technical terms that are often confused. Availability has been explained above. Reliability is the probability that the system or item of equipment will perform its intended function when required to do so. The reliability details for each system or subsystem listed within a performance standard should be clearly stared, with reference back to the reliability studies carried out during the design of the equipment. Changing the frequency of inspection and maintenance will have a direct bearing on its stated reliability. For this reason the maintenance or the inspection period used as key input to the frequency figure quoted must also be quoted in order for the reliability figure to be meaningful. As noted above for availability, it is important to obtain an estimate of the level of unrevealed failure modes the system may be subject to, preferably from gathered “own experience”. It is also important to understand that reliability figures theoretically derived from calculations involving manufacturer’s data on ‘mean time to failure’ may be over optimistic. It is strongly advised that platform specific information is used in evaluating equipment and plant reliability. The manufacturer’s data may have been gained under laboratory conditions and produces times-tofailure information that may not be reproducible in the real offshore environment or otherwise represents an amalgam of accumulated data from a range of applications and maintenance regimes. For example, theoretical calculations for a pellistor gas detection head, using the manufacturer’s data may imply that an adequate reliability is achieved by a 6 monthly test and inspection frequency. In reality, if the detector is then placed in an air inlet duct, exposed to salt, spray, temperature and pressure cycling and vibration, the time to failure in actual service may be significantly shorter. Where un-revealed faults in safety equipment could occur, test/ maintenance history must be monitored. If every time the gas detector is tested it fails to operate there must be immediate feedback to the responsible engineer, that the high reliability indicated in the Performance Standard is not being achieved. The test frequency should then be adjusted (for example to a 3 monthly interval) until is can be demonstrated that an appropriate level of reliability is restored. Voting arrangements for heat, smoke, flame or gas detectors also have a direct bearing on the proposed frequency of maintenance interventions. For example, a detection voting system that requires 1 detection element to be activated out of a total 2 (known as 1 out of 2 and indicated as 1oo2), has only one other item by way of redundancy plus a spurious indication from either item will cause unit or platform shutdown. It should be remembered that reliability requirements encompass unnecessary activation as well as failure to activate. The “built-in” redundancy is unavailable during maintenance of any one item. Industry good practice has converged on 2 out of 3 voting systems (2oo3) which offer a “good” compromise of high reliability of having 3 items available and still leaving a working arrangement in the event of a single item failure plus the demand rate for spurious indications is lower as a confirmed signal is always required. During maintenance this arrangement becomes a 2oo2 system. The voting arrangements should always be stated in the Performance Standards. Where reliance is placed on just one or two detectors to take executive action a review of the failure modes and the consequences of failure should always be undertaken and the consequences of maintenance changes need to be evaluated to ensure there are no knock-on effects to the platforms overall risk profile.
3.6.5 Survivability The Performance component parts makes it clear to major emergency
Standard must state the survivability requirements for each SCE and each of its where there are different requirements to those for the overall system. This all concerned exactly how long the item will need to continue to function in a in order to fulfil its safety role. For example one or more of the communications
152-RP-48 Rev 02, Feb 2006
Page 68 of 261
fireandblast.com systems and the place of temporary refuge (TR) will be required to function as long as there are any personnel left on the installation. This may be anything from 10 minutes on a small NUI to 2 hours on a large installation. Individual fire or gas detectors however may only need to survive for long enough to detect the release or fire and initiate the necessary alarms, shut-downs and blowdowns. This may be only a few seconds. Valve actuation systems may need around a minute. Whatever the specified survivability, the information provided in the Performance Standard must be clear and unambiguous to the reader. Experience from major disasters both on and offshore indicates that failure to examine, understand and then communicate the survivability requirements of the provided safety systems to the right personnel has been a major contributor to the disaster.
3.6.6 Written schemes of examination (WSEs) or verification The detailed schemes of examination or verification required under the PFEER and DCR regulations are intended to provide an independent check that: •
the initial design of the safety critical system/element is appropriate for the hazard;
•
the SCEs have been procured; installed and commissioned to confirm that they achieve their required function;
•
the maintenance being carried out is compatible with the reliability and availability specified in the Performance Standard;
•
the maintenance activity takes into account the likely failure modes (especially un-revealed failures) of the components.
The written schemes must be thorough. Since they are derived from the Performance Standard documentation, any essential information omitted from these documents is in danger of being left out of either the maintenance scheme or the written schemes of the independent Competent Person, or both. This will lead to gaps in the platform safety management system. Such gaps may only come to light in the aftermath of a major incident. The written scheme is required to be “live” through the platform’s lifetime and may be re-affirmed at any time.
3.7 Methods and approaches to structural analysis 3.7.1 General The risk level for the installation as defined by the risk matrix given in Section 2.7.4 determines the level of sophistication required for the fire assessment. If the conservatism of simplified methods of analysis can be guaranteed, then these could be used at an early project phase or as a first step in a sequence of analyses of increasing sophistication. For High or Medium risk installations, a ‘Structural Assessment’ should be performed for a representative range of fire scenarios. The process and Safety disciplines will generally define these Scenarios. A Structural Assessment may be performed at three levels of increasing complexity starting with a ‘Screening Analysis’. Should a structure fail the ‘Screening analysis’ then a ‘Strength level analysis’ will be required. If it fails the Strength level analysis then ‘Ductility level analyses must be performed. If the Ductility level analysis indicates failure then mitigation measures are required. These could involve measures for elimination or reduction of the frequency of exceedance of the initiating event, reduction of the severity of the consequences of the event or structural modification. ‘Failure’ in the context of fires means failure to satisfy the performance standards for the installation. High-level performance standards for the installation and safety critical components 152-RP-48 Rev 02, Feb 2006
Page 69 of 261
fireandblast.com are defined in terms of allowable peak temperature, strain or time to collapse depending on the method of analysis used. Screening Analysis, Strength level or Ductility level performance characteristics from an assessment of one installation may be used to infer the fitness for purpose of other similar installations, provided the framing, foundation support, service history, structural condition, blast and fire barriers and payload levels are not significantly different. In cases where one platform’s detailed performance characteristics are used to infer those of another similar platform, documentation should be developed to substantiate the use of such generic data. The required initial level of analysis depends on the Risk level assigned to the installation or the risk level associated with a representative set of fire scenarios. The risk category of the installation does not preclude the use of more sophisticated methods of assessment which may result in reductions in conservatism and hence cost, if they are considered more appropriate. Table 3-5 Appropriate method of analysis – fires Risk level
Analysis method
Low
Screening analysis
Load calculation bases Allowable temperature (yield strength reduction to 60 % - see Table 3-6 and Table 3-7 Past experience.
Medium High
or
Response calculation Design basis checks. Past experience for demonstrably similar platforms.
Strength analysis
level
Calculate peak temperature member by member, from nominal fire loads and fire extent.
Strength level analysis, Redundancy analysis
Ductility analysis
level
Calculate temperature - time history of primary members from fire loads time history and flame extent.
Redundancy analysis, Ductility level analysis
A structural ‘Redundancy Analysis’ of a topside structure will indicate which members can be removed without collapse of the structure. In addition those members not supporting the TR, muster areas, escape routes or safety critical equipment must survive during and after the fire event for sufficient time to allow personnel on board to escape, allowing for the possible need to assist injured colleagues. The results of a fire response analysis will then indicate which structural members and SCEs must be protected to achieve the fire performance standards for the installation. Simple fire response analyses are usually performed based on the following assumptions [3.4]. •
Unprotected structural members and panels have no variation of temperature through thickness or along their length. In practice the critical sections of the member are considered from the point of view of resistance.
•
Fire protected structural members and panels have a constant steel temperature, the thermal insulation has a linear variation of temperature through thickness.
•
Each member may be considered to have reached a steady-state, variations of temperature are due entirely to changes in boundary conditions and incident heat fluxes.
•
Conduction between members need not be considered (except when considering coat-back requirements).
152-RP-48 Rev 02, Feb 2006
Page 70 of 261
fireandblast.com •
Thermal stresses due to restraint may generally be neglected as supports also soften during fire loading.
The methods of analysis identified above are discussed in the following sections.
3.7.2 Screening analysis A screening analysis for an existing installation consists of a condition assessment which may involve a survey followed by design basis checks. Design basis checks consist of checking the basis of the existing design for the installation and determining if the methods used for the design are currently acceptable in the context of fire events. For a Screening Analysis, the Zone method may be used. The Zone method assigns a maximum allowable temperature that a steel member can sustain. This method does not take into account the stresses present in the member before the fire. The maximum allowable temperature may be read from Table 3-6. These temperature values correspond to a yield strength reduction to 0.6 of the ambient temperature values. The fact that a fire is an accidental load will mean that the allowable stress is the full yield stress value as opposed to about 60 % of the yield stress allowed for in the conventional design load cases. The yield stress corresponding to 0.6 of the ambient yield stress will then give an allowable stress the same as that for the structure before the fire. Higher strain levels than 0.2 % may give a proportionately higher decrease in Young’s Modulus giving an unmatched reduction in yield strength with the reduction in Young’s modulus exceeding the reduction in yield strength. The Zone method may then not be applicable [3.5]. Fire barriers must perform according to their required rating. A blanket critical temperature for all members may be postulated as in the Zone method. This critical temperature is chosen typically to be 400 °C as this requires no modification to the normal code checks if strains are limited to 0.2 % in an elastic Design Level analysis. This approach may result in unnecessary protection and may be unconservative locally to areas of high strain. It will not usually be necessary to protect every vulnerable member unless the scenario performance standards demand that the installation is required to re-start after a few days. The above method will indicate the protection of non-essential members from the point of view survival of the installation. The temperature calculation for each member is performed and measures are taken to restrict the temperatures to values below the critical temperature usually by the application of PFP (Passive Fire Protection). It will also be necessary to check that radiation levels on escape ways remain at acceptable levels (i.e. below 2.5 Kw m-2), to allow for personnel on board to escape.
3.7.3 Strength level analysis Strength level analyses are conventional linear elastic analyses as used in design against environmental, operating and gravity loads. The loads used in such an analysis should be in a form which could be interpreted as a load case as used in the design process. In investigating the effect of a fire the ‘live’ loads such as contained liquids and storage may be taken as 75 % of their maximum values as is the case for the consideration of Earthquakes. Alternatively, live loads may be taken as the values used in the fatigue analysis performed for the installation if these have been properly derived. 152-RP-48 Rev 02, Feb 2006
Page 71 of 261
fireandblast.com The transfer of conclusions and load characteristics from the analysis of a geometrically similar platform with similar structural and process characteristics is acceptable for strength level analyses. In a strength level analysis a maximum allowable temperature in a steel member is assigned based on the stress level of the member prior to the fire such that the utilization ratio remains less that the corresponding value given in Table 3-6 below. The maximum allowable temperature in a steel member as a function of utilization ratio is given in Table 3-6 below. Table 3-6 Maximum allowable steel temperature as a function of Utilisation Ratio [3.6]
Maximum Member Temperature
Yield Strength Reduction Factor
Member UR at 20 °C to give UR = 1 at Max. Temperature
°C
°F
400
752
0.60
1.00
450
842
0.53
0.88
500
932
0.47
0.78
550
1022
0.37
0.62
600
1112
0.27
0.45
If the primary structure on the installation have been designed for all credible fire scenarios to then the primary structure will be acceptable from a fire resistance point of view. Higher strain levels than 0.2% may give a proportionately higher decrease in Young’s Modulus giving an unmatched reduction in yield strength and Young’s modulus. Strength level checks may then give utilization ratios above unity. A Ductility level or ‘elastic-plastic’ method of analysis may be required. Table 3-7 gives the maximum allowable steel temperature as a function of strain. The peak temperature of each member needs to be determined for the fire event to check if the structural response remains elastic. Table 3-7 Maximum allowable temperature of steel Maximum Allowable Temperature of Steel Strain % °Celsius
°Fahrenheit
0.2
400
752
0.5
508
946
1.5
554
1029
2.0
559
1038
Fire barriers must perform according to their required rating.
3.7.4 Scenario or performance based strength level analysis In a performance or scenario based approach, the first task involves the definition of credible fire scenarios from the failure probabilities of vessels and piping, the inventory pressures local to the release point, the material released, the emergency shut down systems available and the 152-RP-48 Rev 02, Feb 2006
Page 72 of 261
fireandblast.com ventilation conditions. This information will normally be supplied by the Safety and Process disciplines. A scenario based Strength level analysis is performed in the following general stages: •
Definition of a fire scenario. (See Section 3.2 “Fire types and scenarios”).
•
The time history of the rate of release is calculated.
•
If required, the probability of occurrence of the release can be estimated from published failure statistics and the numbers of past failures which are available for most types of vessels, flanges and process equipment generally [3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13].
•
Calculation of the burning rate for the fire geometry enables the extent and duration of the fire to be determined.
•
The heat output from the fire in terms of radiation and the convection of hot air and gases may then be determined (see also Sections 5.3, 5.4 and 5.5).
•
The heat incident on structural members and panels may then be used to calculate the temperature/time history of the member (see also Sections 5.4 and 5.5.3).
•
For load bearing members, the temperature determines the appropriate values for the yield stress and Young’s modulus of the material of the member to be used in the structural analysis performed.
•
For panels and firewalls, which are usually non load bearing, the important parameters are the temperature of the cold face and the time to reach certain limiting temperatures which determine the walls’ rating.
It will also be necessary to check that radiation levels on escape ways remain at acceptable levels where immediate injury will not caused (i.e. below 2.5 kW m-2). A utilization ratio of up to 1.7 will be acceptable for members loaded in bending if a small amount of plastic deformation is acceptable. A different utilization ratio will be appropriate for detection of buckling. Shear stresses should be kept within the yield stress for the material at that temperature. Alternatively the yield stress may be enhanced by a factor of 1.5 to take account of the fact that fire is an accidental load. Modified code checks may be made on the structural members and if load re-distribution is neglected then the material effects and isolated plasticity may also be taken into account in the analysis. The occurrence of plastic hinging may be taken into account by factoring the acceptable utilization ratio by the ratio of the plastic ‘Zx’ to elastic section modulus ‘Sx’. This factor is generally greater than 1.12 and will be in the range 1.1 to 1.5. The member must be able to sustain the formation of a plastic hinge before buckling, i.e. be in tension or be a ‘plastic’ section. Use of the critical temperature approach may give an efficient scheme for the application of PFP in combination with a full non-linear elastic-plastic (progressive collapse) structural analysis. This type of analysis is referred to as a ductility level analysis for fire or explosion response calculations.
3.7.5 Redundancy analysis An elastic linear analysis is performed to determine the minimal structure which will fulfil the requirement that escape ways will remain available for sufficient time to allow escape and that the TR integrity is maintained during and after a fire event. 152-RP-48 Rev 02, Feb 2006
Page 73 of 261
fireandblast.com A structural redundancy analysis will determine which members are essential for the above. Protection of these members with PFP will complete the assessment on the basis of a redundancy analysis. The determination of the critical structural members may be performed using an elastic structural frame model as follows: •
Eliminate all non-critical structural elements by inspection, with due regard to escalation potential;
•
Remove all members identified in step 1;
•
Modify the static loading to represent the probable load at the time of the fire 75% of the loads associated with process contents and storage may be used as suggested for Earthquake analysis [3.14];
•
Remove safety factors in the code check, enhance the yield stress by a 1.5 factor, or allow a correspondingly higher utilization;
•
Identify those members with the highest utilization ratios - particularly relating to stability using the frame model;
•
Remove these members from the geometry;
•
Repeat step 6 and assess the remaining structure at each stage.
3.7.6 Ductility level analysis A ductility level analysis may be required for Medium or High Risk installations. This method of analysis can take into account the load re-distribution which takes place when structural components fail and the time to failure of the structure considered. A number of options for the linearization of stress/strain relationships at elevated temperatures exist. If the software used for the ductility level analysis allows temperature dependent stress/strain curves to be input then the linearization will not be necessary. The levels of heat radiation and convection from the selected fire scenarios are calculated and the time history of the increase of temperature of the structural components is derived. Conduction of heat from neighbouring structural components will also occur but may generally be ignored in the primary framing analysis. Methods of performing these calculations are discussed in the various parts of Section 6. Once the steel temperature at a given time is known, the reductions in yield stress and Young’s modulus may be calculated. Failure of a structural member is defined as collapse (where increasing displacement results in no net increase of capacity) under the imposed static gravity and operating loads. In investigating the effect of a fire the ‘live’ loads such as contained liquids and storage may be taken as 75 % of their maximum values as is the case for the consideration of Earthquakes. Alternatively, live loads may be taken as the values used in the fatigue analysis performed for the installation if these have been properly derived. Optimization of PFP (passive fire protection) thickness is rarely worthwhile as application of PFP to a given thickness is not sufficiently controllable. The thickness of PFP is controllable at best to within about 3 mm.
152-RP-48 Rev 02, Feb 2006
Page 74 of 261
fireandblast.com The scenario based strength level analysis method will not detect failures at intermediate or later times caused by thermal restraint from cold members. This is, in any case, an unlikely event in the context of offshore topside structures. Imperfections or deflections for example due to a previous explosion will not be taken into account. It will be necessary to use a ductility level analysis to take these effects into account. In view of the fact that a single scenario is only one among many, the spatial variation of thermal loading is not generally meaningful. It is unlikely that this level of analysis will be necessary unless a single extreme event such as a riser failure or blow-out which puts the whole installation at risk is being considered. It will also be necessary to check that radiation levels on escape ways remain at acceptable levels (i.e. below 2.5 kW m-2).
3.7.7 Assessment of fire barriers Fire barriers are given a ‘rating’ derived from the SOLAS (Safety of Life at Sea) [3.3] classification system for use on ships. Originally they were developed for cellulosic fires as opposed to hydrocarbon fires, which are more severe. The type of fire is represented in a furnace test where the firewall is in contact with a furnace with a well-defined temperature/time relationship. The hydrocarbon fire curve has a higher rate of temperature rise and attains a higher peak temperature. The three main ratings used offshore are: B
Maintains stability and integrity for 30 minutes when exposed to a cellulosic fire. The temperature rise of the cold face is limited to 140 °C for the period in minutes specified in the rating. i.e. A30 has a 30 minute time period during which temperature rise is below 140 °C.
A
Maintains stability and integrity for a period of 60 minutes when exposed to a cellulosic fire. The temperature rise of the cold face is limited to 140 °C for the period specified in the rating.
H
Maintains stability and integrity for a period of 120 minutes when exposed to a hydrocarbon fire. The temperature rise of the cold face is limited to 140 °C for the period specified in the rating.
J
Currently proposed one in latest draft version of the ISO (22899-1); identifies Type of application / Critical temperature rise (°C) / Type of fire / Period of resistance (minutes) Here retaining ‘stability and integrity’ means that the passage of smoke and flame is prevented and that the load bearing components of the barrier do not reach a temperature in excess of 400 °C. Insulation failure is also deemed to occur when the average temperature rise on the unexposed face of a separating element exceeds 140 ºC or the maximum temperature rise exceeds 180 ºC, whichever occurs first. These limits are to prevent combustion of any material which may be close to the unexposed face. Their origins are unknown and, in many cases, the limits may be excessively conservative.
152-RP-48 Rev 02, Feb 2006
Page 75 of 261
fireandblast.com
3.7.8 Approaches to analysis methods by risk level 3.7.8.1 Overview of installation/compartment risk screening Installations are subject to different levels of risk, based on the severity of the fire, its potential duration and the installation’s vulnerability to the event. The severity and duration of the fire will be functions of process flow rates, pressures and inventory. The potential vulnerability of the installation will be a function of layout, manning levels, location and age etc. A simple approach which is frequently adopted for qualitative risk analysis uses a 3 x 3 matrix of potential consequence versus frequency or likelihood of an accident or event, and such a matrix is illustrated below (Table 3-8). The overall categories of 3 published documents are shown; the documents are issued by UKOOA, API and ISO [3.15, 3.16 and 3.17], the notation differs between the three documents and has been adjusted for comparison purposes. Other practitioners make use of a 5 X 5 matrix, the choice of preferred level of refinement should be dependent on the Duty Holder’s corporate background and their experience with the use of qualitative risk assessment. A 5 X 5 matrix will obviously offer a greater degree of refinement, the choice of refinement should be governed by the motive for the analysis, for example, a ranking exercise for a number of competing feasibility options could easily make use of a 3 X 3 matrix, whereas, making a decision on a protection option would benefit from the use of a 5 X 5 matrix. The higher the risk (likelihood x consequence) in an installation or compartment the greater should be the rigour that is employed to understand and reduce that risk, this may entail choosing more comprehensive methods and analysis tools. The solutions and protective measures for the installation with greater risk should be able to bear greater scrutiny, from both the Duty Holder and the regulator’s point of view. All three documents use risk matrices for risk screening. Table 3-8 Risk matrices from the three documents
Likelihood / Probability
152-RP-48 Rev 02, Feb 2006
UKOOA
API
ISO
Consequence
Consequence
Exposure level
H
M
L
H
M
L
L1
L2
L3
H
H
H
M
H
H
M
H
H
M
M
H
M
L
H
M
L
H
M
L
L
M
L
L
M
L
L
M
L
L
Page 76 of 261
fireandblast.com There is a large degree of similarity between the three documents, the differences in notation and the differing treatment of the outcomes (risk) are summarised in Table 3-9 below. Table 3-9 Notation and treatment of outcome of risk matrix by document Notation
UKOOA
API
ISO
Likelihood/Probability
Likelihood
Probability of occurrence
Probability of exceedance
H
High
Higher
Risk level 1 (L1)
M
Medium
Medium
Risk level 2 (L2)
L
Low
Low Risk
Risk level 3 (L3)
Outcome
UKOOA
API
ISO
H
Requires high sophistication analysis
(Higher risk) Risk level must be reduced. Assess structure by considering scenario/event based approach
Significant risks which are likely to require prevention, control, mitigation
M
If nominal loads apply, use them otherwise high sophistication analysis
If nominal loads apply, use them otherwise high sophistication analysis
Risks require further study to define probability, consequences, cost
L
Use low sophistication analysis, elastic analysis (nominal loads)
Low risk need not be considered further
Insignificant or minimal risk which can be eliminated from further consideration
It is also appropriate to note that uncertainties and/or sensitivities should be considered as part of the level of rigour of analysis chosen (based on the risk ranking). The uncertainties and sensitivities should also dictate the approach to the ensuing analyses. For example, a precautionary approach may be adopted where data are limited, the design is novel or manning levels are higher, (more than say 50, one TEMPSC load). 3.7.8.2 Low fire risk installations Where the fire risk category for the installation is low, the low risk methodology may be used. This applies not only to the definition of the fire hazard but also to methodologies in handling the response of structures, piping, and other SCEs. A suitable low sophistication means of defining the fire hazard is the use of valid nominal fire loads available in published codes and Guidance [3.18, 3.19 and 3.20] in the form of averaged and maximum heat fluxes. Sections 5.4 and 5.5 contain tables of revised nominal fire loads based on the results of recent research. Another acceptable means of fire severity determination for low risk installations is comparison with a specific past cases. Such comparisons should be supported by evidence that a structured assessment has been undertaken to identify areas of difference and that the original means of calculation were sound.
152-RP-48 Rev 02, Feb 2006
Page 77 of 261
fireandblast.com Extrapolation of data for the relevant parameters is not generally recommended but may be valid if a sound basis exists. The comparison process would incorporate consideration of the following factors: – The validity of the model used in the initial assessment; – The version of the fire modelling software used; – The resolution and precision of the grids used in the calculation if a computational fluid dynamics or CFD method is used; – Consideration of any substantial physical differences between this and previous cases. The nomination of a typical installation to represent a fleet of platforms may be acceptable 3.7.8.3 Medium fire risk installations Where there are no suitable past cases for comparison, then the level of analysis appropriate for high risk installations should be used for fire hazard assessment. Therefore, it is recommended that for medium risk installations the choice of methodology for any particular task should be justified where it deviates from the high risk installation methodology. 3.7.8.4 High fire risk installations Where the potential risk level on an installation or within a compartment is high, this will warrant a commensurately high sophistication level of analysis. The ability of the installation and the safety critical systems on it to withstand the fire scenarios need to be accurately determined as any error could have a significant risk impact. The time before failure may also be an important consideration. This level of analysis would normally involve: – A complete set of fire scenario investigations; – A combination of CFD and phenomenological fire simulation with knowledge of the frequencies of release and ignition; – Determination and assessment of the structure and SCEs against the design fire loads including consideration of escalation potential; – Time dependent and possibly non-linear modelling of the installation and systems response. Escalation and interaction between fire and explosion scenarios shall be considered including the collapse of tall structures.
3.8 Particular considerations for floating structures, storage and offloading systems 3.8.1 Introduction Floating structures for production, storage and offtake have been used safely and reliably throughout the oil industry for many years. Early installations were primarily floating storage and offtake vessels, “FSO”, but today the modern floating production, storage and offtake vessel, “FPSO”, includes processing equipment and a higher level of sophistication. Consequently, the FPSO becomes an offshore producing installation, storage facility, and loading terminal all rolled into one unit. 152-RP-48 Rev 02, Feb 2006
Page 78 of 261
fireandblast.com The early “ship-shaped” vessels, developed in the 1980s, took advantage of a severe downturn in the tanker market and were converted from relatively new tankers. More recently, the tendency has been to use new, purpose-built, ship-shaped hulls, particularly for FPSOs associated with long lived projects. Conversions of tankers, both old and new, continue to take place. There are many different types of design, weather-vaning with internal or external turrets or spread moored that maintain a fixed orientation. The FPSO and the FSO present many of the same hazards to personnel and the environment, although the added complexity of production facilities on the FPSO increases associated risk. The guidance in this section relies heavily on the published guidance of UKOOA, [3.21] and the draft guidance being prepared by OGP [3.22]. This guidance document will adopt the OGP nomenclature and when considering an issue applicable to both types of floating installation will use the term F(P)SO. A number of features impact fire related hazards on floating installations; for example, the geometry of the layout, compartmentalisation, operations, fire scenarios, response characteristics of marine construction to fires and the vulnerability of marine systems associated with the motion, station keeping and stability. The effects of fire on these features are discussed further in the following sections.
3.8.2 Marine life cycle considerations F(P)SOs usually consist of a marine structure supporting process and utilities decks of a conventional offshore construction. These differing methods of construction are governed by differing regulatory regimes. For the UKCS, the application of SOLAS and MODU codes without demonstration of validation by the additional risk assessments normally required by PFEER will be insufficient for the treatment of fire events. Some specific attributes to be considered on F(P)SOs are; •
Fire-fighting in the enclosed compartments containing marine systems (e.g. engine rooms, DP control rooms, generators); fire fighting techniques will include inerting, with the ramifications this entails for personnel access and the requisite alarms
•
As the process and utilities modules are normally located above the vessels deck (and the cargo storage), the process and utilities deck areas will be large, usually of one or two levels. Segregation to avoid escalation of a fire can be achieved by separation of modules occasionally further separated by fire barriers, (this may or may not help explosion overpressures but will impair the dispersion of released hydrocarbons).
•
The fire risk analysis undertaken on F(P)SOs will consider the nature of the hydrocarbon fuel source as well. Due to the nature of the storage on F(P)SOs, the fields they are generally use for tend to be crude that can be stabilised fairly readily. F(P)SOs may be required to hold stored product in their cargo tanks for typically 3 to 7 days dependent upon their geographic location. The F(P)SO solution is therefore less favoured for more volatile reservoirs.
•
The (potentially) long process and utilities decks and their orientation with respect to wind conditions will be affected by the weather-vaning of the F(P)SO. The top decks should be designed to follow a hazard gradient from the most hazardous area with respect to fires (and explosions) to the least hazardous. This will generally be from the turret outwards. Due to the weather-vaning effects (either due to wind or current and their effects on the superstructure height and hull draft) the fires can escalate downwind and at the very least, toxic products of combustion will be distributed downwind. The layout should consider these additional hazards and the design should accommodate them to maintain levels of safety. (Some designs have used DP to adjust the F(P)SO orientation in the event of a release or a fire hazard
152-RP-48 Rev 02, Feb 2006
Page 79 of 261
fireandblast.com although the DP then becomes a Safety Critical Element and subject to the development of Performance Standards and integrity assessments required in the UKCS.) •
On an F(P)SO, escape routes and piping runs may be very long and tortuous and personnel may need to pass the origin of the incident to reach the Temporary Refuge. Consideration in the design of escape over long distances during incidents and incident escalation should be a key issue.
•
Fire water mains will also be extensive and distant from the fire pumps in the process area. Correct fire-pump sizing and firewater-main hydraulic analyses will be required to ensure adequate pressure at deluge points, hoses and monitors.
•
Buoyancy, stability and station-keeping must be maintained at all times, and the systems associated with these duties must be protected from fire hazards.
F(P)SOs also require specific consideration of major fire hazard and release scenarios unique to their design and operation. •
Oil storage tanks – May present hazards in the form of either large scale storage of stabilised crude or with empty storage tanks containing potentially explosive mixtures.
•
Non-process hydrocarbon inventories – The F(P)SO is a power-hungry installation and requires substantial stores of diesel to maintain station, process and utilities power demands plus other life-support systems. The vessels are often located in difficult or remote places and will generally be designed to be “self-sufficient” for extended periods in the event that supply vessels cannot reach them.
•
Jet fires on main deck – The process decks on F(P)SOs are often lifted clear of the cargo storage tank roof for several reasons, (see bullet points below) a 5metre gap is not uncommon. The space provided also allows jet fires from the underside of the process to reach other process or utility modules without any impingement to reduce the effect of the flame. The gaps provide other risk reducing and operational benefits but steps can be taken to reduce the likelihood of jet fires by careful layout and orientation of the higher pressure equipment.
•
A gap will allow “green water” to flow over the main deck without placing an excessive load on the process modules supports by creating restrictions and eddy current effects.
•
A gap allows a clear and uninterrupted space for long piping runs (both process piping and storage tank vent and balancing lines)
•
A gap allows personnel access across the vessel, both for normal operational and maintenance access as well as facilitating emergency response.
•
Swivel connections, a source of releases – The turret contains a large number of swivel joints in order to function, these are often at the highest process pressure and pass the reservoir fluids prior to any cleaning or conditioning and are therefore subject to the F(P)SOs most onerous process duty.
•
Offloading and pool fires on the sea – Offloading to shuttle tankers is a regular event and poses a significant risk both on the F(P)SO and the shuttle tanker. The risks comprise the breakage or leakage of the transfer hoses and the potentially flammable mixing of hydrocarbon and air in the storage holds of F(P)SO and shuttle tanker. During the offloading operation, the shuttle tanker and F(P)SO are in relative proximity and the risks on either vessel are compounded by increased potential for escalation to another vessel.
152-RP-48 Rev 02, Feb 2006
Page 80 of 261
fireandblast.com
3.8.3 Application of fire hazard management to floating structures 3.8.3.1 Topsides considerations The storage and transfer of hydrocarbons on F(P)SOs present particular hazards to personnel and the environment and some of these have been listed above. This sections describes further measures that can be applied to the management of fire hazards in the F(P)SO topsides. There is a need to continuously vent hydrocarbon vapours during loading, it is important that the venting system be designed to accommodate the maximum volume of volatile organic compounds (VOCs) vented from storage. Allowance must be made the higher temperatures the vents will experience when venting during maximum production rates and as well as providing design allowances for possible process upsets. In some areas, local regulations or guidelines limit the amount of VOCs that may be released to the atmosphere. It is always good practice to adopt loading procedures that will minimise VOC emissions. The atmosphere in the F(P)SO tanks is to be maintained in a ‘non explosive’ condition. The normal method is to supply low oxygen content combustion products to the tanks from boiler uptakes or from an independent oil or dual fuel generator. Cargo tank purging must be carried out before introducing air to the tank to ensure that the atmosphere will at no time enter the flammability region. The guidelines given in Chapter 10.0 of ISGOTT [3.23] should be strictly adhered to during this operation. F(P)SOs need special consideration due to the potential venting of hydrocarbons either near the process plant or near the flare stack. Calculations will have to be made at the design stage to ensure that carry over of hydrocarbons from the inert gas stack will not interfere with day to day operations. It is recommended that the inert gas system comply in all respects with the requirements of SOLAS and the relevant IMO guidance notes. Prudent operators may also consider maintaining 100 % redundancy for this critical component. After purging, the tank must be gas freed in order to remove the residual inert gas from the tank and replace it with a normal atmosphere containing 21 % Oxygen. The issue of VOC return lines and their use during offloading represents a key safety issue. The operation of VOC reclamation represents a highly hazardous situation where flammable mixtures of hydrocarbons are returned to the F(P)SO. An added complication is that the offloading and reclamation systems may often be combined as a dual hose system and for F(P)SOs with stern accommodation, the offloading and reclamation point may be located close to the accommodation and TEMPSC. Due to the longer term storage (compared with most other offshore installations), water and other contaminants in the crude can accelerate corrosion of the F(P)SO storage structure and systems resulting in premature failure and, potentially, escape of hydrocarbons. Design allowances should not be based on ideal crude conditions but should consider a realistic appreciation of operational practices. 3.8.3.2 Vessel and marine considerations The layout of surface and sub-sea facilities must be carefully considered early in the design to account for the following shipping related hazards (that may give rise to loss of integrity and fire): 1. Passing ships and local community activities, such as fishing; 2. Supply and maintenance vessels in relation to anchoring or dropped objects; 3. Anchor mooring patterns of drilling rigs during locating and moving; 152-RP-48 Rev 02, Feb 2006
Page 81 of 261
fireandblast.com 4. Safe access by offtake tankers, avoiding interference with other moorings, flowlines and risers as well as other field operations. The field layout must also consider the need for offtake tankers to approach the F(P)SO, moor, load their cargo, unmoor and proceed to open waters, always in safety. The parameters for achieving this, which will include manoeuvring areas and weather limits on operations for the tankers, may be derived by means of a risk assessment study as described in OCIMF Offshore Loading Safety Guidelines [3.24] – With Special Reference to Harsh Weather Zones. Additional reference material for Offshore Loading may be found in UKOOA’s guidelines for tandem off-loading from FPSOs/ FSUs to shuttle tankers, [3.25]. Thrusters may also be useful in fire or platform abandonment scenarios where the vessel can be rotated to clear fire or smoke from around production areas and living quarters and to provide a lee side for survival craft launch. It should also be noted that thrusters may well be Safety Critical Elements. Due to the vessels being in very close proximity, the risk of a fire or explosion on one vessel affecting the other is greatest during offloading. It is important that the F(P)SO is equipped with emergency shutdown and release equipment that will allow the vessels to part in the event of an emergency on one vessel.
3.9 Particular considerations for mobile offshore units 3.9.1 Introduction Units that work in the North Sea will generally conform to three types of which two are more common. Ship-shape units are not often used for drilling, as their motion characteristics are often not suitable for drilling in harsh weather. A small number of construction and well intervention vessels work in the calmer weather months. Most MOUs in the North Sea are of two types, Semi-submersibles and Jack-ups. Semisubmersibles have more in common with floating structures while jack-ups have more in common with fixed structures. This specialist subset is termed Mobile Offshore Drilling Units, or MODUs. Though they are fundamentally different from each other, they do have one thing in common. They are vessels subject to the Conventions and Codes of the International Maritime Organisation, or IMO, and thus emanate from a long-standing marine tradition.
3.9.2 MODU classification The UK Safety Case Regulations do not stipulate design safety cases for MODUs. However, MODUs are subject to Classification Society rules for design, construction, and operation. Generally, certificates are subject to renewal every five years with intermediate surveys of a less intrusive nature ranging from every year to every two and one-half years. General areas of interest with respect to fire hazards include such items as: •
Structural fire protection layout plan for decks and bulkheads;
•
Fire extinguishing systems;
•
Recommended sequence of emergency shutdowns;
•
Hazardous areas.
152-RP-48 Rev 02, Feb 2006
Page 82 of 261
fireandblast.com The ABS published Classification Guidance contains a whole chapter on Fire Safety Features, including: •
Fire control plans;
•
Fire pumps;
•
Fire main;
•
Hydrants, hoses, and nozzles;
•
Fixed fire fighting systems;
•
Extinguishing systems (CO2, foam, water spray, portable extinguishers, etc.);
•
Fire detection/alarms;
•
Gas detection/alarms;
•
General alarm;
•
Area or specific alarms;
•
Fireman’s outfits;
•
Other PPE;
•
Helifuel;
•
Paint lockers.
Any reader will quickly note there is a distinctly marine “feel” to the rules. This is appropriate as hydrocarbons are seldom present on MODUs as much of their time is spent in transit between locations, thus the threat of types of fires that occur on ships is given attention. In the main, Conventions and Codes of the IMO are meant to apply to vessels on international voyages, not when the vessel is undertaking its industrial function. Though these rules are prescriptive, the great number of ships in the world’s fleet lends of validity through experience. Marine tradition refers to conventional ships on long distance voyages who must cope with mishaps such as shipboard fires and explosions with faint prospects for immediate rescue. This tradition has within it the experience of thousands of ships but scant experience of live hydrocarbons. Perhaps it is best characterised as highly worthy knowledge in its own right but not directly coincident with the newer oilfield traditions. Obtaining and remaining in class is very important for a MODU. Otherwise, it would not be able to obtain hull insurance. Minimising losses is important for underwriters so MODUs are able to benefit from loss reduction strategies of the world’s fleet of ships, and the considerable reservoir of experiences thus represented.
3.9.3 Conventions, codes and regulations 3.9.3.1 General MODUs are also subject to flag-state rules for operation under the conventions (roughly equivalent to regulations) and codes (roughly equivalent to guidance) of the IMO. The flag-states are responsible for enforcing the conventions and codes of the IMO through their national legislation. The most significant IMO instruments are the international conventions for: •
Safety of Life at Sea (SOLAS) [3.3];
•
Prevention of Pollution from Ships (MARPOL) [3.26];
•
Load Lines (LL) [3.27];
•
Standards of Training, Certification and Watch-keeping (STCW) [3.28];
152-RP-48 Rev 02, Feb 2006
Page 83 of 261
fireandblast.com •
Preventing Collisions at Sea (COLREG) [3.29];
•
Tonnage Measurement (Tonnage 69) [3.30].
For the purpose of this guidance, SOLAS is the most relevant and receives expanded treatment. Two versions of IMO MODU Code are also important, the 1979 and 1989 versions of the Code for the Construction and Equipment of Mobile Offshore Drilling Units [3.21, 3.32], or MODU Code [3.33], covered later in this section. 3.9.3.2 SOLAS SOLAS Chapter II Construction – Subdivision and stability, machinery, and electrical installations The parts of interest (within SOLAS) are: Part D – Electrical Installations: Precautions against shock, fire, and other hazards of electrical origin Part E – Additional Requirements for periodically unattended machinery spaces: Fire precautions, alarm system, safety system, and special requirements for machinery, boiler, and electrical installations SOLAS Chapter II – Fire protection, fire detection, and fire extinction The whole of Chapter II is relevant. Coverage includes: •
fire pumps;
•
fire mains;
•
hydrants/hoses;
•
fixed gas fire-extinguishing systems;
•
fire-extinguishing arrangements for machinery spaces;
•
foam systems;
•
water systems;
•
arrangements for fuel/lubricating oil/other flammable oils;
•
ventilation;
•
fire control plans, etc.
Details for passenger ships, cargo ships, and tankers are given and will be of interest for informational purposes. 3.9.3.3 MODU code There are two versions of the MODU Code. The 1989 Code [3.34] is meant to be applied to units constructed after 1 May 1991. The 1979 Code [3.35] applies to earlier units. The 1989 Code addresses fire/explosion safety in the following chapters: Chapter 4 – Machinery installations for all types of units 4.7 – Arrangements for oil fuel, lubricating oil, and other flammable oils Chapter 5 – Electrical installations for all types of units 5.5 Precautions against shock, fire, and other hazards of electrical origin 152-RP-48 Rev 02, Feb 2006
Page 84 of 261
fireandblast.com Chapter 6 – Machinery and electrical installations in hazardous areas for all types of units 6.1 to 6.7 – Zoning of hazardous areas and the types of machinery in these areas Chapter 8 – Periodically unattended machinery spaces for all types of unit 8.3 – Fire safety Chapter 9 – Fire safety 1 to 13 – Structural fire protection, accommodation, means of escape, fire pumps/mains/hydrants & hoses, systems in machinery spaces, portable extinguishers, fire detection & alarms, gas detection & alarms, firemen’s outfits, helicopter facilities, storage of gas cylinders, and miscellaneous items.
3.9.4 Overview of MODU operations on the UKCS MODUs operating in the North Sea area are generally prepared to drill a range of wells of different types in order to meet the needs of the client oil companies. Though there are fire risks from flammable materials on MODUs, about half the risks with the greatest consequences are presented by the hydrocarbon accumulation the MODU has been hired to exploit. The Formal Risk Assessment required in a UK or North Sea safety case overlays all the provisions from fire and explosion protection that Classification, the flag-State rules, and MODU Code. However, there are two main differences. • 4.
The rules emanating from the IMO are prescriptive. The risk reduction model is the marine industry acting on the experiences of the world’s shipping fleet. The model of model of application is for ships on international voyages, not vessels undertaking industrial processes.
3.9.5 The UK safety case Generally, oil companies hire MODUs to pursue drilling campaigns. The campaigns can be short (one well of less than 30 days duration) or as long (3 years or longer on rare occasions). In the UK, it will be necessary to for the MODU to have an accepted safety case before drilling can begin. The main hazards a MODU faces are listed below: •
Helicopter crash;
•
Fire;
•
Explosion;
•
Major mechanical failure;
•
Blowout;
•
Toxic release;
•
Dropped object;
•
Structural failure;
•
Mooring failure;
•
Ship collision;
•
Loss of stability;
•
Towing incident.
152-RP-48 Rev 02, Feb 2006
Page 85 of 261
fireandblast.com The most serious of these incidents requires a PFEER Assessment [3.35] in order to be sure the personnel can escape to a place of safety. The assessments MODUs generally undertake are as below. It is worthwhile pointing out that the MODU Owner will generally engage the crew in a compartment-by -compartment analysis for fire and explosion risk. This utilises the greatest asset – the rig crew who are exposed to the risk. Following from this approach, the qualitative method is preferred. Such QRA as takes place is generally done to meet statutory requirements for integrity of the Temporary Refuge. The QRA calculations are most often done by consultants outside the MODU Owner’s organisation. The crew are generally not in the habit of assimilating such information. Table 3-10 Typical hazard list showing preliminary PFEER assessments Fire & explosion consequences
Item no.
Type of event
1
Shallow gas blowout, subsea
Yes
MODU Owner depends on the client oil company site selection and shallow gas detection by seismic plus experience in the area (if available)
2
Shallow blowout in cellar deck
gas the
Yes
Usually occurs when the riser is attached (semi) or drilling out the first (structural) string of pipe (jack-up). Same comments as shallow gas blowout, subsea, above, apply.
3
Reservoir blowout at drill floor
Yes
The client oil company’s drilling programme is required to analyse and predict reservoir content (gas or oil), pressure, and temperature, any other relevant characteristics.
4
Toxic gas release
No
This scenario is meant to cover precautions against the toxic effect of H2S on personnel. MODU Owner depends on the client’s drilling programme.
5
Gas release/ignition in mud processing areas
Yes
Caused by gas entrained in the drilling mud. Consequences are more severe for oil-based mud. MODU Owner “works as directed” by the oil company and thus depends on oil company’s drilling programme and consultation with his site personnel to predict the likelihood of and to control this event.
6
Well test area fire/explosion
Yes
Occurs during flow testing of wells only.
7
Accommodation fire
Yes
Covered by class, flag-state rules, and MODU Code
8
Machinery space fire/explosion
Yes
Covered by class, flag-state rules, and MODU Code
9
Helicopter crash into the sea
No
Client’s standby vessel covers this scenario
10
Helicopter crash on the installation
Yes
MODU helideck requirements are the same as for fixed producing installations, per ICAO rules for design, augmented by such instruments as CAP 437 [3.36] in the UK.
152-RP-48 Rev 02, Feb 2006
Comments and description
Page 86 of 261
fireandblast.com
Item no.
Type of event
Fire & explosion consequences
Comments and description
11
Collision
No
MODUs have provisions for survival in damaged conditions. They rely on the client oil company to provide information such as proximity so shipping lanes and on the clientcontracted standby vessel to warn errant vessels away.
12
Structural failure due to extreme weather
No
Covered by Class, flag-state rules, and MODU Code
13
Mooring failure
No
Covered by Class, flag-state rules, and MODU Code
14
Loss of stability
No
Covered by Class, flag-state rules, and MODU Code
15
Loss of control in transit
No
i.e. loss of towline
16
Man overboard
No
Client’s standby vessel covers this scenario.
Half of the events above that cause most serious concerns on a MODU involve fire and explosion. This is a very significant proportion. Thus, the question occurs as to how the fire and explosion expert(s) might apply themselves to reducing the risks MODUs face. The information given below is meant to stimulate further consideration. Particular circumstances and personnel roles will have large roles to play. From the hazard events itemised above in Table 3-10, it can be seen that of 16 event categories, 8 consider fire (and explosion) events. Event categories in item numbers 1, 2, 3, 5 and 6 are caused by well upsets and three of the remaining hazard categories consider non-well events such as; •
Accommodation fire
•
Machinery space fire/explosion
Which are covered by classification, flag-State and MODU Code, and: •
Helicopter crash on the installation.
Which is common to all installations and is considered by the design guidance in CAP 437. The inspection of helidecks is covered by BHAB inspection of the installation.
3.9.6 Pre-hire surveys Many oil companies use 3rd party inspectors to perform pre-hire checks on the rigs they intend to contract. The items listed below cover many equipment categories that the surveyors generally cover which will have an impact on fire and explosion hazards. Typical items for pre-hire surveys: •
Well testing equipment;
•
Electrical safety;
•
Automatic fire detection system;
•
Fixed fire extinguishing systems (water & foam);
152-RP-48 Rev 02, Feb 2006
Page 87 of 261
fireandblast.com •
Breathing apparatus;
•
Electric safety;
•
Blow out prevention equipment (BOPs);
•
Well control equipment;
•
Fire control system;
•
CO2 system for fire control;
•
Portable extinguishers and fire fighting equipment;
•
Gas detection system;
•
Safety.
3.9.7 Classification society surveys Classification societies will carry out surveys of vessels to ensure that they continue to comply with class requirements; these will be carried out against the rules issued by the class societies referred to throughout this section. The survey reports generally stay on the unit and at the field office.
3.9.8 The well programme The well programme lays out the plan for drilling the well, including predictions for formations to be encountered, along with the types of fluid in the formations (oil, water, or gas). Part of the programme will deal with site assessment, covering the prospects for encountering shallow gas. The programme should offer information regarding whether H2S is likely to be encountered. The type mud system to be used will be detailed for each hole section. If well testing is foreseen, the details of the flow rates likely to ensue will be given along with the duration of the test and the sampling foreseen. Well testing is given separate treatment below. There is no equivalent of a design safety case for wells. However, the Safety Case Regulations require operators to apply a process termed Well Examination. This regulation requires that operators file their well programmes with the HSE a minimum of 21 days before operations are due to begin. The details to be submitted are spelled out in some detail. If there is no objection from the HSE, work can begin. However, if there are material changes in the well programme, an independent, competent person known as a Well-Examiner, must agree the change does not pose an increase in risk. For the MODU Owner, the effect of Well Examination is that the programme is fixed in good time for them to interpret it and make ready for it. It also ensures there is a process for ensuring changes are subject to analysis for risk. The well programme covers 5 of the 8 contingencies involving fire and explosion.
3.9.9 The MODU safety case safety management system The UK Safety Case and supporting regulations entail a robust Safety Management System (SMS). One component of the system is an active system of audit. Another is the Verification of Safety-critical Elements – those elements or systems vital to the safety of the personnel on the MODU. The SMS audits and verification scheme can be a source of information readily available to the interested fire and explosion specialist.
152-RP-48 Rev 02, Feb 2006
Page 88 of 261
fireandblast.com
3.9.10 Well testing Though the Well Programme covers the objectives of well testing, it may not provide copious detail on the well testing equipment. On many rigs, well testing equipment is not permanently installed. It is brought to the rig when well testing is foreseen. On rigs where the installation is permanent, maintenance of such equipment is not generally with the core skill and experience of the drill crew. Few drilling specialists have extensive experience testing wells. The safety case can only generally cover the well testing equipment and cannot be very specific as there are many different manufacturers, different layouts for this equipment, and different crews generally man the well test equipment. Therefore the constructive overview of a fire and explosion specialist should be welcome in these circumstances.
3.9.11 Recommended approach The following is written from the aspect of an oil company contracting for the services of a MODU. Generally, the oil company will likely have staff or have access to 3rd party specialists specialising in fire and explosion. MODU Owners generally do not. In this situation, it seems natural for the oil company specialist to at least have an overview. It is probably sub-optimal to ask the MODU Owner to do everything; on the other hand, it is probably sub-optimal to make numerous in-depth enquiries of the MODU Owner when many aspects are covered by Classification or flag-State rules. What is recommended is a cooperative, balanced, and constructive overview into all aspects of fire and explosion aspects. Any enquires should respect the culture and strength of the MODU Owner. Chief amongst these is that the MODU Owner’s greatest asset is the crew. Some of their number will have participated in or have knowledge of the rig’s treatment of fire and explosion. Rig crew use the “hands on” approach. Thus, their expertise can best be accessed by qualitative data, as it is the type of data they are most used to dealing with. Finally, remember the marine approach should be seen as counting for something. Though the rules are prescriptive, the nature of their derivation makes them statistically valid as most have been derived from experiences of the world’s shipping fleet. Given the diverse character of information for fire and explosion on MODUs, the approach given below could function as a starting point(s).
152-RP-48 Rev 02, Feb 2006
Page 89 of 261
fireandblast.com Item
Overview
MODU Classification
Be aware of the Classification Society. Look up and become familiar with their rules. The MODU Owner will have records of the ongoing surveys.
Flag-State
Be aware of who the flag-State is. Look up and become familiar with their rules. The MODU Owner will have records of the ongoing surveys.
MODU Code
Be aware if the unit has a certificate and whether it is 1989 or 1979. Be familiar with what it contains.
Safety Case
Be aware of the analyses in the safety case for fire and explosion, especially those with PFEER Assessments. They represent the risks with the most severe consequences.
Pre-hire survey
Have a look at the fire and explosion aspects of the pre-hire survey, provided, of course, such a survey was performed.
Well Programme
Have a look at the well programme from the point of view of the MODU Owner. Judge whether you would be happy with the information in the programme in terms of preventing fire and explosions? If not, it would be a service to both oil company and MODU Owner to point out where better information would be beneficial.
SMS Audits
The MODU Owner’s own audits can provide information on the standard of maintenance. It would be a good thing to be aware of the audit findings. Further delving could be undertaken if an overview gave cause for concern.
Verification Safety-critical Elements
of
Well testing
The same comments apply here as above for SMS audits.
Probably the area where the fire and explosion expert might make best input. Well testing can be infrequent and thus less familiar. An overview of the equipment, procedures, and risk analyses may well prove beneficial in terms of risk reduction.
3.10 Particular considerations for existing installations 3.10.1 Application of fire hazard management to existing structures 3.10.1.1 General Much of the preceding guidance has been written with design of new installations in mind. For existing installations, the elements of the overall platform fire protection design will have already been fixed. Unless the existing fire risk is found to be unacceptably high, major changes are unlikely to be justified. The challenge for existing installations is in •
Continuing to ensure all the design arrangements for fire hazard management operate as intended throughout the long life of the installation.
•
Ensuring that if the design or the operation changes, the fire management is reviewed and changed where necessary to suit the changed fire hazard.
There are slightly different considerations to be borne in mind at different stages of the field life. Some typical examples of issues for the early, mid and the late stages of field life are provided below to illustrate this point. 3.10.1.2 Early operating phase Vigilance is required in the early stages of field life for deviations from the original process, structural, mechanical or instrument design intent. Such changes need review for any implications for fire hazard creation or management. Such a review needs to be scheduled and chaired by the project safety engineer and attended by a mixture of design and operations personnel. It should take place after a year or two of operation. Since key project design personnel are likely to have 152-RP-48 Rev 02, Feb 2006
Page 90 of 261
fireandblast.com moved to another project by that stage, an alternative would be for operations to log all variations to original design, operating or maintenance assumptions/intent for formal follow-up by the installation safety engineer in order that the implications for fire hazard management can be explored and corrective action taken if found necessary.. Nowadays, plant modifications are closely scrutinised by a range of discipline engineers and onshore support staff for any detrimental effect on safety. Accumulated minor operating and maintenance changes (known as ‘creeping change’) however can go unremarked, unless vigilance is maintained. Examples of the types of change that would not be obvious without a specific attempt to capture them are: •
Environmental data (sea level or weather pattern changes);
•
Instrumentation problems – e.g., leading to changed operator response to alarms;
•
New fire research findings;
•
Change in production composition or phases, leading to changed fire scenarios or release frequencies.
3.10.1.3 Midlife operating phase Some typical considerations for fire hazard management of existing installations at the mid-life stage are: •
Creeping change in original design assumptions – examples are development of sand, vibration or corrosion problems, increasing the likelihood of releases in certain areas; changes in process conditions resulting in change to fire consequence modelling assumptions;
•
Fire-related protective equipment proves unsatisfactory in operation – detection devices give frequent alarms or are found to be failed at every inspection. Alarms that are too frequent are eventually ignored;
•
PFP left off vessels or other equipment for longer and longer periods to allow access for NDT/inspection;
•
Areas of the platform always ‘keyed out’ of the automatic fire and gas system;
•
Very slow process changes which come to be regarded as normal by operations personnel (e.g. more frequent alarms, very low or high operating temperatures etc.).
If minor deviations go un-noticed, over time it becomes custom and practice to operate outside the original design scope, and/or without all protection functioning. Problems then become apparent only during an emergency situation. Many of these minor changes would be identified by the independent competent person during the course of his examinations of safety critical equipment and systems, but some changes can still be missed. Most oil companies include operations personnel in their project teams. Often one or both intended OIMs plus key offshore supervisors are part of the project team specifically to become fully conversant with, and supply input to operations and design issues. Over a period of 10 years or so however, personnel change and key information, whether held personally, in hard-copy or in electronic format is likely to be lost if no active steps are taken to refresh the ‘corporate memory’ at regular intervals. In addition, over time, new research improves the understanding of the fire threat and the ability of the designed fire control measures to effectively counter the threat. The implications of this knowledge need taking into account and where necessary the emergency response procedures updated. 152-RP-48 Rev 02, Feb 2006
Page 91 of 261
fireandblast.com It is thus recommended that a formal review (taking into account new research knowledge) or audit of the fire hazard management arrangements and records be carried out every 3 to 5 years. 3.10.1.4 Late operating phases As platforms age the safety systems tend to require more repair and maintenance in order to keep them in full working condition. The late operating phase is also a time when the platform production tail off and there is a big drive to reduce OPEX costs. Fortunately, as platform age and production rates drop, process pressures also drop, water cut increases and fire risks tend to reduce. It is possible on some installations, where parts of the process have been simplified or decommissioned or where drilling activity is finished, to review a platform’s fire hazard management arrangements and remove fire protection equipment that is, by then, surplus to requirement. This can reduce the maintenance burden. Any such modifications have to be formally justified and recorded through the Operator’s Plant Modification Request procedures, and documented in the Safety Case and associated PFEER/DCR documentation. Typical Problems for the Late Operating Phase are: •
Degradation of Passive Fire Protection;
•
Corrosion of firewater systems and leaks in air-trigger systems;
•
Wear and tear on firewater pumps and deluge valve sets;
•
Obsolescence of parts for Fire and Gas detection/protection systems;
•
Increased leak likelihood due to sand erosion, corrosion (especially under lagging) and fatigue;
•
Tightened commercial constraints and reductions in manning.
Despite the associated cost of maintenance and inspection, the performance standards laid down for of all the safety critical systems, subsystems and individual items must either: •
Continue to be met as per the original design;
•
Revised (with appropriate justification) to reflect the changing fire risk. The associated written schemes would be updated to reflect the changed performance standard in discussion with the appropriate Independent Competent Person(s).
or
3.10.2 Life cycle considerations During the operational phase, vigilance over the fire hazard management must be maintained. Some of the changes that will need to be reviewed and assessed in other phases of the lifecycle are covered in the table below:
152-RP-48 Rev 02, Feb 2006
Page 92 of 261
fireandblast.com Table 3-11 Life cycle considerations for fire hazard identification and protection measures Life Cycle Phase
Fire Hazard and Fire Protection Issues
Installation and commissioning
Checklists, commissioning procedures and test schedules are required to ensure that design is properly installed and performs as intended.
Early Operational Phase
Regular maintenance and testing to ensure performance standards met for continued operation as design
Mid Operational Phase
Continue to be vigilant for creeping change for example, to platform process conditions.
All design modifications subject to appropriate ‘Plant Modification Request’ procedures Late Operational Phase
Repair or replace parts of system subject to unacceptable wear and tear, continue to ensure performance standards are met, regardless of OPEX constraints, while production continues. HOWEVER: Where fire hazard is proven to be reduced some protection system removal may be justified and maintenance burden reduced. Any changes to original design concept to be formally justified and recorded in platform Safety Case and PFEER/DCR documentation.
Asset life extension
See Section 3.10.3 below
Decommissioning
Fire risk profile for installation changes. Production fire risk reduces as plant is isolated, hydrocarbon-freed and removed. Other fire risks introduced e.g. gases for flame-cutting or fuel for temporary plant Fire protection needs to be based on fire risk assessment of each stage of decommissioning plan. Proper isolation from pipelines and reservoir must be ensured
3.10.3 Aging installations and life extension 3.10.3.1 Overview Many installations in the North Sea have reached the end of their originally stated life span but are still producing sufficient quantities of oil to make continued operation worthwhile. Other installations, although no longer producing oil from their own wells are being modified to act as production hubs, taking oils from other subsea wells in the area and processing it, often with new or modified topsides plant, for export to pipeline or tanker. Asset life extension raises several issues in relation to fire hazard management, these are discussed in the following sections. 3.10.3.2 Design Issues: New process plant needs to be provided with adequate fire and gas detection systems. The existing systems may be adequate to cover the new equipment or may need extending, but the same considerations as for a new design will still apply. The existing system may be virtually obsolete and not feasible to extend so replacement of the whole system may be required. The effect of the new plant on the ESD and blowdown systems must be evaluated in the light of the additional fire scenarios. It should not be assumed that tie-in to the existing platform blowdown system will be adequate, even though original demands on the system may have reduced. If the 152-RP-48 Rev 02, Feb 2006
Page 93 of 261
fireandblast.com installation is old, the original blowdown system may have been under-designed by comparison with existing best practice especially where severe fire scenarios are involved. All new fire scenarios must be reviewed for effect on existing deluge systems. A fire in the new plant may set off several other systems, especially on an open installation. The project may have to supply new fire pumps to cover the new plant as the existing pumps are unlikely to have spare capacity. The condition of existing pumps for extended future service must be assured. More use of passive protection may be possible, but integrity assurance for aging piping/structure/equipment must be provided for Existing deluge systems are often difficult to extend. The mechanical condition of the system needs to be assured for extended service. There may now be a new fire scenario with implications for important parts of the structure (e.g. the TR or TEMPSC areas or their supports) which are currently unprotected. (See Sections 3.5.2 and 7.3.2.2 for further discussions on the limits to PFP application, including some issues affecting retrofitting PFP to structures in situ). All escalation potential should be considered, and the decisions relating to selection of protection recorded. New fire scenarios must be evaluated for impact on evacuation, escape and rescue. New support structure provided for the new plant may be vulnerable to fire impingement from existing fire scenarios, and may require protection. 3.10.3.3 Operations Issues: There is a tendency for this type of work to be carried out in isolation by small project teams within narrow boundaries in order to keep costs down. The project teams try to keep documentation updates to the bare minimum in standalone, project specific reports. It is essential that operations personnel are involved in the project and offshore personnel are specifically trained on the implications of the change for fire hazard management. 3.10.3.4 Emergency Response Issues: As platforms age, emergency equipment and facilities degrade. Although some items can be easily replaced once they fall below an acceptable standard, other items such as sea ladders, spider deck walkways, gratings on rarely-used escape routes to sea can fall into disrepair and are expensive to replace. Routes to sea are important in severe fire scenarios and must be kept up to standard as long as the fire hazard remains. Where new business is introduced over an old installation, new escape routes, as well as refurbishment of existing routes (where the original fire hazard still exists) may be needed. 3.10.3.5 General Considerations Fire hazards would be identified in the HAZID at FEED stage of the process modification design, and subsequently assessed as for any new design project. The impact of the new facilities on the existing fire and gas detection and protection systems needs to be documented and recommendations tracked to implementation. Incorporation of new safety critical items into existing Safety Case, SCE and PS related documentation is a legal requirement.
152-RP-48 Rev 02, Feb 2006
Page 94 of 261
fireandblast.com
3.11 Particular considerations for accommodation and other areas for personnel 3.11.1 General Much fire measurement data, definitions and internationally accepted standard tests have been developed from building fires and the damage caused. Many of these have been adapted for use on the appropriate sections of petrochemical plants and their shortcomings in wider applications should be understood. The following sections deal with some standard aspects of conventional onshore fires but practitioners should refer to standards produced for onshore and civil use for these “non-hydrocarbon” areas. Accommodation and other areas of the installation such as control rooms, some workshops (i.e. those without specific storage requirements for hazardous materials), leisure areas and galleys are all based on normal architectural practices. The internal materials are the same as onshore facilities and the design practices tend also to be the same with minor variation. The key difference with these areas is how they relate to process and other operating areas and extreme care should be taken to make sure that even the most apparently benign systems do not interface with a hydrocarbon system in an unforeseen manner. Key aspects where interfaces can occur are listed below and these should be assessed when considering the process fire hazards: 1.
HVAC;
2.
Drainage;
3.
Storage areas/enclosures;
4.
Access (both for personnel using the facilities and working there and goods coming into or out of the area).
3.11.1.1 Compartment fires - general In a compartment or building fire, the source of ignition will normally be at a discrete location and the initial fire growth will be slow. The temperature in compartment will increase and a hot layer of gas will build up below the ceiling. A point is reached when re-radiation from this gas layer causes the unburnt furniture etc to ignite. Within a short space of time the entire contents of the compartment will be burning in a process called flashover. The severity and duration of a building fire depend on the amount of fuel and the ventilation conditions. Fires may be fuel controlled or ventilation controlled. Generally, ventilation controlled fires are more severe. The main difference between a building fire and a pool or jet fire is the nature of the fuel. Although buildings contain hydrocarbons in the form of plastics they also generally contain a large amount of cellulosic material in the form of paper, and wooden furniture. It is common, although not strictly correct, to refer to building fires as cellulosic. When assessing elements of construction for buildings the Standard Fire resistance Test fire is normally used. For some “fire engineered” designs a natural fire is modelled. The simplest natural fire model is the parametric fire although there are many, more complex, computer models for building fires
3.11.2 Compartment fires – parametric A parametric fire [3.37] is an idealised form of a “natural fire” in a building compartment. They provide a simple means to take into account the most important physical phenomena which may 152-RP-48 Rev 02, Feb 2006
Page 95 of 261
fireandblast.com influence the development of a fire. They take into account the fire load, the ventilation conditions and the thermal properties of the compartment linings. The natural fire is assumed to have a slow build-up with a pre-flashover period of ignition and smouldering, following flashover, the heat build-up is rapid and proceeds for some period dependent on the available fuel. There is then a post-flashover period where cooling takes place. The “standard fire” curve starts from an equivalent point at flashover and begins the heating phase directly. For the “standard fire” the heating rate continues (albeit at a slower rate) and does not reach a “cooling period”. The modelling of the temperature curve of the parametric fire also follows a similar logic of heating starting directly from a notional equivalent of the flashover point, i.e. without any preceding phase. The heating rate is then faster than for the standard fire but reaches a point where cooling commences. The cooling rate assumed for parametric fires is linear compared to the accelerating cooling of the natural fire. The parametric fire was developed to model mainly cellulosic building fires. It gives reasonable correlations against tests for modern office fires. It may often be more severe than the Standard cellulosic fire.
3.11.3 ISO, cellulosic (Standard fire) Building regulations throughout the world almost invariably require elements of construction to have fire resistance based on the standard fire [3.38]. This is an idealised fire defined by a timetemperature relationship and is the basis for fire resistance tests.
3.11.4 Temperatures The Standard cellulosic fire has, when compared with most other “design” fires, a low initial rate of temperature increase. However, the temperature rises logarithmically with no limit. It reaches 945 ºC in 60 minutes and 1153 ºC in 240 minutes. The temperature reached depends on the conditions in the compartment and in a typical office fire, the combustion products temperature will reach about 1300 ºC. The fire temperature will normally peak at about 45 to 60 minutes and decline steadily afterwards. Compartment temperatures will reduce to 200 ºC after 120 minutes.
4. Interaction with explosion hazard management 4.1 General The methods and systems for the management of explosion and fire hazards will have a degree of commonality. Some of these will be complementary, whereas others will serve a single function only. In addition, conflicts may exist between the successful management of explosion hazards and the successful management of fire hazards. Thus, a holistic approach must be taken in the management of both types of hazard. Hazard management will always be a series of compromises between economics, engineering, operability and risk reduction considerations. Successful hazard management involves identifying the best compromise between all these considerations, in compliance with any statutory obligations placed on the operator of the installation.
152-RP-48 Rev 02, Feb 2006
Page 96 of 261
fireandblast.com
4.2 Fire and explosion prevention methods 4.2.1 General It has to be accepted that the complete prevention of fires and explosions can never be attained. However, procedures and systems should be provided to reduce the frequency of such events to as low as is reasonably practicable. Such procedures and systems are detailed below.
4.2.2 Minimisation of leakage frequency The loss of containment of a flammable material is a necessary precursor to the occurrence of an explosion or fire. This can be avoided, as far as is reasonably practicable by: •
Fitness for purpose of all flammable material containment equipment and associated pipework.
•
The maintenance of the design fitness for purpose throughout the life of the installation. This requires that an adequate inspection and maintenance regime be in place throughout the life of the installation. In addition, care must be taken to ensure that the original design intent is not debased by subsequent modification that may take place within the life of the installation or lost via poor record keeping or industry take-overs and/or mergers.
•
Wherever possible, the number of potential leakage sources should be minimised. Typical of these would be instrument tappings and pipework flange connections. However, care must be taken in applying this philosophy as this may lead to an increased need for ‘hot work’ if modifications, replacement or repair of equipment becomes necessary.
4.2.3 Minimisation of ignition probability Given that the leakage of flammable materials cannot be totally prevented throughout the life of the installation, then an explosion or fire will only occur if the leak is ignited. The probability of such ignition may be minimised by: •
Adequate control of ‘hot work’ on live installations by the use of air-purged habitats. Alternatively, only carry out ‘hot work’ during an installation shutdown. (Noting that hot work should be avoided wherever possible, some installations have a ‘no hot work’ policy and insist on bolting etc., and carry out hot work only during a shutdown.)
•
The correct hazardous area zoning for electrical equipment and the correct selection and maintenance of such equipment.
•
The early detection of any leakage together with the necessary control actions to isolate all non-essential items of equipment which could potentially be sources of ignition.
Note that ignition probability per se, does not represent a true measure of risk. What are most significant are the time-delay between a leak occurring and the ignition of the leak, and also the time delay (if any) between the detection of the leak and the ignition of the leak. These are a function of the rate of ignition rather than of the ignition probability. The minimisation of ignition probability illustrates one of the many compromises that have to be arrived at in the management of explosion and fire hazards, whilst accepting that ignition probability must be minimised, in doing so it must also be recognised that the potential for a ‘long-delayed’ ignition increases. Under these conditions a severe explosion event may result.
152-RP-48 Rev 02, Feb 2006
Page 97 of 261
fireandblast.com
4.3 Fire and explosion detection and control methods 4.3.1 General The positive pressure phase of an explosion is in the order of a few hundred milliseconds. Thus, the effects of an explosion are realised immediately. Conversely, the time for the effects of a fire to be realised, even upon personnel, is of at least an order greater than that for explosions. Thus the early detection of a leak is of greater significance when explosion hazards are considered than when fire hazards are considered. It follows that leak-detection and associated alarms, are the only means of providing adequate warning to personnel. Fire-detection is of no value in this context. However, fire-detection is still of importance when fire hazards are considered. It may be that very rapid response fire-detection systems, such as those that utilise flamedetection, could detect an explosion before they are damaged by the explosion blast or drag effects. In addition, rapid response fire detection may also be of benefit with respect to the initiation of explosion mitigation systems (such as deluge on gas detection). As stated above, this would be of no significance when explosion hazards are considered. However, it may be important for the management of fire-hazards to detect any fire that may follow an explosion. This may provide an argument for the use of rapid-response fire-detection systems, where the frequency of occurrence of explosions is deemed to be significant. It may also provide an argument under the same circumstances for the automatic actuation of any active fire control and mitigation systems upon the detection of a leak.
4.3.2 Automatic release-detection systems and alarms. Two generic types of release detectors are available. These operate on: Type 1)
The detection of an accumulation of flammable gas from the release, or
Type 2)
The direct detection of a release based on its acoustic signature.
Type 1) detectors may be point detectors e.g. pellistors, or beam detectors. In each case, there is a requirement to assess the minimum flammable cloud size that should be detected. There is little guidance available to assist in this. One approach may be to consider both the thermal effects and the blast effects on a flammable cloud. The thermal effects may be assessed by treating the combustion of the flammable cloud as a fireball. The minimum cloud size, intended to be detected, may then be based on an acceptable probability of persons in the area surviving these thermal and blast effects. A range of figures for the probability of survival of detection systems following an initial blast load would be between 0.5 and 0.9. The lower end of the range has been used often in QRAs submitted to the Health & Safety Executive but a survival probability of 0.9 if other protective steps have been considered. Type 2) detectors appear to have an advantage over type 1) detectors in as much as they detect a leak directly. However, it is important that the sensitivity of such detectors is adequate; the advantage of leak detection is its sensitivity; there are definite benefits to detect leaks at as low rates as possible, this can be used to alert the operator even if a shut-down is not initiated at this stage of the incident. In addition, there is no clear evidence as to whether or not such acoustic detector will operate adequately when two-phase leaks occur. Thus it is suggested that the ideal leak detection system should employ both types of detectors. The detection of a leak should be annunciated on an installation-wide basis. All installation personnel, including visitors, should have received clear instruction as to the correct action to be taken on the receipt of such an alarm. The minimum cloud size to be detected should also consider the potential escalation. This assessment should be conservative due to the diversity of potential escalation paths and the analysts’ inability to assess them all. 152-RP-48 Rev 02, Feb 2006
Page 98 of 261
fireandblast.com
4.3.3 Automatic fire-detection systems and alarms. Only leak detection can provide adequate warning to personnel of a potential explosion hazard. Fire detection is of very limited value in the event of an explosion already having occurred. Several fire detection device-types are commonly available, they include: •
UV and IR flame-detectors
•
Rate of temperature rise detectors
•
Smoke detectors
•
CCTV with or without embedded flame imaging software
The flame-detectors will have the most rapid response of the above if they are in the vicinity of the fire. However, very early smoke detector (VESDA) systems can respond rapidly based on an arrangement where the detection system samples smoke at very low concentrations, this has often been used in sensitive enclosed areas, computer systems have a long history of being protected by VESDA systems. It is advisable that total reliance is not placed on flame-detectors alone. Conditions arise where fires are obscured by smoke and indeed, smoke generation is the major hazard to personnel. IR detectors may also be obscured by water, for example, triggering deluge on gas detection may impair subsequent fire detection, or the IR detectors may fail to register fire escalation to adjoining process systems. The fire-detection system should include a mix of each type of detectors and be appropriate to the mix of release/fire/explosion hazards considered in the escalation path. The comments concerning alarms made for leak detection are equally pertinent for fire detection.
4.3.4 Reducing the available inventory of fuel. This is of equal importance to the management of both fire and explosion hazards. Obviously, where explosion hazards are concerned, any beneficial effects will arise if the fuel inventory is partially or completely depleted before an ignition takes place. This contrasts with the situation where fire hazards are concerned, where the beneficial effects will continue to operate after an ignition takes place. However, these beneficial effects on the fire-hazard will only ensue if the automatic isolation and blow-down and flare systems are not damaged by any prior explosion, to such an extent as to prevent their correct operation. Isolation and blow-down valves should, wherever possible, fail to a “safe” condition; generally, this means that isolation valves “fail closed” and blowdown valves “fail open” although there can be extenuating circumstances for this rule. Especially for large high pressure valves, the actuators can be significantly large pieces of equipment, and their destruction in an accident can compromise the “fail safe” mode; such valve actuators should be protected against blast and drag-effect damage as much as reasonably practicable, but it must be accepted that there will be practical limitations on the extent to which this can be achieved. This emphasises the importance of early detection of leaks and the automatic initiation of the ESD and blow-down systems upon the detection of a leak. Whereas, ESD and blow-down systems do provide benefit in the management of fire and explosion hazards, it is important to realise that these systems alone cannot be relied upon to prevent subsequent failures of equipment or structural elements due to the effects of a fire. Blowdown systems are almost universally designed to API RP520 [4.1]. This requires that the internal pressure be reduced by 50 % or to 100 psig (22 barg); whichever is the lower; within fifteen minutes. However, even if this is achieved, a significant fire could still be ongoing which could cause failures, especially in congested areas. 152-RP-48 Rev 02, Feb 2006
Page 99 of 261
fireandblast.com
4.3.5 The significance of area ventilation 4.3.5.1 On explosions The equilibrium size of a flammable cloud, produced by the accumulation of flammable gas from a leak will be inter-alia, a function of the area-ventilation rate. The severity of an explosion following the ignition of such a flammable cloud, will be, inter-alia, a function of the mass of flammable gas in the cloud. Thus it follows that an increased rate of area ventilation will have a beneficial effect upon the explosion hazard. The possible disbenefit of this is that it could make early detection of a leak more difficult to achieve. Nevertheless, in most cases the balance of risk will come down in favour of maximising the rate of area ventilation. 4.3.5.2 On fires The influence of area ventilation rate on fires is less apparent than its influence on explosions. The research report [4.2] indicates that the suppression of pool fires by water/foam deluge systems is aided by increased wind-speed i.e. an increased ventilation rate. However, the possible distortion of the water spray pattern by the wind could mitigate against this. Where mechanically ventilated, enclosed areas are concerned; the internal wind-speeds are unlikely to be sufficient to distort water-spray patterns. Note that for enclosed areas, the rate of mechanical ventilation will usually be of the order of 12 air changes per hour. Research [4.3] has indicated that for naturally ventilated areas ventilation rates in the order of a few hundred air changes per hour are achievable. It is possible to shut down ventilation systems to provide ventilation control of a fire, but it should be noted that in order to prevent smoke and combustion products migrating along ducts if the HVAC is not shutdown and isolated, (which could lead to fire or fire effects spreading to other areas) that common practice is to shut down and isolate HVAC systems in all but the most critical areas (such Temporary Refuges) on confirmed detection of fire. 4.3.5.3 Maximisation of ventilation rates For existing installations, there are constraints to the options for increasing the existing ventilation rates. For mechanically ventilated areas, major refits are required for fans and ducting sizes, for naturally ventilated areas, the ventilation rate may be increased by the removal of any louvered wind walls. For ‘new builds’ the influence of the rate of ventilation on both fire and explosion hazards should be addressed in the design. For naturally ventilated areas a conflict may arise between protecting the temporary refuge against smoke ingress and the maximisation of area ventilation. It is conventional wisdom that wherever possible, the temporary refuge should be up-wind of the prevailing wind direction. There will normally be bulkheads between the temporary refuge and drilling and process areas. This means that the open sides of these areas will be at a right angle to the prevailing wind direction limiting natural ventilation. 4.3.5.4 Other factors influencing ventilation rate 4.3.5.4.1 Equipment layout The equipment layout within an area will have an influence on the area ventilation rate. The most efficient layout to maximise the ventilation rate will be the same as that to minimise the explosion hazard. Layout guidance can be found in Part 1 of this guidance. For existing installations, it must be accepted that little can be done to change the existing layout of equipment. For ‘new builds’ cognisance should be taken of the recommendations given in the FLACS explosion handbook. 152-RP-48 Rev 02, Feb 2006
Page 100 of 261
fireandblast.com 4.3.5.4.2 Influence of release rate The release rate of gas can itself have a significant influence on the rate of natural ventilation. The research report [4.4] provides some, albeit limited, data on this effect. Analysis of these data indicates that: •
If the leak is counter-flowing to the ventilation flow direction, the ventilation rate will be reduced.
•
If the leak is co-flowing with the ventilation flow direction, the ventilation rate will be increased.
•
If the leak is crosswind to the ventilation flow direction, the ventilation rate is effectively unchanged.
The following correlations are suggested as representing a conservative estimate of these effects. For leak direction counter to ventilation flow direction,
V ′ = V (1 − 22.4 x ) ...................................................................... Equation 4-1 where V
is the reduced ventilation rate (m3/s)
V'
is the original ventilation rate (m3/s)
x
is the gas release rate (m3/s)
For leak direction co-flowing with the ventilation flow direction,
V ′ = V (1 + 12.45 x ) .................................................................... Equation 4-2 where V
is the increased ventilation rate (m3/s)
V'
is the original ventilation rate (m3/s)
x
is the gas release rate (m3/s)
4.3.5.4.3 Influence of water deluge The research report [4.4] indicates that the presence of water deluge reduces the ventilation rate in naturally ventilated areas. The date on this is very limited and applies only to deluge rates in the order of 24 l min-1 m-2. It is suggested that a conservative estimate of this effect would be to reduce the area ventilation rate by 30 % when the area deluge system is operating.
4.4 Fire and explosion mitigation methods 4.4.1 Active fire-fighting systems The first, and most obvious, consideration of the interaction with the explosion events is whether or not the fixed fire-fighting systems would still be functional after an explosion. Water deluge systems should be provided with as much protection against the explosion effects as is practicable. For 152-RP-48 Rev 02, Feb 2006
Page 101 of 261
fireandblast.com existing installations, it must be accepted that little can be done in this regard. For ‘new builds’, this may be achieved by the judicious location of water deluge pipe-work. However, because of its very nature, such a system will be distributed throughout the whole of the area; it is likely that only a limited degree of protection could be provided. It is now well established that in well-vented areas, the presence of an area water deluge can reduce the severity of explosions. This would appear to be an argument for the initiation of water deluge, before the ignition of a flammable atmosphere takes place. The could have the benefits of reducing the explosion severity to an extent that the water deluge system in operation to control or mitigate the effects of any subsequent fire, and also prevent damage to automatic isolation and blow-down systems. Research report [4.5] provides correlations to estimate the reduction in explosion severity by area deluge. The correlations also demonstrate the variation in explosion severity with the gas concentration in the flammable atmosphere. The correlations are: In the absence of water-spray,
PE 2 = PE 1 e
( −17.693((E −1.0563) −(E −1.0563) )) ......................................... Equation 4-3 2
2
2
1
In the presence of water-spray,
PE 2 = PE 1 e
( −18.215((E −1.007) −(E −1.007) )) ............................................ Equation 4-4 2
2
2
1
where PE1
is the overpressure at equivalence ratio E1
PE2
is the overpressure at equivalence ratio E2
E1 =
C1 CS
E2 =
C2 CS
and C1
is gas concentration 1
C2
is gas concentration 2
CS
is the gas stoichiometric concentration
It is not possible to provide a generic correlation for the absolute reduction in explosion severity, as the domains in which the explosion takes place will vary from one another. However, it can be stated that the ratio of the unmitigated explosion severity to the mitigated explosion severity increases as the unmitigated explosion severity increases. Thus area deluge mitigation of explosions is most effective where very severe explosions can occur. This means that such a system will be most effective in large, congested well-vented areas. The mitigation of explosions by area water deluge will only occur when the explosion is accompanied by significant flame acceleration. In practice, this means large, well-vented domains. 152-RP-48 Rev 02, Feb 2006
Page 102 of 261
fireandblast.com Where this does not occur, such as in enclosed domains area water deluge will not provide any benefit, and in some cases, could increase the explosion severity. As has been stated above, the presence of water-deluge will result in the reduction of the natural ventilation rate. This will have the effect of increasing the equilibrium, size of the flammable cloud and also increasing the time required to disperse this flammable cloud. In ageing platforms, there has been a concern that the presence of water-deluge may increase the probability of ignition due to water ingress into electrical equipment. Thus, in any particular situation, the decision as to whether or not the activation of an area waterdeluge is appropriate can only be informed by an assessment of all the above factors. Water-deluge systems, with or without foam, can be effective in suppressing and extinguishing pool fires. The following correlations for the time to extinguish pool fires have been developed from a research programme of fire trials [4.6]. These trials used diesel as the fuel but the correlations would give a reasonable approximation for the time to extinguish stabilised crude oil fires.
T50 = 494 − 376 Y + TE = 859 − 448 Y +
29 .............................................................. Equation 4-5 Y
80 ............................................................... Equation 4-6 Y
where T50
is the time to reduce the fire size by 50 % (s)
TE
is the time to extinguish the fire(s)
Y = C ×U and C
is the water spray area cover rate (l min-1 m-2)
U
is the internal wind speed (m s-1)
These correlations are specific to water sprays with droplet Sauter mean diameters of 400 to 500 microns. The research report [4.7] indicates that the water droplet diameter can have a significant effect upon the time to extinguish a pool fire. In summary, large droplets are more effective than small droplets, inasmuch as they are less easily displaced by ventilation crosswinds and can penetrate the fire plume more effectively. The addition of a foaming agent to the water spray system can reduce significantly the time extinguish a pool fire compared to those predicted from Equation 4-5 and Equation 4-6. One additional factor in foam compound selection is the viscosity of the finished foam. For two dimensional pool fires a low viscosity of the finished foam is appropriate. However, for threedimensional running fires, such as may be encountered on a helideck, a high viscosity (or sticky) finished foam is appropriate. Where water miscible fuels may be encountered, then alcohol resistant foam is necessary. In locations where the ambient temperature can be below 0 °C for a significant time the foam compound should be ‘freeze-protected.’
152-RP-48 Rev 02, Feb 2006
Page 103 of 261
fireandblast.com A number of characteristics affect the effectiveness of water spray systems (designed for example to NFPA15 [4.8]) against either pool or jet fires.. The effects of water systems with respect to different fire types are discussed in more detail in Section 5.2. However, area water deluge can provide significant protection against incident thermal radiation from both jet and pool fires. The research report [4.9] suggests the following correlation for the reduction in incident thermal radiation.
R = 100 tanh (1.55 x ) ................................................................ Equation 4-7 where R
is the percentage reduction in incident thermal radiation
x = f ×L and f
is the water volume fraction in the atmosphere
L
is the distance through the water spray or curtain (m)
This indicates that the presence of area deluge could provide significant protection for personnel escaping from the location of a fire. The same applies to the use of water curtains if these are of adequate thickness. Area deluge systems or water curtains cannot be relied upon to protect personnel from the thermal effects of an explosion. These thermal effects are of too short a duration to prevent any serious risk of failure of equipment or structural elements. Such risks would be associated with the blast and drag effects of an explosion. Obviously, water spray systems can provide no protection against such effects. Dual agent (foam and dry powder) can be effective in the suppression and extinguishment of pool fires. Their effectiveness is probably limited to enclosed areas due to the problem of delivering the dry powder to the base of the fire in open, well-ventilated areas. Where effective, dual agents can reduce the fire duration to less than that where water deluge and foam is used. Any area deluge or local cooling system should be fully operational as soon as possible after the receipt of an initiating signal. The recommendation for the maximum value of this time delay, given in NFPA, should be adhered to. This is because waterspray heads constructed of brass or gunmetal will, when exposed to flame impingement, suffer major damage if water flow has not been established. This level of damage is likely to occur within 60 seconds and seriously degrade the effectiveness of the waterspray system. This could be avoided by the use of waterspray heads constructed of a high melting point material, such as super-duplex stainless steel. However this option would be accompanied by a severe cost penalty. Consideration should be made as to whether the fire hazard may extend beyond the notional fire area, thus mitigation measures should be able to protect from fire effects from outside (via an adjacent module for example). The application of water systems should then be appropriate to the fire hazard identified and also to the type of protection required, e.g. does the outside area include key escape routes form the primary affected area to the Temporary Refuge. Where high voltage electrical equipment, or equipment susceptible to damage by exposure to water are present then conventional water deluge or foam systems will not be appropriate fire fighting systems. Historically, such equipment has been protected against fire by the installation of Halon flooding systems. Since the adoption of Montreal protocol, this option is no longer available. 152-RP-48 Rev 02, Feb 2006
Page 104 of 261
fireandblast.com A number of drop-in Halon replacement systems have come on to the market but these are not yet in general use and thus little data are available on their effectiveness in ‘real’ fire situations. Water mist systems do appear to be very effective against electrical fires in enclosed areas. However, there is no general agreement as to whether or not unacceptable levels of damage to such equipment would ensue. More evidence is required to determine whether this objection to the use of water mist systems is or is not valid.
4.4.2 Fire-proofing systems Two types of fireproofing materials are in general use on offshore installations. These are: •
Inert materials;
•
Intumescent materials.
The inert materials provide excellent protection against fire exposure and a resistant to the erosive effects of jet flame impact. They do suffer from the disadvantage of increased load on the structure. It is for this reason that the intumescent materials are generally preferred. The intumescent materials can also provide excellent fire protection. However, there is a concern that the erosive effect of jet flame impact could dislodge the ‘char’ formed and thus reduce the effectiveness of the fireproofing. Where these materials are to be used, the material manufacturer should provide jet fire test data to demonstrate that this is not a problem. The design standard performance specifications for fireproofing materials are generally based on diffusion flame engulfment rather than jet flame impact. Thus the need for the test data referred to above is reinforced. In this context it is of course necessary to know whether diffusion flames or jet flames will be encountered. The research report [4.10] does provide some evidence on the likely rainout of liquid from an ignited two-phase release. If the rainout is significant then a pool fire will result. If not, then a spray fire (equivalent to a jet fire) will result. It is suggested that for ignited two-phase releases; •
If the GOR is low, then at drive pressures above 10 bar absolute a spray fire will result.
•
If the GOR is high, than at drive pressures above 5 bar absolute a spray fire will result.
The effectiveness of both types of fireproofing materials can degrade over time. This can be due to mechanical damage of the coating, especially the sealing topcoat. This in turn can lead to water ingress and deterioration of the fireproofing material, together with possible unrevealed corrosion of the substrate. This can be avoided by regular inspection of the fireproofing coatings and repair as necessary. Ideally, the fire-proof coating of any item should be capable of withstanding an explosion blast loading, up to the failure loading of the equipment item or structural element concerned, without suffering any significant degradation of the fire-proof rating. This would retain the protection provided by the fire-proofing against any fire subsequent to the explosion. The design of fire-proofing systems is universally carried out on the basis of the fire loading only.
4.4.3 The temporary refuge Ideally, the temporary refuge should provide for the protection of personnel against the effects of both fires and explosions. Whilst it is feasible that the temporary refuge could provide such protection against the thermal and smoke effects of fires and against the thermal effects of explosions, there must exist a practical limitation on the protection that could be provided against the blast effects of explosions. Thus the objective should be to reduce the explosion blast effects on the temporary refuge to as low as is reasonably practicable. This is probably best achieved by maximising the separation distance between the temporary refuge the likely locations of explosions as much as it is reasonably practicable to do. 152-RP-48 Rev 02, Feb 2006
Page 105 of 261
fireandblast.com
4.5 Combined fire and explosion analysis 4.5.1 Introduction Parts 1 and 2 of the Guidance have considered the subjects of explosion and fire in isolation. In practice, not only is it impossible to fully isolate the two phenomena, but also to do so risks missing potential high-risk events. This applies particularly where a fire analysis ignores potential damage caused by a preceding explosion or where an explosion occurs during a fire. The nature of the interaction between explosion and fire will depend upon whether an explosion precedes a fire (the usual base case) or whether it occurs during a fire. The effects of interaction are discussed in the following sections. For the purposes of this section, explosion shall be assumed to include the effects of projectiles.
4.5.2 Fire response of explosion damaged structures 4.5.2.1 General There are four categories of explosion damage to structures, three of which may affect subsequent fire endurance. 1.
A structure, which has responded to explosion while remaining in the elastic deflection range everywhere and without connection failures. A Category 1 structure can be considered to have been unaffected by explosion when considering its response to fire. This is the case for structures subject to explosion within the SLB range.
2.
A structure, which has responded to an explosion with plastic deformation but without connection failures. A Category 2 structure will be unaffected in its response to fire except in respect of: a) Possible damage to PFP (e.g. due to substrate strains), but noting that there are extremely limited data available on PFP damage following an explosion; b) Loss of straightness of members subject to buckling loads; c) Deformation of supported equipment and pipes; d) Loss of pipe/equipment support.
3.
A structure that has responded to explosion loading with or without connection failures (local or global). Category 3 structures will be weakened and behave differently in fire scenarios, compared to undamaged structures, with much reduced fire endurance.
4.
A structure, severely damaged by explosion with loss of entire segments of the structure.
Categories 2, 3 and 4 damage relate to structures designed to resist explosion in DLB range. 4.5.2.2 Analytical treatment of explosion damaged structure For category 1 damage in an explosion (SLB) it is assumed that there is no weakening of structure with respect to fire endurance hence fire and explosion can be considered independently by different techniques, if required. In practice it is very difficult to perform fire response analysis of explosion-damaged structure, where the explosion damage may have reduced the reserve structural capacity for dead loads.
152-RP-48 Rev 02, Feb 2006
Page 106 of 261
fireandblast.com The two practical difficulties are: •
Calculating the reserve structural capacity for distorted and/or weakened structures;
•
Covering a suitable range of explosion damage scenarios.
It is therefore recommended to design the main parts of the structure to survive design (10-4 years return period) events with category 1 or modest category 2 damage. In practice this will involve optimising the overall layout of the topsides facilities to minimise explosion pressures. For category 2, 3 or 4 damage it would be necessary to apply a structure model that has been fully modified to take account of the explosion damage that has occurred prior to fire. This is a particularly advanced type of analysis but could be practical where the non-linear software can determine both fire and explosion response. It is probably necessary to account both for geometry changes and the straining that has occurred in strained members, and this will affect the material model for those members. For this reason it may not be suitable to use different software for the fire and explosion response and merely use the output geometry from the non-linear explosion software as input to the fire-response software.
4.5.3 Explosion response of structures at elevated temperatures 4.5.3.1 General As temperature increases, the yield stress and Young’s modulus of metals decrease. This can result in comparatively small temperature rises resulting in a considerable increase in explosion related deflection. This applies particularly where a component is designed to resist explosion through plastic deformation. Explosions during fire can sometimes result from: •
Equipment or vessel BLEVEs due to heating in fire;
•
Delayed effect of explosions in one area on an adjacent area, already in flames. This is part of a complex domino situation where a first area is in flames and the explosion in that first area has caused leaks in a second (adjacent) area, and it takes some time before the leaks in the second area ignite and cause the second explosion, causing explosion overpressures in the first area.
Unless, analyses of escalation identify clear limits to potential damage, it is recommended that the fire hazard strategy assumes a “burn down philosophy” and that the fire risk analysis should confirm that the TR is not destroyed with an unacceptable frequency, in which case, a different solution will be required (e.g. a revised layout or separate accommodation jacket). Other damage can occur due to projectiles caused by vessel BLEVEs and to a lesser extent from pipe failures. Another source of damage may be equipment and structure falling from areas above that has become weakened by fires. The higher the module stack, the more damage a dropped could cause. Where appropriate, this aspect needs to be linked to dropped-object hazard evaluation. On F(P)SOs and converted jack-up type substructures the damage consequence due to impact with the deck might be large and the protection requirements difficult to meet without heavy protection such as thick steel plates or Bi-steel. 4.5.3.2 Analytical treatment of fire-damaged structure Rigorous numerical analysis for explosion effects on fire-damaged structure is currently not practical in most cases, though the advanced non-linear techniques briefly mentioned in Section 4.5.2.2 might be applicable here. Coping with the explosion after fire scenarios is principally achieved with a suitable barrier philosophy and distancing (sensitive equipment and structure from hazard). For vessel BLEVEs distancing will not usually be sufficient due to long projectile trajectories. Barriers, which may be 152-RP-48 Rev 02, Feb 2006
Page 107 of 261
fireandblast.com walls or other equipment installed between the location of the BLEVE incident and vulnerable targets, can reduce projectile trajectories and thereby render distancing philosophy effective. From the practical standpoint, where an explosion during a fire is a significant risk, the temperature of structural steelwork may need to be kept significantly lower than for fire-only loaded steelwork. This is to improve resistance to resist the secondary explosions. This can be accommodated by more extensive application of PFP and this factor should be borne in mind when contemplating reducing the extent of PFP coverage to meet only specific fire scenarios. An additional consideration is that where there is a significant risk of an explosion during a fire it is necessary to ensure adequate strength and bonding or fixing of passive fire protection materials at high temperatures.
4.6 Safety conflicts The application of safety measures always requires a balance regardless of whether the hazards are fire or explosion related. The over-riding principle concerns the risk assessment of the identified hazards and whether the protective steps for one hazard will exacerbate the likelihood or consequences of another. This “conflict” is particularly meaningful when dealing fire and explosion hazards as they are the result of only slightly diverging escalation paths. All protective measures should be considered in the context of the hazards identified for the specific installation as is reiterated elsewhere in this guidance; the hazard identification exercise for the installation should be rigorous and comprehensive. This section will discuss specifically the potential conflicts arising from the use of the protective measures considered for fire hazard management. The detail of each measure discussed can be found elsewhere in this guidance. The conflicts will be reviewed in the context of their role in the protective hierarchy and the issues “in conflict” will be described.
4.6.1 Conflicts arising from inherent safety measures The major inherent safety steps are to reduce or eliminate inventories. Reduction or elimination of inventory is desirable for all hydrocarbon related hazards and presents no obvious conflicts with other hazard categories. In general, the reduction or elimination of ignition sources is again desirable for all hydrocarbon related hazards although care should be taken that dispersion of gas or vapour to a “non-hazardous” area where ignition sources have been allowed is considered in the HAZID and that suitable other steps have been taken.
4.6.2 Conflicts arising from preventative safety measures Additional safety measures that might be considered here are open module areas to disperse any hydrocarbon release (in gaseous or vapour form) or providing comprehensive hazardous drainage systems to remove liquid spills as quickly and safely as practicable. These steps would then prevent the concentration of flammable fluids reaching or exceeding the Lower Flammable Limit (LFL). The reduction or elimination of ignition sources will (theoretically) prevent ignition of any release prior to dispersion or dilution having occurred. A conflict arises with the open module concept. The normal practice for fire protection engineers is to consider the firewater demand of the largest area plus adjacent areas to which the fire may spread. It can be seen that the larger area (the practical result of opening modules) increases the 152-RP-48 Rev 02, Feb 2006
Page 108 of 261
fireandblast.com firewater demand and may make the demand impractical for normal firewater pump sizing. The open area also decreases the likelihood that the fire will ever be ventilation controlled, thus requiring the designer to consider other steps. This “open module” measure does however improve the situation for explosions (as was discussed in Part 1 of this guidance). Concerning designing drainage systems to remove liquid hydrocarbon spills, these pose no obvious safety conflicts with other hazard categories but may create an undesirable environmental event. Although regulators often acknowledge environmental impacts in extreme events, the design and operational constraints of this safety measure should be considered further and the consequences of both events understood.
4.6.3 Conflicts arising from detection safety measures Detection measures tend to be relatively passive and provide a step towards a more precise hazard management system (focussed control, mitigation or response). There are no obvious conflicts identified here, merely that the detection devices/systems should certainly be directed towards specific hazard categories and if possible, specific hazards. The detection devices should be defined by their Performance Standards to achieve a certain degree of detection in the context of particular hazards and also with other protective measures having been activated, for example, flame detection effectiveness after firewater systems (deluge or mist) have been activated. Therefore, for detection, the issue is more of omission (of particular applications) rather than conflict and can be clarified by clear application to the defined hazards.
4.6.4 Conflicts arising from control safety measures Safety measures that might be considered to control the event would comprise isolation valves and blowdown systems to control the inventory available to feed the fire. Dependent upon the way that the incident was defined, a further control system would be the firewater system, either acting to control escalation or acting as a mitigation measure. The firewater systems will be discussed under conflicts arising from mitigation measures. Concerning isolation valves and blowdown systems, these will limit the released inventory for any release event and present no conflict in the execution of that function. However, to function well in the event of an incident, these measures may require additional ESD valves and blowdown lines. The designers should be aware of one area of conflict in that the actuators of large valves are themselves quite large and that they and/or blowdown piping will constitute significant obstructions to explosion generated flame-fronts and thus increase overpressure loads which may in turn require blast protection as both ESD valves and blowdown lines are safety critical. The design process moves into a vicious circle whereby the safety items can increase the severity of the event they are controlling. These issues are not insuperable and like many safety issues are dealt with by adopting good layout principles.
4.6.5 Conflicts arising from mitigation safety measures The are 3 main mitigation measures for fire hazards; •
Physical containment; to stop the fire either escalating to adjoining sensitive areas (where personnel may be), or reaching new inventories or to otherwise limit the fire by ventilation control.
•
Extinguishing systems; to extinguish the fire directly or to cool surrounding piping, equipment and structures to retain strength and stop escalation.
152-RP-48 Rev 02, Feb 2006
Page 109 of 261
fireandblast.com •
Designing for retention of structural integrity; to provide fire resistance (via intrinsic structural strength or passive fire proofing) in order to maintain structural integrity to support process systems (and avoid escalation) and to support areas of greater safety for personnel (TR and muster areas) and to support evacuation systems (TEMPSC launch stations, helidecks).
With respect to the mitigation measures identified under item 1, these measures provide the greatest conflicts with other hazard categories. Physical containment of areas, whilst delineating fire areas, providing greater effectiveness for the applied fire water systems and a degree of ventilation control (in circumstances where the area/module is well sealed) have adverse effects on other hazards. Gas or vapour releases are also contained, they are not dispersed beyond the area/module and the opportunity for dilution to below the Lower Flammable Limit does not exist. Also, there remains the possibility that delayed ignition initiates an explosion rather than a fire in which case the resultant explosion overpressure will more than likely be higher than in an open module (though this may not always be the case and a considered analysis should be undertaken, see Part 1 of this Guidance). The avoidance of gas/vapour clouds in the flammable or explosive region should always be the first priority. Concerning mitigation measures identified under item 2, there is a range of demands for the extinguishing systems dependent upon which fire type they are designed for. In addition, there are different nozzle types and spray behaviour required for explosion suppression. The mixture of nozzle types and their location should be considered carefully when designing the firewater system. Dependent upon the hazards identified for an area, a decision can be taken on the basis of the risk (considering both likelihood and consequence) of the “reasonably foreseeable” events. The risk ranking of the types of events will provide an indication as to the types and locations of firewater nozzles to be used. There is also the effect of timing; deluge used for explosion suppression is required to be activated early, i.e. in advance of any ignition and this has led to the practice of some operators of The critical consideration for the structural and safety demands required by mitigating measures under item 3 is to maintain structural integrity. There are no obvious conflicts arising from measures meeting these demands, the increased strength and/or added passive fire proofing do not impact other hazard management measures. However, the addition of passive fire proofing does increase the likelihood of accelerated corrosion due to trapped moisture which may arise from leaking insulation or from temperature cycling generating condensation.
4.6.6 Conflicts arising from emergency response safety measures The safety measures considered here will form escape and evacuation equipment, both personal and for teams and will also comprise portable and hand-held fire-fighting equipment. These are all measures required to assist personnel and there are no obvious conflicts where their provision impairs the hazard management efforts for other hazard categories. At worst, they may be ineffective, as indeed they will be for some fire scenarios.
4.7 Fire and explosion walls There are two main types of fire and explosion resistant walls: Proprietary corrugated walls (in carbon or stainless steel) and bulkhead walls. Corrugated walls are the most popular, mostly because they are lighter, less expensive and can be manufactured complete, off-site and installed after grit-blasting and painting of topsides structure and installation of main equipment. They fit more easily into the construction programme. PFP is generally tested using flat surfaces; the effects of a jet fire on a corrugated wall either in terms of heat load or surface PFP are less well understood.
152-RP-48 Rev 02, Feb 2006
Page 110 of 261
fireandblast.com Another issue for manned areas can be toxicity of smoke from intumescent PFP. This type of PFP is rarely used on corrugated walls but is common on bulkhead structures. Corrugated walls are designed not to participate in the loads bearing capacities of the structures they are integrated into and only have to have residual strength in fire to support their own weight. Bulkhead walls on the other hand do participate in the dead load carrying capacity of the structures into which they are constructed and therefore require to be insulated to prevent strength loss in fire. Most fire / Blast walls do not otherwise require to be insulated, and insulation of them is only normally required where they are used as boundaries to enclosed occupied rooms. Resistance to penetration by projectiles will be affected by temperature rise and this will depend upon whether PFP is used or not. It also depends on whether or not the insulation is on the fire attack side or the cold side of the wall. In some cases relatively thin coatings of PFP have been applied to (carbon steel) corrugated walls and this has the advantage of ensuring limited temperature rise during the important early blowdown phase of platform equipment when BLEVE and projectile risk is highest (a compromise solution). Stainless steel corrugated walls have more residual strength at elevated temperatures and are therefore more resistant to projectiles. On the other hand they tend to be thinner than equivalent carbon steel walls and this diminishes the strength advantage in regard to projectile penetration, but they are very ductile. Support interface design is important as this must allow for thermal expansion of the wall in fire and out-of-plane bending, due to preceding explosion or differential temperature through the depth of the wall or both. The out of plane deflection due to fire is lower with corrugated walls because the geometry of the wall profile ensures that the inner flange and outer flange are heated equally, whereas large differential temperatures occur in bulkhead walls and stressed skin construction (with the plate on the fire side) because the cold side flange of the stiffeners is not heated directly: the temperature gradient is greatest with uninsulated walls. Provided the supports are configured to deform without strength-loss, the residual strength of the wall will not be affected by the distortion but care needs to be taken with the PFP in these areas, particularly where such PFP is within the coat-back distance for the structure that supports the wall. If in doubt, shaped stainless steel flashings can be used in such locations with fibrous insulation behind.
4.8 Decks Decks normally comprise a series of girders and a stiffened deck plate. Usually the PFP will be applied to limit the temperature rise of main girders and those secondary beams that support the higher categories of Safety Critical Equipment. Coat-back requirements are often relaxed to 50 mm or so hence the overall percentage of cover to deck steel work will be relatively small. Of course it is not normal to coat the top surface of decks. In pool fires decks would not be expected to be heated if the fire is from above but this may not be the case with jet fire. The top flanges of girders can be weakened in such circumstances, particularly as the insulation to the girder below the deck plate will inhibit heat loss and allow higher top flange temperatures to occur. These are potential considerations. As a general rule it is preferable to specify the secondary deck beams and plating to have a higher strength than the primary structure so that it’s loss in explosion and / or fire does not lead to the primary structures being dragged down or losing their secondary stabilising support members, for example for lateral torsion buckling. The welding of secondary steel and girder connections needs particular attention and it is recommended to make welded connections capable of transmitting the 152-RP-48 Rev 02, Feb 2006
Page 111 of 261
fireandblast.com forces imposed during gross deformation of the secondary members they connect without fracture (as in earthquake-resistant design). Potential deficiencies in fire resistance of decks which support SCE’s or which act as fireboundaries can sometimes be overcome by the addition of deck to deck hangers. Where the critical fire is below the deck these hangers would not be weakened as they would be located in a different fire area. This is a solution that can be applied for retrofit situations. It should be understood that there may be a problem of running pool fires on decks due to distortion of plates arising from the fire. All analyses are based on a circular or bunded fire and do not take into account potential running. The HSE are currently planning a test programme to investigate this effect.
4.9 Feedback from explosion testing at Spadeadam Large scale fire testing has been carried out at the Spadeadam test establishment. In the context of testing of PFP, Spadeadam has developed a large scale explosion test of PFP material which subjects PFP covered samples to an explosion loading (including drag forces in the case of pipes or beams) and following the explosion test, the samples are subjected to a standard jet fire test. There is an added level of acceptance for Duty Holders that the combined explosion/fire testing can be witnessed by a 3rd Party such as the Verification Body, who have certified the results of the tests for a number of PFP manufacturers.
152-RP-48 Rev 02, Feb 2006
Page 112 of 261
fireandblast.com
5. Derivation of fire loadings and heat transfer 5.1 Introduction In the following sections generic fire types are identified for the types of fire that might occur on or near an offshore installation. The fire types are considered further in terms of their characteristic flame and how their behaviour might be affected by confinement and/or deluge. The parameters used to define the fire and the hazards presented by the fire in terms of thermal and smoke loading are defined. Based on large scale experimental work (including unpublished studies by Advantica to which access has been granted for this guidance) and on the predictions of validated models developed and used by Shell and Advantica, typical fire loading data are summarised for the fire types. Typical values can be used to assess the hazard to personnel and the likely effect on fire impacted obstacles using a simple calculation method. Also considered are the effects of deluge on fire behaviour, the potential heat loads from fires and the effect on the temperature rise of an engulfed object, plus the manner in which PFP may limit the rate of temperature rise of an engulfed object and how blow-down may reduce the heat load and hence the likelihood of failure. Using these typical fire loadings and calculations of heat transfer to objects, the steps to prepare an initial scoping or indicative QRA of the fire hazards are also outlined.
5.2 Fire characteristics and combustion effects 5.2.1 General In Section 3.2.35, potential fires on offshore installations were categorised into six fire types. In this section, each of these fire types is described in detail in terms of the likely nature of the flame and the thermal loading it may present to the surroundings. Where appropriate, the effect of active water deluge on the fire is discussed as is the effect of confinement.
5.2.2 Gas jet fire 5.2.2.1 Nature of the gas jet fire An ignited pressurised release of a gaseous material (most typically natural gas) will give rise to a jet fire. A jet fire is a turbulent diffusion flame produced by the combustion of a continuous release of fuel. Except in the case of extreme confinement which might give rise to extinguishment, the combustion rate will be directly related to the mass release rate of the fuel. In the offshore context, the high pressures mean that the flow of an accidental release into the atmosphere will be choked having a velocity on release equal to the local speed of sound in the fluid. Following an expansion region downstream of the exit the flame itself commences in a region of sub-sonic velocities as a blue relatively non-luminous flame. Further air entrainment and expansion of the jet then occurs producing the main body of the jet fire as turbulent and yellow. In the absence of impact onto an object, these fires are characteristically long and thin and highly directional. The high velocities within the released gas mean that they are relatively unaffected by the prevailing wind conditions except towards the tail of the fire. The fire size is predominantly related to the mass release rate which in turn is related to the size of the leak (hole diameter) and the pressure (which may vary with time as a result of blowdown). In the case of high pressure releases of natural gas, the mixing and combustion is relatively efficient resulting in little soot (carbon) formation except for extremely large release rates. Hence little or no smoke is produced by natural gas jet fires (typically 2 rows at 12 l min-1 m-2, for use in Equation 5-4 (See Section 5.2.2.2).
Increased CO up to about 5% v/v at a vent prior to external flaming, but after external flaming 30 kg s-1 a single number is given for the total heat flux which could be interpreted as implying a constant value for all of these larger release rates. Where heat flux calculations are required for larger leak rates, the heat flux figures should be used with caution, CFD simulations can be used to obtain data on the effects of larger fires.
152-RP-48 Rev 02, Feb 2006
Page 129 of 261
fireandblast.com Table 5-2 High pressure two-phase jet fires
Fuel mix of 30 % gas, 70 % liquid by mass
Size (kg s-1)
0.1
1.0
10
30
Flame length (m)
5
13
35
60
Fraction of heat radiated, F
Flashing liquid fires (such as propane or butane).
1.0
Affected by enclosure shape and openings
See equation below table
CO level (% v/v) and smoke concentration (g m-3)
CO < 0.1 Soot ~0.01
CO < 0.1 Soot ~0.01
CO < 0.1 Soot ~0.01
CO < 0.1 Soot ~0.01
Total heat flux (kWm-2)
200
300
350
400
230
Radiative flux (kWm-2)
100
180
230
280
160
Convective flux (kWm-2)
100
120
120
120
70
Flame temperature (K)
1560
1560
1560
1560
1300
Flame emissivity,
0.30
0.55
0.70
0.85
1.00
Convective heat transfer coefficient, h (kWm-2K-1)
0.080
0.095
0.095
0.095
0.070
Effect of deluge
Effect of Confinement
Increased CO up to about 5 % v/v at a vent prior to external flaming, but after external flaming < 0.5 % v/v at the end of the flame. Soot levels depend on equivalence ratio from about 0.1 g m-3 at φ = 1.3 to 2.5 g m-3 at φ = 2.0
Some benefit to engulfed objects but temperature may still rise although at a slower rate. Combined area and dedicated deluge may prevent temperature rise if effectively applied. See Section 5.2.3.2. In far field take F’ as per Table 5-1.
Increased heat fluxes, take values as per 30 kg s-1 two-phase jet fire.
Risk of extinguishment and potential formation of pool, see Section 5.2.4.
Fraction of Heat Radiated, Fm , of mixture involving x% liquid by mass: ⎛ x ⎞ Use Fm = ⎜ ⎟ ⋅ ( FL − FG ) + FG where FG is the fraction of heat radiated for natural gas as given ⎝ 100 ⎠ in Table 5-1 and FL is the fraction of heat radiated for the liquid fuel involved. Take FL = 0.24 for C3; 0.32 for C4, 0.45 for C6-C25 (including condensate and diesel); and 0.5 for crude oil. 152-RP-48 Rev 02, Feb 2006
Page 130 of 261
fireandblast.com 5.4.2.3 Pool fires on the installation The following information is provided for pool fires on an installation: •
The expected flame extent, so that items or personnel within that range can be identified and the consequences of flame engulfment considered.
•
The mass burning, so that the duration of a fire following a spillage might be assessed and to provide input to calculations of the incident radiation field.
•
The Fraction of Heat Radiated, F, so that estimates of the far field incident radiation hazard can be made using Equation 5-3 in Section 5.3.1, where the rate of fuel combustion, m , is taken as the mass burning rate times the area of the pool.
•
The CO level and soot concentration in the smoke produced.
•
The total heat flux to an engulfed object together with the radiative and convective components, so that calculations of the object heat-up can be performed (see Section 5.5). Note that these fluxes represent the initial values when the engulfed object is cold. Values of typical flame temperature, emissivity and convective heat transfer coefficients are also provided.
•
The effect of deluge in terms of the reduction in the heat flux to engulfed objects and the enhanced attenuation of incident radiation to the surroundings using the Effective Fraction of Heat Radiated, F’ (see Equation 5-4).
•
The effect of confinement on fire characteristics and the combined effect of confinement and deluge.
This information is presented in Table 5-3.
152-RP-48 Rev 02, Feb 2006
Page 131 of 261
fireandblast.com Table 5-3 Pool fires on the installation Pool fire parameter
Methanol pool
Small hydrocarbon pool
Large hydrocarbon pool
Effect of confinement
Typical Pool Diameter (m)
5
5
Any
Flame Length (m)
Equal to pool diameter
Twice pool diameter
Up to twice pool diameter
Mass Burning Rate
0.03
Crude – 0.045-0.06 Diesel – 0.055 Kerosene – 0.06 Condensate - 0.09 C3/C4s – 0.09
Crude – 0.045-0.06 Diesel – 0.055 Kerosene – 0.06 Condensate - 0.10 C3/C4s – 0.12
Fraction of Heat Radiated, F
0.15
0.25
0.15
See Section 5.2.4.3. Take values as per large hydrocarbon pool fire for worst case. If confinement is severe then mass burning rate will decrease to match available air flow and large external fire at vent expected.
CO level (% v/v) and Smoke Concentration (g m-3)
Negligible
CO < 0.5 Soot 0.5 – 2.5
CO < 0.5 Soot 0.5 – 2.5
Total Heat Flux (kWm-2)
35
125
250
Radiative Flux (kWm-2)
35
125
230
Convective Flux (kWm-2)
0
0
20
Flame Temperature (K)
1250
1250
1460
Flame Emissivity,
0.25
0.90
0.90
Convective Heat Transfer, h Coefficient (kWm-2K-1)
-
-
0.02
Effect of Deluge
Extinguishable using AFFF. Water soluble but effect of water deluge unknown.
(kg m-2 s-1)
See Section 5.2.4.2 Considerable fire control and potential extinguishment can be achieved. Expect a reduction in flame coverage (and hence flame size) of up to 90 % within 10minutes. Rapid extinguishment with AFFF.
Increased CO up to about 5 % v/v at a vent prior to external flaming, but after external flaming about 0.5 % v/v at the end of the flame. Soot levels up to 3 g m-3 . See Section 5.2.4.3. Take values as per large hydrocarbon pool fire.
See Section 5.2.4.4. Expect reduced flame temperatures and reduced or no external flaming. Mass burning rate reduces to match available air flow.
Up to 50 % reduction in radiative heat flux to engulfed objects. In far field take F’ = 0.8F for 1 row of water sprays, F’=0.7F for 2 rows and F’=0.4F for >2 rows at 12 l min-1 m-2 (See Section 5.2.4 for other rates) 152-RP-48 Rev 02, Feb 2006
Page 132 of 261
fireandblast.com 5.4.2.4 Fires on the sea The following information is provided in Table 5-4 for hydrocarbon pool fires on the sea: •
The expected flame extent, so that items within that range can be identified and the consequences of flame engulfment considered.
•
The mass burning, so that the duration of a fire following a spillage might be assessed and to provide input to calculations of the incident radiation field.
•
The Fraction of Heat Radiated, F, so that calculations of the far field incident radiation hazard can be made using Equation 5-3 in Section 5.3.1, where the rate of fuel combustion, m , is taken as the mass burning rate times the area of the pool.
•
The CO level and soot concentration in the smoke produced.
•
The total heat flux to an engulfed object together with the radiative and convective components, so that calculations of the object heat-up can be performed (see Section 5.5 “Heat transfer”). Values of typical flame temperature, emissivity and convective heat transfer coefficients are also provided.
The gas outflow from a sub-sea pipeline will depend on the pressure and the pipeline size. The release will also vary with time; this variation depending upon the length of pipeline which is depressurising. Similarly, the area at the sea surface over which the gas emerges will depend on the depth and the gas release rate. Furthermore, depending on the gas outflow and the depth, the gas plume at the sea surface may not be within flammable limits. For these reasons, simplified guidance cannot be readily provided and the use of a model is recommended. This topic is an area of some uncertainty and model predictions vary considerably. For illustrative purposes, predictions of the fire hazard following the rupture of a long 24” diameter natural gas pipeline operating at 100 barg at a depth of 50 m suggest that the fire diameter might be of the order of 100 m with a flame length of 150-200 m. On the basis that the fire is a low velocity laminar flame, it can be regarded as a large pool fire and the values presented in Table 5-4 for fraction of heat radiated and heat fluxes are recommended.
152-RP-48 Rev 02, Feb 2006
Page 133 of 261
fireandblast.com Table 5-4 Hydrocarbon pool fire on the sea Pool fire on sea parameters Typical Pool Diameter (m)
Value >10
Flame Length (m)
Up to twice diameter
Mass Burning Rate (kg m 2 s 1)
Crude – 0.045-0.060 Diesel – 0.055 Kerosene – 0.060 Condensate – 0.100 C3/C4s – 0.200
Fraction of Heat Radiated, F CO level (% v/v) and Smoke Concentration (g m-3)
0.12 CO < 0.5 Soot 0.5 – 2.5
Total Heat Flux (kWm-2)
250
Radiative Flux (kWm-2)
230
Convective Flux (kWm-2)
20
Flame Temperature (K)
1460
Flame Emissivity,
0.90
Convective Heat Transfer Coefficient, h (kWm-2K-1)
0.02
5.4.2.5 BLEVEs BLEVEs are highly transient events in which a fixed inventory is instantaneously released. The subsequent combustion gives rise to a fireball which grows in size to a maximum before burning out as all the fuel is consumed. Consequently, the key parameters of interest in terms of a consequence assessment are the extent of the flame and the incident radiation hazard to personnel outside the flame. These parameters are also highly transient. In relation to incident radiation levels outside the fireball, both the maximum level experienced and the ‘dosage’ over the duration of the event are of interest in order to determine the effect on people. Consequently, Table 5-5 presents the following data in relation to BLEVEs: •
Typical maximum fireball diameter (assuming unconfined) based on the mass of fuel involved in the BLEVE, and the maximum flame volume calculated assuming a spherical geometry. Hence the area of a module which would be expected to be engulfed in flame can be assessed by dividing the volume of the fireball by the height of the module.
•
The expected duration as a function of the mass of fuel involved in the BLEVE.
•
The Modified Fraction of Heat Radiated F*, which can be used to calculate the maximum incident radiation received at a location d, remote from the fireball (more than one fireball diameter distant from edge of fireball) using the equation: qd ,max =
τ F*M H 4 π d2 t
where: t
τ 152-RP-48 Rev 02, Feb 2006
kWm-2 ...................................................... Equation 5-11
is the duration of the BLEVE event (s) is the atmospheric transmissivity
Page 134 of 261
fireandblast.com M
is the mass of fuel involved in the BLEVE (kg)
H
is the calorific value (kJ kg-1)
d is the distance from the centre of the fireball where the dosage is experienced (m)
Various correlations have been developed relating the maximum diameter (D), maximum height (h) and duration (t) of the fireball following an unconfined BLEVE to the mass of fuel released, for example CCPS Guidelines for Chemical Process Quantitative Risk Analysis suggests that: D = 6.48 x M0.325 ; h = 0.75 x D; t = 0.825 x M0.26. These equations have been used to derive the values presented in Table 5-5 for maximum diameter and duration. Comparisons with large scale data showed reasonable agreement. Table 5-5 BLEVEs Parameter
Characteristic expressed as function of BLEVE fuel mass (kg of fuel)
Maximum Diameter (m)
D = 6.48 x M0.325
Maximum Flame Volume (m3)
V = 142.47 x M0.975
Duration (s) Modified Fraction of Heat Radiated, F*
t = 0.825 x M0.26 0.35 (ONLY for use in Equation 5-11 to derive maximum incident radiation at a locations remote from the fireball)
5.4.3 Predictive models for fire loading There are basically three types of predictive models which can be used to predict fire characteristics and the thermal loading from fires, these being: •
Empirical models;
•
Integral (or phenomenological) models;
•
Numerical (CFD) models.
Empirical models contain, to varying degrees, a physical basis combined with correlations which have been derived from experimental data. They are generally easy to use, but their applicability is limited to the range of experimental data used to derive them. Integral models use equations relating the fire characteristics to the physical processes involved, such as mixing, combustion and thermal emissions. However, the relationships are simplified and are generally one-dimensional. Such models will also often contain some parameters which have been empirically derived from experimental data. Nevertheless, integral models provide an effective method for predicting fire characteristics and are generally easy to use. Strictly speaking, they should only be applied to the range of circumstances for which they have been validated by experimental data. However, because of the physical basis of the equations, the models can be applied, within reason, to situations outside this range. 152-RP-48 Rev 02, Feb 2006
Page 135 of 261
fireandblast.com Numerical models (CFD) attempt to model in 3-dimensions the time varying processes within a fire such as the fluid flow and combustion processes. In principle, this physical basis enables these models to study complex geometries and conditions far removed from experimental data used to validate them. It is noted that resulting predictions may be sensitive to small changes in input parameters if not used properly. Therefore these models generally require ‘expert’ users.. For these reasons, CFD codes are not routinely used for general risk assessments. However, they can be useful to study in detail a particular fire scenario of interest due to its severity. The impact of potential design changes (such as increased ventilation) can then compared and provide at least qualitative guidance on how to reduce the hazard. The CFD predictions use more realistic geometry and dynamic models and may require the risk assessment to take into account new parameters such as the leak jet direction, leak location, and the dynamic behaviour of the fire. This makes the risk analysis larger. For explosion risk, the CFD method is well established following the NORSOK Z13 standard. However, for fire risk calculations, it is not routinely used. Annex D discusses the above model types in more detail and provides an in-depth review of different fire modes currently available.
5.5 Heat transfer 5.5.1 Mechanisms for heat transfer 5.5.1.1 General Basic heat transfer by radiation, convection and conduction is well covered in the standard text books (e.g. Incropera and De Witt, 2002 [5.4]). This section concentrates on determination of heat transfer using the values identified in Table 5-1 through to Table 5-5 for key parameters measured in intermediate and large scale trials as; previously, these have not been readily available. This follows on from the approach recommended by the Energy Institute (formerly the Institute of Petroleum) in assessing the effect of severe fires on pressure vessels (Energy Institute, 2003) [5.5]. 5.5.1.2 Radiation Radiation from the hot gases and incandescent soot particles is the main mechanism for transferring heat. For flames with relatively little momentum, e.g. pool fires, radiative transfer to an impinged object represents at least 80 % of the heat transferred. Even with impinging high velocity jet fires, radiative heat transfer still represents 50 % to 60 % of the heat load. The radiative heat emission process is modelled by assuming that the radiation comes from the flame surface. The surface emissive power (SEP) of a flame is the heat radiated outwards per unit surface area of the flame. Generally, a uniform SEP is taken over the whole flame shape but this a gross simplification of what may happen in practice. For example, in a large pool fire, the base of the flame may have the relatively high SEP of 180 kW m-2 whereas the smoke obscured flames, which may comprise two thirds of the flame shape, may have the relatively low SEP of 60 kW m-2. If an object is definitely not directly impinged by flame, the radiative heat transfer is given by Equation 5-12 below.
qrad = VF Eτ .................................................................................. Equation 5-12 where VF is the geometric view factor, E (kW m-2) is the surface emissive power of the flames and τ is the atmospheric transmissivity. The view factor is purely a geometrical parameter determining the proportion of radiation leaving one surface which reaches a second surface. As radiation travels in straight lines, only those parts of the respective surfaces that can see one another contribute to the value of the view factor. Analytical expressions for the view factor are available (e.g. McGuire J H, 1953 [5.5] and SFPE, 152-RP-48 Rev 02, Feb 2006
Page 136 of 261
fireandblast.com 2002 [5.6]) for standard geometries. For example, pool fires may be represented by tilted cylinders, jet fires by a conical frustum and fireballs by circular discs through the centre of the fireball. Numerical integration may be used for more complex geometries where the flame surface is divided into a series of regular shapes (e.g. triangles or squares) and the view factors for each of these summed. Atmospheric attenuation is primarily caused by absorption of radiation by carbon dioxide and by water vapour and scattering by dust particles. The atmospheric transmissivity over a specified path length, due to the presence of water vapour and carbon dioxide, can be calculated from the temperature and relative humidity of the atmosphere provided that the emission spectrum is known. Usually it is assumed that there is emission at every wave length (black or grey body). For path lengths of 10 m or less it is usual to take the atmospheric transmissivity as 1. Expressions of differing complexity are available ranging from those that just take distance into account to those that also consider water and carbon dioxide concentration. Wayne (1991) [5.7] gives the following empirical expression, which takes both water vapour and carbon dioxide concentrations into account:
t = 1.006 − 0.01171 ⎡⎣log10 X ( H 2O ) ⎤⎦ − 0.02368 ⎡⎣log10 X ( H 2O ) ⎤⎦ −0.03188 ⎡⎣log10 X ( CO2 ) ⎤⎦ + 0.001164 ⎡⎣log10 X ( CO2 ) ⎤⎦
2
2
Equation 5-13
Where
X ( H 2O ) = Rh d S mm
288.651 ...................................................... Equation 5-14 T
Rh is the fractional relative humidity, d is the path length (m), Smm is the saturated vapour pressure of water (mmHg) at atmospheric temperature T (K). This expression assumes that the flame is 1500 K, which was chosen as an average between that of a propane fire and a LNG fire. The transmissivity given by this expression at 15 °C is illustrated by Figure 5-1.
Figure 5-1 Variation of atmospheric transmissivity with distance at 15 °C The 0.8 transmissivity suggested in Section 5.3.1 corresponds to that at a distance of 25 m at a relative humidity of 60 %.
152-RP-48 Rev 02, Feb 2006
Page 137 of 261
fireandblast.com As indicated in Section 5.3.1, the radiation to the surroundings may be represented by a point source model. For a point source model, the radiation received (qd, kWm-2) at a distance d (m) is given by:
qd =
τ F m H .............................................................................. Equation 5-15 4π d2
Generally, the heat of combustion (H, kJ kg-1) will be known from the literature (e.g. Weast, 1981) and typical values for the fraction (F) of the heat of combustion radiated for six main fire scenarios ) for hydrocarbon pool fires are considered are given in Section 5.4.2. The mass burning rates ( m given in Table 5-3. Slightly higher values are given for C3/C4 and condensate pool fires if the pool diameter is greater than 5 m. For jet fires, the mass burning rate is based on the leakage rate and, for QRA, these are generally assumed to be 0.1, 1, 10 or > 30 kg s-1. In the case of fireballs, the mass burning rate is based on the total amount of fuel released divided by a fireball duration calculated using an expression (0.825. mass0.26) based on the mass released. Application of the two techniques is illustrated using data from the BLEVE of a 2 tonne LPG tank (Roberts et al., 2000 [5.8]). The relevant data are summarised in Table 5-6 below. Table 5-6 Example LPG BLEVE fireball data Parameter
Value
Heat of combustion
46000 kJ kg-1
Amount of fuel released
1708 kg
Duration
7s
Mass burning rate
244 kg s-1
Fraction of heat of combustion radiated
0.38
Surface emissive power
312 kW m-2
Fireball diameter
71 m
The full data set indicated that the maximum output from the fireball was at the lift off point. This situation can be modelled by treating the fireball as a disc through the centre of the fireball just touching the surface and the target as a vertical receiver (normally it is necessary to determine both the vertical and the horizontal component of the view factor) on the surface (see Figure 5-2).
152-RP-48 Rev 02, Feb 2006
Page 138 of 261
fireandblast.com
Figure 5-2 View factor for circular disc with receiver off axis but parallel The view factor is given by, [5.9]:
⎛ y2 + z 2 − R2 ⎜ VF = 0.5 ⎜ 1 − 2 ⎜ R4 + 2 ( y2 − z 2 ) R2 + ( y2 − z2 ) ⎝
⎞ ⎟ ⎟ ........................... Equation 5-16 ⎟ ⎠
Hence, if z = R and y = n.R
⎛ n ⎞ VF = 0.5 ⎜1 − ⎟ ................................................................. Equation 5-17 4 + n2 ⎠ ⎝ Table 5-1 provides the data for applying both a solid flame and point source model. Assuming an atmospheric transmissivity of 1, the results from application of each model are plotted in Figure 5-3.
152-RP-48 Rev 02, Feb 2006
Page 139 of 261
fireandblast.com
Figure 5-3 Comparison of solid flame and point source model for a fireball Figure 5-3 suggests that a solid flame model should be used if the object of interest is closer than two flame widths/lengths from the flame as, at these distances, the receiver cannot “see” all of the flame. The above models are only applicable if there is no direct flame impingement. If the flames are impinging on an object then the radiation received may be approximated (ignoring reflection and re-radiation, see Section 5.3.2 “Thermal loading to engulfed objects” for the derivation) by Equation 5-18.
qrad = ε s σ ( ε f Tf4 − Ts4 ) ................................................................ Equation 5-18 where εf, εs are the flame and surface emissivities, σ is the Stefan-Boltzmann constant (5.6697 x 10-8 Wm-2K-4), and Tf, Ts are the flame and object surface temperatures (K). Section 5.4.2 gives typical values for these coefficients for a range of fire types and sizes. 5.5.1.3 Convection Heat transfer by convection occurs when there are hot gases flowing over the surface of the object. Convective heat transfer will always occur to some extent if there is direct flame impingement and, in these circumstances, at least as much radiative heat transfer will accompany it. Convective heat transfer can occur without significant radiative heat transfer if a plume of hot gases is channelled to an object not in direct (or reflected) line of site with the flames. Heat transfer by convection from impinging flames is represented by Equation 5-19.
152-RP-48 Rev 02, Feb 2006
Page 140 of 261
fireandblast.com
qconv = h (T f − Ts ) ......................................................................... Equation 5-19 where Tf and Ts are the flame and object surface temperatures respectively (K) and h is the convective heat transfer coefficient (W m-2 K-1). The convective heat transfer coefficient varies with geometry, boundary layer conditions, gas velocity and temperature. Typical values for the heat transfer coefficient for a range of types and sizes of fire are given in Section 5.4.2. In cases where there is convective heat transfer from a hot plume, the plume temperature can be used in Equation 5-17 instead of the flame temperature if it can be reasonably estimated. 5.5.1.4 Conduction Heat transfer by conduction is very small compared to the other methods of heat transfer but needs to be taken into account in some circumstances. One-dimensional heat conduction under steady state conditions is represented by Equation 5-20 below.
qcond = k
(Ts − Tl ) L
......................................................................... Equation 5-20
where Ts is the temperature (K) of the surface exposed to flame, Tl is the temperature (K) at a thickness L (m) and k is the thermal conductivity (Wm-1K-1). The thermal conductivity of carbon steel is about 45 Wm-1K-1 and hence, even with a fairly large temperature differential, the heat transmitted is low. Hence, in most circumstances, the heat transmitted by conduction can be ignored. However, there can be problems through differential heating at the joints between thick and thin thick-walled structures. The other conditions where conduction is normally taken into account are where heat is transferred through passive fire protection or through the walls of a vessel or pipe to a fluid inside.
5.5.2 Flame position relative to the receiver Generally, flames are not static. They will move around in the wind and will vary with the fuel release rate, amount of back radiation etc. For a pool fire, the wind may tilt the flame towards, away from or sideways to the receiver. With jet fires, a co-flowing wind will elongate the flames and a variable crosswind will move the flames from side to side. A fireball will present a smaller flame area up and down wind compared to the crosswind area. An understanding of the geometry of the flame is essential in order to apply the heat transfer mechanisms identified in the previous section. Modern, validated empirical and phenomenological models are now available for most of the standard situations but the user needs to be aware of the limitations and simplifications made in the model used if the results are to be relied upon. Summaries and comparisons of these models are available in the standard reference books e.g. “Yellow book” (1997) [5.10], SFPE Handbook (2002) [5.11], Lees (2005) [5.12]. Some of these models have been incorporated in commercially available suites of programmes e.g. FRED, PHAST. The following are given as examples: •
Carsley (1995) [5.13] has developed a model for predicting the probability of impingement of jet fires;
•
Cracknell et al. (1995) [5.14] have developed one for the heat flux on a cylindrical target due to the impingement of a large-scale natural gas jet fire.
•
Chamberlain (1995) [5.15] considered the hazards from confined pool fires in offshore modules.
A feature of most of these models is that the surface emissive power used for a particular situation will depend on how the flame geometry is modelled for that situation. Hence a model using a high surface emissive power and relatively low flame area may/should give the same answer as a model using a relatively low surface emissive power but larger flame area. Combustion models used in computational fluid dynamics (CFD) have advanced, enabling more realistic modelling in situations where the fire scenario can be fully described (this is discussed 152-RP-48 Rev 02, Feb 2006
Page 141 of 261
fireandblast.com further in Annex D). However, in preparing a safety case, only general assumptions are normally made and in practice, CFD would only be used to look at a particular case in detail when the extent of the safety issues or costs at risk justify it. In assessing the heat transferred, the key decision is on whether or not the object is impinged by flame. For the general case, it may be sufficient to apply a safety margin, e.g. 50 %, to the flame length given by a model or the relevant table in Section 5.4.2. If a key structural item is of particular concern, e.g. a platform support leg, one approach used by industry is to estimate (using a solid flame model) the distance for 50 kW m-2 received radiation and assume that everything within this distance is impinged by flame and that everything outside this distance only receives radiation. In practice, the heat transferred to a receiver will depend on whether it is fully, partially or not enveloped in flame and, in partially or totally enclosed modules, how much re-radiation there is from walls, ceilings and process plant. Even when there is full engulfment, the situation is still complicated as the: •
Relative proportions of radiative and convective load from a flame will vary depending on the fuel type and location of the object within the flame.
•
Total heat loads will vary depending on the fuel type, the size and shape of the object and the location of the object within the fire:
Particularly with jet fires, the flames can be channelled along and around an object where heat loads will vary over the surface of the object and the heat absorbed by the object will vary with time. Whilst detailed analysis may now be made using CFD and finite element analysis, calculations for an initial analysis can be readily performed if some of the above factors are simplified. As indicated in Section 5.3, the main simplifying assumptions are that: •
There are no heat losses;
•
The flame and receiver surface are considered grey bodies;
•
The ambient temperature can be neglected; and
•
In most circumstances, heat conduction can be ignored.
In these circumstances, the heat transferred to the object surface from an impinging flame may be represented by Equation 5-8.
qtotal = qrad + qconv = ε s σ ( ε f T f4 − Ts4 ) + h (T f − Ts ) ...................... Equation 5-21 If the object is not impinged by flame (e.g. beyond the 50 kWm-2 distance) then, ignoring the hot plume case, the heat transfer is by radiation and the solid flame model (Equation 5-1) should be applied.
qrad = V f E τ ................................................................................ Equation 5-22 If the object is more than two flame widths/lengths away then the point source (Equation 5-3) or a multipoint source model (where the source is split into a number of zones, each representing a fraction of the total radiation emitted and each zone represented by a point source emitting this fraction of the radiation) may be used as an alternative to the solid flame model. It may be used at closer distances but the results will be very conservative. This may be acceptable in some situations.
152-RP-48 Rev 02, Feb 2006
Page 142 of 261
fireandblast.com
qrad =
τ F m H ............................................................................ Equation 5-23 4π d2
5.5.3 Temperature rise All the equations given above provide the heat flux to the surface of the receiver. The key requirement is to determine the temperature rise in the item being considered and the time taken to reach the critical temperature for that particular component. The main situations considered are: •
Unprotected steel;
•
Fire protected steel;
•
Pressure vessels (unprotected and protected);
•
People.
As the heat absorbed is a time dependent process. Mathematical models, particularly finite difference methods, are available which can undertake these calculations from first principles or with the input parameters εs, εφ, Tf and h as determined by the particular model used or as provided in the tables in Section 5.4.2. Such models may also simultaneously calculate the heat up of a structure, a vessel or pipe work contents. However, conservative calculations of heat up can be undertaken on the basis that, at any particular time, steady state conditions exist. 5.5.3.1 Unprotected steel The equations given in FABIG Technical Note 1 [5.16] are still valid. However, those equations used a section factor (Hp/A, m-1) defined as the heated perimeter (Hp, m) divided by the steel crosssectional area (A, m2). ASFP (2002) [5.17] comment that in new European fire testing and design standards (e.g. ENV 13381-4 2002 [5.18], BSEN 1993-1-2 2005 [5.19] and BSEN 1994-1-2 [5.20],) the section factor (the unit remains the same, i.e. m-1) is defined as Asteel/Vsteel (note: the steel subscripts are provided here to avoid confusion with other parameters) where Asteel is the surface area of steel exposed to fire per unit length and Vsteel is the volume of the section per unit length. Using the Asteel and Vsteel notation, for a fully engulfed steel member, e.g. an I-beam, the heat up of the steel member is described by Equation 5-24 below.
ε s σ (σ f T f4 − Ts4 ) + h (T f − Ts ) =
Vsteel dT Csteel ρ steel .................... Equation 5-24 dt Asteel
Where Csteel is the steel heat capacity (Jkg-1 K-1) and ρsteel is the steel density (kg m-3). A steel section with a large surface area will receive more heat than one with a smaller surface area and the greater the volume the greater the heat sink. Hence the lower the section factor the slower an I - beam will heat up. For an I - beam, the heated perimeter (ASFP still use this in their examples and data sheets) is calculated as:
152-RP-48 Rev 02, Feb 2006
Page 143 of 261
fireandblast.com
Figure 5-4 “I” beam heated perimeter Where B and D are the overall breadth and depth of the section and W is the web thickness. A comprehensive list of heated perimeter equations for different types of beams, columns etc are given by ASFP in the “Yellow” book (ASFP, 2002) [5.21]. For a steel section that is not engulfed in flame, the heat up of the steel member is described by Equation 5-25.
qrad = V f E τ =
Vsteel dT Csteel ρ steel ............................................... Equation 5-25 dt Asteel
In this case, the heated perimeter is the projected area of the member that sees the radiation. Equation 5-24 and Equation 5-25 can be solved numerically (e.g. by using a spreadsheet with fixed cell addresses for the constants) by using incremental time steps. An example is given in Section 5.4.3.3 on pressure vessels. 5.5.3.2 Fire protected steel The Interim Guidance Notes [5.22] advocate a heated perimeter approach when the steel is insulated. The equation assuming that the fire protection material has negligible heat capacity is shown below (Equation 5-26). It is assumed that the insulation surface temperature (Ts) rapidly reaches the flame temperature.
dT =
Asteel K PFP (Ts − T ) dt .................................................... Equation 5-26 Vsteel Csteel ρ steel L
where KPFP is the thermal conductivity of the protection material and L the thickness of the insulation material. It should be noted that the thermal conductivity and heat capacity of both the steel and the insulation material will vary with temperature and, for accurate calculations; these would have to be expressed as parametric equations. API (2005) [5.23] give approximate thermal conductivity values for typical insulations, e.g. light weight cementitious 0.51 W m-1 K-1, but the values given are approximate and should be treated with caution. The problem is that it is very difficult to obtain a realistic value for both the thermal conductivity and heat capacity as most forms of passive fire protection react in a complex way. 152-RP-48 Rev 02, Feb 2006
Page 144 of 261
fireandblast.com Generally, steel may be protected from fire by passive fire protection, which may take the form of a cladding or a coating (cementitious, vermiculite or intumescent). Summaries of their properties are reiterated below and should be read in conjunction with further detail in Section 3.5.1, “Firewalls” and 3.5.2 “Passive fire protection methods”. •
Inert cladding e.g. ceramic boards, a thin steel panel backed by mineral wool, a removal jacket or a composite panel. The insulation backed steel panels act as passive insulator until the insulating materials melts leaving voids. Insulation materials such as rock wool contain resins that will melt and migrate. Composite panels may comprise a series of panels of different materials with either air gaps between them or some or all of the gaps filled with insulating material. In most of these cases, the thermal conductivity needs to take account of different materials and of internal voids giving rise to internal convection effects and heat capacity will vary with each material used.
•
Cementitious coatings. These will act as passive insulator with a thermal conductivity dependent on the amount of water present until the temperature reaches about 100 °C. The temperature will be kept at this until all the chemically and physically bound water has been driven off. The temperature will then rise with the material again acting as passive insulator but with a different thermal conductivity. Hence, an overall thermal conductivity value must account for movement and evaporation of water in a situation where the total amount of physically bound water is not likely to be known.
•
An intumescent coating. These react to flames by melting and then swelling to form a hard char five to ten times thicker than the unreacted material thickness. The char is gradually eroded away exposing unreacted material, which then reacts to form more char. Hence the unreacted material is gradually being used and, once it has all been used, bare steel will be exposed. In this case, the thermal conductivity needs to take account of the unreacted material and the char and the fact that there are continual boundary and phase changes.
Not withstanding all the problems identified, the manufacturers will have data from furnace tests with cellulosic and hydrocarbon heat up curves and will have resistance to jet fire test data. In general, the manufacturers will use the ASFP (2002) [5.24] method to derive the thickness of material required to protect against a particular fire scenario or combination of fire scenarios e.g. jet fire preceding a pool fire. The manufacturers will have performed a series of furnace tests conducted on structural elements with varying section factors, usually between 50 and 350 m-1, to various fire durations and limiting temperatures. The thickness of material (L) required to provide specific standards of fire resistance e.g. at least 1 hour for a mean temperature rise of 140 °C, is derived by means of the empirical relationship:
tresist = a0 + a1 L
Vsteel + a2 L ............................................................ Equation 5-27 Asteel
where tresist is the fire resistance time (minutes). The furnace tests are chosen to cover the range of section factors, thicknesses and duration required. The constants, a0, a1 and a2, applicable to each material are determined by multiple linear regressions. Once a satisfactory correlation has been obtained, the protection thicknesses for a given section factor and required fire resistance time can be derived using the rearranged equation:
L=
tresist − a0 ........................................................................... Equation 5-28 V a1 steel + a2 Asteel
Generally, interpolation of fire test data is allowed but extrapolation is not. ASFP (2002) [5.25] give illustrations of how this works with product data sheets based on cellulosic fire curve furnace tests. 152-RP-48 Rev 02, Feb 2006
Page 145 of 261
fireandblast.com A method of combining the results from furnace and jet fire tests is to compare results from tests on substrates with similar section factors (usually about 100 m-1) and use this to derive an “erosion” factor which is added to the value obtained from the expression derived from the furnace tests. This data can also allow approximate thermal conductivities and heat capacities to be determined but they will be product specific and the manufacturers of the products being considered should be consulted. 5.5.3.3 Pressure vessels There are many different processes occurring when a flame interacts with a pressure vessel due to the complex behaviour of the flame, the vessel and the vessel contents. API has considered the requirements for pressure relief valves (API 520, 1997) [5.26] and emergency depressurisation systems (API 521, 2005) [5.27] and these are considered in Sections 6.6.2 to 6.6.5 discussing relieving and other process responses. However, API only considers relatively small hydrocarbon pool fires and, if it is a realistic fire scenario, a pressure vessel is much more likely to fail in a jet fire. This was reviewed by Roberts et al. (2000) [5.28] and the Institute of Petroleum (2003) [5.29] have published guidance on the effects of severe fires on pressure vessels and Scandpower (2004) [5.30] have considered this in regard to emergency depressurisation. The key processes occurring during jet-fire impingement on pressure vessels include: •
Heat transfer between the fire and outer surface of the vessel, in the vapour and liquid 'zones', by radiation and convection;
•
Heat transfer through the vessel walls by conduction. The wall may comprise of an outer passive fire protection (PFP) coating plus the underlying steel wall;
•
Heat transfer into the vessel fluids by predominantly radiation in the vapour space, and by natural convection or nucleate boiling in the liquid phase;
•
Mass transfer from the bulk liquid or vapour to the outside environment through any holes in the vessel;
•
Mass transfer out of the vessel through any open or partially open pressure safety valves (PSVs);
•
Mass transfer within the liquid phase by flow of heated fluid into a stratified 'hot' layer lying above the bulk liquid. The hot layer may or may not be stable;
•
Mass transfer between the liquid and vapour phases by evaporation;
•
Pressure, enthalpy and composition changes (e.g. relative fractions of mixed hydrocarbons in a separator) in the fluids during each of the above processes;
•
Catastrophic vessel failure resulting in a possible BLEVE.
The heat transfer processes described above are shown schematically in Figure 5-5.
152-RP-48 Rev 02, Feb 2006
Page 146 of 261
fireandblast.com
Figure 5-5 Heat and mass transfer Various models have been proposed that take these factors into account although few have been fully validated. Persaud et al. (2001) [5.31] has applied the Shell HEATUP [5.32] model to the heat up and failure of LPG tanks. They give equations for all the physics describing heat and mass transfer processes and predict vessel failure by comparing the hoop stress with the ultimate tensile strength of steel. In practice, when a fire impinges on a vessel containing liquid, the wall in contact with vapour will heat up very quickly and the wall in contact with liquid will stay at a relatively low temperature unless film boiling occurs. In flashing liquid propane jet fire trials on unprotected 2 tonne LPG tanks (Roberts et al., 2000) [5.33] the vapour wall reached up to 870 °C on failure whilst the wall in contact with liquid did not exceed 230 °C. 5.5.3.3.1 Vessel walls LPG trials indicate that the prime cause of failure, at least for relatively thin walled vessels, was heating the wall in contact with vapour to a temperature where the steel weakened rather than due to over pressurisation although over pressurisation will be an important factor if a vessel becomes hydraulically full. Gayton and Murphy (1995) [5.34] also suggest that time to metal plate rupture is used in depressurisation system design. On this basis, a conservative estimate can be made of the time to failure by ignoring the heat transfer to the contents. As indicated above, the iterative process for solving the time dependent heat transfer equations is illustrated for the vessel vapour wall case. In a time step ∆t, the object will heat up by ∆T given by:
∆T =
∆t q0
Csteel ρ steel L
.......................................................................... Equation 5-29
where the initial heat absorbed by the wall (ignoring heat losses to the contents) is given by Equation 5-30 below.
152-RP-48 Rev 02, Feb 2006
Page 147 of 261
fireandblast.com
q0 = ε sσ ( ε f Tf4 − T04 ) + h (Tf − T0 ) .................................................. Equation 5-30 At time t1 = t0 + ∆t, the surface temperature will be T1 = T0 + ∆T, where T0 is the initial surface temperature. Using the new T1 and substituting into Equation 5-30, then the heat absorbed at time t1 is,
q1 = ε sσ ( ε f Tf4 − T14 ) + h (Tf − T1 ) .................................................. Equation 5-31 So, in general, at time ti, the thermal flux absorbed by the object is given by:
qi = ε sσ ( ε f Tf4 − Ti 4 ) + h (Tf − Ti ) ................................................... Equation 5-32 and the temperature of the object will increase to Ti+1 = Ti + ∆Ti where
∆Ti =
∆t qi
Csteel ρsteel L
.......................................................................... Equation 5-33
In order to illustrate the conservatism of the data in Section 5.4.2, both trials data and data derived from Table 5-1 are given below in Table 5-7. Table 5-7 Data for calculation of LPG tank failure
Flashing liquid fires 1 kg s-1 (From Table 5-1)
Trials data
Total incident flux (kWm-2)
230
170
Radiative flux (kWm-2)
160
110
Convective flux (kWm-2)
70
60
Emissivity of flame εf
1.0
0.8
Emissivity of steel εs
0.8
0.8
1300
1320
70
60
5.67 x 10-8
5.67 x 10-8
0.0071
0.0071
Density of steel, ρ (kg m-3)
7850
7850
Heat capacity of steel, C (J kg-1 K-1)
520
520
Parameter
Temperature of flame, Tf (K) -2 -1
Heat transfer coefficient, h (Wm K ) Stefan-Boltzman constant, σ (Wm-2K-4) Wall thickness, L (m)
The predicted rise in wall temperature, for an initial temperature of 20 °C, is illustrated in Figure 5-6. The measured times to failure and maximum wall temperatures (all at positions in contact with vapour) for each degree of fill are summarised in Table 5-8, the same failure points also shown in Figure 5-6.
152-RP-48 Rev 02, Feb 2006
Page 148 of 261
fireandblast.com Table 5-8 LPG tank failure data Degree of fill of 2 tonne tank (%)
Time to failure (s)
Maximum wall temperature at failure (Celsius)
Pressure at failure (barg)
20
250
870
16.5
41
286
704
21.3
60
217
821
18.6
85
254
848
24.4
Heat up times
1200
Wall temperature (oC)
1000
800
600 Flashing liquid jet fire data
400
Trials data Failure data
200
0 0
60
120
180
240
300
Time (s)
Figure 5-6 Comparison of heat up time with LPG failure times and temperatures A comparison can also be made with API (2005) [5.35] data for an unwetted 25.4 mm plate. API 521 [5.35] gives 12 minutes to reach 593 °C. Use of the small hydrocarbon pool fire data in Table 5-3, gives about 11 minutes as the time; (the API data are based on calculations from a gasoline trial with a 0.125” plate). 5.5.3.3.2 Vessel contents The overall response of pressure vessels is considered further in Section 6.6. As indicated above, the actual heat transfer processes are very complex. Traditionally, the API (2005) [5.36] approach has been used to calculate the heat transfer to a vessel contents. For vessels containing only gas, vapour or super-critical fluid the vessel wall is considered to be unwetted and the heat transfer to the contents is not directly calculated. For vessels containing liquid, the approach is based on the heat transfer to the wetted surface of vessels up to a height of 7.6 m; as only relatively small hydrocarbon pool fires are considered. Two expressions are given; one (Equation 5-34) where adequate drainage and fire fighting equipment exists and one (Equation 5-35) where it does not.
152-RP-48 Rev 02, Feb 2006
Page 149 of 261
fireandblast.com
Qabsorb = 43200 F A0.82 .................................................................. Equation 5-34 Qabsorb = 70900 F A0.82 .................................................................. Equation 5-35 where Qabsorb is the total heat absorbed (W), F is an environment factor and A is the total wetted surface area (m2). The expression A0.82 is an area exposure factor which recognises that large vessels are less likely than small ones to be completely exposed to the flame of an open fire. In the likely confinement offshore, it would be more appropriate to use A rather than A0.82. The environment factors are given in Table 5-9. Table 5-9 API 521 environment factors Type of equipment
Environment factor (F)
Bare vessel
1.000
Water deluge protected vessel
1.000
Depressurising and emptying facilities
1.000
Insulated (conductance 22.71 kWm-2 K-1) vessel
0.300
Insulated (conductance 11.36 kWm-2 K-1) vessel
0.150
Insulated (conductance 5.68 kWm-2 K-1) vessel
0.075
Insulated (conductance 3.80 kWm-2 K-1) vessel
0.050
Insulated (conductance 2.84 kWm-2 K-1) vessel
0.038
Insulated (conductance 2.27 kWm-2 K-1) vessel
0.030
Insulated (conductance 1.87 kWm-2 K-1) vessel
0.026
Note that credit is only given for insulated vessels. API now makes it clear that the insulation must be passive fire protection but the requirement is that the insulation material should function effectively up to 904 °C. As is recognised by API, their approach is not suitable if the fire scenario identified is more severe than a about 110 kW m-2 hydrocarbon pool fire e.g. a jet fire or a confined hydrocarbon pool fire. Hekkelstrand and Skulstad (2004) [5.37] consider slightly higher heat fluxes than API. They consider small to medium size fires on the basis that the aim is to prevent escalation to a large fire. Two figures are given for the incident heat fluxes from fuel-controlled fires. The local peak heat load is used to calculate the rise in steel temperature and global average heat load is used to calculate the pressure profile. Their incident heat fluxes for jet and pool fires are summarised in Table 5-10. Table 5-10 Global and local peak loads Jet fire Heat load
Pool fire Leak rate > 2 kgs-1
Leak rate* > 0.1 kgs-1
Local peak (kWm-2)
350
250
150
Global average (kWm-2)
100
0
100
* This calculation is for an object close to the fire.
Various rules are given for the application of these values and the original publication should be consulted before use of the values given. 152-RP-48 Rev 02, Feb 2006
Page 150 of 261
fireandblast.com 5.5.3.4 Effect of fire protection on heat transfer to vessels 5.5.3.4.1 Directed water deluge No credit is given for directed deluge systems in API 521 [5.38] as the reliability of water application is uncertain because of freezing weather, high winds, clogged systems, unreliable water supply and vessel surface conditions that can prevent uniform water coverage. However, it is suggested that systems designed to NFPA 15 [5.39] can be effective. NFPA specifies an application rate of 12 l m-2min-1. This is derived from small-scale pool fire trials where the application rate is taken as the amount of water leaving the nozzles divided by the vessel surface area. The NFPA [X] requirements for nozzle spacing and spray angle are very general. In practice, it is the amount of water flowing over the surface of the vessel, which has the greatest influence on fire resistance. As only between 35 % and 45 % of the water exiting the nozzles actually forms a film on the vessel surface, a poorly designed system delivering the minimum requirement of 12 l m-2min-1 may not even fully protect against a pool fire. Although the application requirement of 10 l m-2min-1 in the FOC tentative rules (1979) [5.40] is lower than the NFPA [5.41] requirement, systems designed to these will, in general, apply more water to the surface of the vessel as there is a more detailed specification of the nozzle spacing (longitudinal and stand-off from the surface), numbers of rows of nozzles and spray angle relative to the size of vessel. There has been considerable interest in the use of directed deluge in protecting against jet fires. White and Shirvill (1992) [5.42] have shown that deluge systems with the usual medium velocity nozzles are not effective in protecting against natural gas jet fires. Lev (1995) [5.43] has suggested that it may be possible with systems using high velocity nozzles and White and Shirvill (1992) [5.44] suggest it may be possible with high velocity water monitors. Shirvill (2003) [5.45] has shown that a system delivering about 17 l m-2min-1 is not effective in fully protecting (keeping the wall temperature to 100 ºC or less) vessels against 2 to 10 kg s-1 flashing liquid propane and butane jet fires. Roberts et al. have shown that about 30 l m-2min-1 will protect 2 tonne vessels against 2 kg s-1 flashing liquid propane jet fires. Hankinson and Lowesmith (2003) [5.46] have looked at the effectiveness of area and directed deluge in protecting against “live” jet fires. Davies and Nolan [5.47] have empirically modelled the parameters for predicting the surface water coverage and have developed a practical method for characterising the water coverage. All these recent results are summarised in a special edition of the Journal of Loss Prevention in the Process industries (March, 2003) [5.48]. Even though a directed deluge system may not be fully effective (primarily in protecting the unwetted wall) in protecting against flashing liquid propane and butane jet fires, Shirvill [X] suggests that the overall rate of heat transfer is reduced by 50 %. This is consistent with results (Roberts, 2003) [5.49] from 20 % filled LPG tanks. 5.5.3.4.2 Passive fire protection Roberts and Moodie (1989) [5.50] have shown that a range of fire protection materials are suitable for protecting LPG tanks against hydrocarbon pool fires. As indicated previously, API (2005) [5.51] takes reduced heat input into account by the use of environment factors. These environment factors are calculated using Equation 5-36.
F=
kPFP ( 904 − Trelief ) .................................................................. Equation 5-36 66570 L
where kPFP is the thermal conductivity (Wm-1K-1) of the PFP, Trelief the temperature (°C) of the vessel contents at relieving conditions and L is the thickness (m) of the insulation. API [5.52] provides thermal conductivities for a range of materials but these may only be strictly applicable to hydrocarbon pool fires. In general, PFP materials that have successfully, i.e. meeting the required time to critical temperature, passed a resistance to jet fire test (Jet Fire Working Group, 1995) [5.53] will be suitable for protecting pressure vessels against jet fires. Roberts et al. (1995) [5.54] have shown that this is at least true for LPG vessels. At present, there appear to be no standardised criteria for 152-RP-48 Rev 02, Feb 2006
Page 151 of 261
fireandblast.com the protection of pressure vessels. LPGA (2001) [5.55] suggests that 90 minutes to reach 300 °C (the temperature at which carbon steel starts to lose its strength) is suitable for LPG vessels. Higher temperature criteria may be suitable for thicker walled (> 12 mm) vessels or for vessels made from steel alloys, which maintain their strength to higher temperatures. 5.5.3.5 People The response of people to fires is considered in Section 6.7. Hymes et al. (1996) [5.56] have considered the physiological and pathological effects of thermal radiation and relate these to a thermal dose (note: dosage is usually taken as irradiation x time). The thermal dose (s (W m-2)4/310-4) is given by: 4
TL = t ( qrad ) 3 10−4 ......................................................................... Equation 5-37 where t is the exposure time (s), qrad the radiation (Wm-2) received and 10-4 a convenient scaling factor. The radiation received should be calculated from either the solid flame model if close to the fire or the point source model if more than two flame widths/lengths away from the source. From a major hazard perspective, there are two issues: •
How long can a worker continue to operate in an emergency system whilst exposed to a given level of radiation?
•
What fraction of the population will die or sustain injury given exposure to a certain dose of radiation?
In regard to the former, API (2005) [5.57] provides permissible design thermal radiation levels for personnel. These are given in Table 5-11 below (Note: API 521 [5.58] should be consulted to consider these in the context - disposal by flaring - in which they are given). Table 5-11 API 521 permissible radiation design levels Permissible design level (kWm-2)
Conditions
9.46
Maximum radiant heat intensity at any location where urgent emergency action by personnel is required. When personnel enter or work in an area with the potential for radiant heat intensity greater than 6.31 kW m-2, then radiation shielding and/or special protective apparel (e.g. a fire approach suit) should be considered a
6.31
Maximum radiant heat intensity in areas where emergency actions lasting up to 30 s may be required by personnel without shielding but with appropriate clothing b
4.73
Maximum radiant heat intensity in areas where emergency actions lasting 2 to 3 minutes may be required by personnel without shielding but with appropriate clothing b
1.58
Maximum radiant heat intensity at any location where personnel with appropriate clothing b may be continuously exposed.
Superscript notes: •
It is important to recognise that personnel with appropriate clothing b cannot tolerate thermal radiation at 6.31 kW m-2 for more than a few seconds.
•
Appropriate clothing consists of hard hat, long-sleeved shirts with cuffs buttoned, work gloves, longlegged pants and work shoes. Appropriate clothing minimises direct skin exposure to thermal radiation.
152-RP-48 Rev 02, Feb 2006
Page 152 of 261
fireandblast.com The lethality to the population is usually addressed by probit or logit analysis. The two commonly used probit relations for fatality are: Eisenberg (based on nuclear bomb data) ........... Y = −14.9 + 2.56 ln ( X )
Equation 5-38
43 Where X = t qrad
Lees (valid up to 70% mortality) .......................... Y = −10.7 + 1.99 ln ( Z X )
Equation 5-39
where ZX is a function of X depending on whether clothing ignites. Hymes et al. [5.59] gives doses for probability of 1 % and 50 % lethality as 1050 s(W m-2)4/310-4 and 2300 s (W m-2)4/310-4 respectively. These correspond to a radiation dose of 8.6 kW m-2 for 1 minute or 2.6 kW m-2 for 5 minutes for 1 % lethality and 15.4 kW m-2 for 5 minutes for 50 % lethality. More details on using these and other methods are given by Lees et al. (1996) [5.60]. The response of personnel is considered further in Section 6.7.
152-RP-48 Rev 02, Feb 2006
Page 153 of 261
fireandblast.com
6. Response to fires 6.1 Properties of common materials in use offshore 6.1.1 Overview At normal temperatures steels used in offshore structures are designed to behave elastically, the stress strain behaviour is linear in both compression and tension and beyond yield the slope of the stress-strain flattens markedly. For normal design conditions (i.e. excluding extreme weather for structural steel, fires and explosions) the stress in the steel should be below 60 % of the yield stress. As the temperature rises, the yield stress and the modulus of elasticity both reduce, at a temperature of about 400 ºC the yield stress reduces to about 60% of its value at normal temperatures, and consequently this temperature is often taken as a critical temperature at which the behaviour of the steel changes and failures can start occurring. Concrete is not commonly used offshore but there are about 24 platforms in the North Sea with concrete substructures. The top of the concrete is usually several metres below the underside of the main deck, but it can be subjected to pool fires on the sea surface or the jet fires from risers. Concrete can withstand a pool fire for a significant time, the outer layer of the concrete normally serves to protect the underlying steel from corrosion, but in a pool fire protects the steel and the bulk of the concrete from the effects of fire, at least for some time. In a jet fire the concrete cover can rapidly be eroded, exposing the steel reinforcement to the effects of the flame
6.1.2 Mechanical For simple beams or ties, the yield strength at elevated temperature is all that is required. For a compression member the yield and the elevated temperature value for Young’s modulus is required. For a complex FE analysis, the complete stress-strain curves at elevated temperature are required. The most comprehensive source of material properties for the common structural carbon steels is EC3-1-2. (S235, S275, S355, S420 and S460 of EN 10025, EN 10210-1 and EN 10219-1). Many steel grades will be compatible with the European grades. BS5950-8 gives similar information but tends to be less detailed. For other grades of steel, one of the best sources of information is FABIG Technical Note 6 [6.1]. This contains mechanical properties for: Carbon Steels •
BS EN 10113-3:1993, grades 355M, 420M (based on Helsinki University research), 460M
•
BS7191 grades 355EMZ, 450EMZ
Stainless Steels •
BS EN 10088 grades 1.4301(304), 1.4404(316), 1.4462(2205), 1.4362(SAF2304)
The properties of the RQT and TMRC steels tend to be lower than the normal carbon steels. At 400 ºC their relative strength is about 10 % lower. Stainless steels tend to maintain their strength and stiffness at elevated temperatures compared with carbon steels. For any carbon structural steel, the rate of loss of stiffness is greater than the rate of loss of strength (see Table 6-1). Consequently, for the same load level, buckling will occur at a lower temperature than a failure depending on strength.
152-RP-48 Rev 02, Feb 2006
Page 154 of 261
fireandblast.com Table 6-1 Reduction factors for strength and stiffness (EC3-1-2) Steel temperature
Reduction factor for effective yield strength
Reduction factor for the slope of the linear elastic range
20 ºC
1.000
1.000
100 ºC
1.000
1.000
200 ºC
1.000
0.900
300 ºC
1.000
0.800
400 ºC
1.000
0.700
500 ºC
0.780
0.600
600 ºC
0.470
0.310
700 ºC
0.230
0.130
800 ºC
0.110
0.090
900 ºC
0.060
0.068
1000 ºC
0.040
0.045
1100 ºC
0.020
0.023
1200 ºC
0.000
0.000
It can be seen in the table that the strength of steel falls very quickly. This makes an assessment of the steel temperature very important. At about 500 ºC a 10 % difference in temperature can lead to a 16 % loss of strength. For some heat treated and special steels it may be necessary to carry out tests to establish the necessary properties. This is because the enhancement of properties caused by the heat treatment may be lost if the steel is heated beyond the heat treatment temperature. The mechanical properties given in EC3-1-2 are based on anisothermal tests. In these tests, the steel is first loaded and then heated. The steel responds by expanding due to thermal expansion and elongating due to the stress. As the steel loses strength and thickness the rate of elongation increases until a run-away occurs. From a series of such tests at different stress levels, stress strain curves can be derived for a range of temperatures. The rate of heating is important. The EC3 data is based on steel being heated at about 10 ºC per minute. This corresponds to a 60 minute fire resistance in a building where failure will occur at about 600 ºC. For heating rates between 2 ºC and 50 ºC per minute the EC3 data is reasonable and the effects of creep may be ignored. Because of the effects of creep, if the heating rate is faster the data will be conservative and for slower heating rates it will be unconservative. It should however be emphasised that potential heating rates are much faster in fire incidents offshore. In any hydrocarbon fire flame temperatures can be in excess of 1500 ºC and temperatures of close to 1800 ºC have been recorded. The maximum temperature will depend on the size of the fire and the degree of ventilation. In a hydrocarbon fire, unprotected steel will heat very quickly and will reach temperatures associated with structural collapse in 5 minutes or so. Concrete loses strength at a broadly similar rate to structural steel but loses stiffness at a faster rate. The best reference is EC4-1-2 [6.2] (composite construction).
152-RP-48 Rev 02, Feb 2006
Page 155 of 261
fireandblast.com Both BS5950-8 and EC3-1-2 give the same information on the strength of bolts and welds at elevated temperatures. As these are not well known, the information is shown here in Table 6-2. The yield strength is also shown for comparison. Table 6-2 Strength retention factors for bolts and welds Temperature
Strength reduction factor for bolts (tension and shear)
Strength reduction factor for welds
Yield strength
20 ºC
1.00
1.00
1.00
100 ºC
0.97
1.00
1.00
150 ºC
0.95
1.00
1.00
200 ºC
0.94
1.00
1.00
300 ºC
0.90
1.00
1.00
400 ºC
0.78
0.88
0.97
500 ºC
0.55
0.63
0.78
600 ºC
0.22
0.38
0.47
700 ºC
0.10
0.13
0.23
800 ºC
0.07
0.07
0.12
900 ºC
0.03
0.02
0.06
It can be seen that both bolts and welds lose strength at a faster rate than structural steel. However, because of the partial factors used for normal and fire design this effect is not as significant as it might appear (see Section 6.4.2).
6.1.3 Thermal The thermal properties of the common structural steels are given in EC3-1-2. The thermal properties of concrete are given in EC4-1-2.
6.2 Effects of fire and nature of failures 6.2.1 Standard hydrocarbon fire test In a hydrocarbon fire resistance test [6.2, 6.3, 6.4], the gas temperature is increased to 1100 ºC in about 20 minutes and then held constant. The temperature time curve of the ISO and BS hydrocarbon test fires are compared with the standard cellulosic fire in Figure 6-1. Fire resistance tests are generally only useful for comparing the performance of different products under constant conditions. Regulations and specifications will often refer to a performance standard measured in a fire resistance test. Extrapolation to real fire behaviour can sometimes be misleading. The results of a hydrocarbon fire test are often expressed as H60 or H90 etc.
152-RP-48 Rev 02, Feb 2006
Page 156 of 261
fireandblast.com
1200
Hydrocarbon
Temperature (°C)
1000
800
Cellulosic 600
400
200
0 0
30
60
90
120
Time (mins)
Figure 6-1 Time temperature curves for hydrocarbon and cellulosic fires in fire resistance tests
6.2.2 Jet fire test A draft ISO standard, ISO/CD 22899-1 [6.5] is being developed to advise on requirements for small scale jet fire tests. It has recently been agreed that there will be a Part 2 giving the background to the test, more clarification on classification and a combination of furnace and jet fire test results etc. The method provides an indication of how passive fire protection materials perform in a jet fire that may occur. Jet fires give rise to high convective and radiative heat fluxes as well as high erosive forces. In the test, a sonic release of a gas (0.3 kg s-1) is aimed into a shallow chamber, producing a fireball with an extended tail. Propane is used as the fuel. High erosive forces are generated by release of the sonic velocity at about 1000 mm from specimen surface. The results from the small scale test have been compared with full scale jet fire test results from four testing establishment laboratories. The test standard gives guidance on the use of the test result and its application to the assessment of passive fire protection material.
6.2.3 Types of failure 6.2.3.1 General Structural failure is any unwanted occurrence and may take any form from excessive deformation to total collapse. In a fire, the structure has to carry the applied loads at the time but it also is subject to thermally induced loading which may, for some elements be more severe. The thermally induced loads are caused by restrained thermal expansion. It is also important that the consequences of minor failures on system are analysed with respect to their effects on other systems. For example, a minor structural failure could lead to the fracture of a pipe or breakdown in an electrical system. Another consideration is repair. Has something failed if it does not have to be repaired? Minor residual deformations following a fire may not impair the function of the component or any other component and can probably not be described as failure. 152-RP-48 Rev 02, Feb 2006
Page 157 of 261
fireandblast.com A summary table of the failures of the more obvious (safety critical) elements which may give rise to escalation and to which the above issues should be applied may be found below. Table 6-3 Safety critical element failure or loss of function with respect to fire hazards
System or equipment category
Safety critical element failure or loss of function
Performance Standard Requirement (with respect to fire escalation normally part of survivability characteristics See other parts of Sections 6 & 7 of this Guidance)
Primary structure
Failure is direct cause of major (catastrophic) structural collapse
– Resistance to defined fire loads for a given duration (for example, a jet fire direct impingement for a duration 15 minutes - say until process pressure is adequately reduced (to limit the reach of the jet flame). The failure would be when the structure could no longer maintain its load within defined deformation limits whose exceedance would cause further breaches of process integrity or collapse of safety areas or evacuation systems. – Residual strength requirement defined
Secondary structure
Failure allows shifting of load paths and generation of contributory increased loads (ultimately) to primary structure
– Resistance to defined fire loads for a given duration – Residual strength requirement defined
Supporting steelwork for vessels/piping
Failure allows distortion/movement/collapse of hydrocarbon containing vessels and piping with subsequent loss of containment integrity
– Resistance to defined fire loads for a given duration – Limits to movement are defined
Supporting steelwork for equipment
Failure allows distortion/movement/ collapse of rotating equipment/ lifting equipment/ utilities leading to potential loss of containment integrity/ equipment failure/generation of dropped objects/ missiles/ potential loss of power for some safety systems (control, ESD, detection, active protection etc.)
– Resistance to defined fire loads for a given duration – Limits to movement are defined
Supporting steelwork for accommodation/ control/ muster areas/TR
Failure allows distortion/movement/collapse of areas of key hazard control and places of safety/embarkation for POB
– Resistance to defined fire loads for a given duration – Limits to movement are defined – Limits to loss of airtight integrity defined – Residual strength requirement defined
Supporting steelwork for flooring/ access ways
Failure allows distortion/movement/collapse of access for POB to places of hazard control/safety/embarkation
– Resistance to defined fire loads for a given duration – Limits to movement are defined
Vessels/ main piping
Failure leads directly to loss of containment integrity in hydrocarbon containing vessels and piping
– Resistance to defined fire loads for a given duration – Resistance to impact and explosion loads also defined
152-RP-48 Rev 02, Feb 2006
Page 158 of 261
fireandblast.com
Safety critical element failure or loss of function
Performance Standard Requirement (with respect to fire escalation normally part of survivability characteristics See other parts of Sections 6 & 7 of this Guidance)
Vessel appurtenances/ small bore piping
Failure leads to small leaks (loss of containment integrity in hydrocarbon containing vessels and piping) with potential for further fires and explosions
– Resistance to defined fire loads for a given duration – Resistance to impact and explosion loads also defined
Gas detection
Fire from small event may disable systems to detect further escalating events
– Event size and time delay before triggering defined – Generally resistance to fire and other hazard loads impractical, continuing function achieved by redundancy
Fire detection
As above
– Event size and time delay before triggering defined – Generally resistance to direct impingement of fire and other hazard loads impractical, continuing function achieved by redundancy
Blast walls
Blast walls usually have protective requirement with respect to fires as well as explosions, loss of fire resistance integrity following an initial blast will potentially allow spread of fire hazard to other areas
– Resistance to impact and explosion loads defined – Resistance to defined fire loads for a given duration following initial events also defined
Fire walls
Failure leads to loss of control and hence allows unimpeded escalation of the initial event
– Resistance to impact and explosion loads defined (where possible) – Generally resistance to direct impingement of fire and other hazard loads impractical, continuing function achieved by redundancy
Active fire protection systems
Failure leads to loss of control and hence allows unimpeded escalation of the initial event
– Resistance to impact and explosion loads defined (where possible) – Generally resistance to direct impingement of fire and other hazard loads impractical, continuing function achieved by redundancy
Passive fire protection systems
Failure leads to loss of mitigation and fire resistance on adjacent systems/steelwork and hence eliminates or impairs any slowing of the escalation from an initial event
– Resistance to impact and explosion loads defined (where possible) – Resistance to direct impingement of fire and other hazard loads may be impractical, continuing function achieved by diversity within suite of safety systems
HVAC
Failure of closure or redirect aspects of HVAC leads to loss of a control system for unignited gas and products of combustion, allowing unimpeded escalation of the initial event
– Resistance to impact and explosion loads defined (where possible) – Resistance to direct impingement of fire and other hazard loads may be impractical, continuing function achieved by diversity within suite of safety systems
System or equipment category
152-RP-48 Rev 02, Feb 2006
Page 159 of 261
fireandblast.com
6.2.4 Loss of compartmentation Fire spread by loss of compartmentation will increase the likelihood of most types of failure so loss of compartmentation is an important type of failure and within the UK, regulations refer to loss of insulation and loss of integrity. Testing a component in isolation in a fire resistance test may result in acceptance criteria that may be simple to achieve. In the test, a combination of good detailing and a suitable thickness of insulation will normally suffice. However, when a component, such as bulkhead is built into an offshore structure, the interaction between the bulkhead and its boundaries must be considered. Restrained thermal expansion can lead to buckling which may dislodge fire protection material. Boards and thickly sprayed material will be more affected, whilst intumescent coatings will normally be sufficiently flexible. Intumescent coatings will not protect against a loss of insulation. Their activation temperature is generally greater than the limit on temperature rise (140 °C). The biggest problem is in preventing gaps opening up through which the fire might spread. Awareness and good detailing are probably the best ways to prevent this type of fire spread. Designers should be aware of the likely magnitude of any gaps. In some circumstances the use of intumescent mastic may be of use. Frequently compartment boundaries will be penetrated by pipe work or some form of duct. Maintenance of compartmentation will normally depend on the performance of a proprietary penetration seal for which there should be suitable test evidence and careful installation and regular inspection. 6.2.4.1 Thermally induced deformation 6.2.4.1.1 Linear expansion Expansion is difficult to resist and a heated member can exert extremely large forces at its supports. Fully restrained steel will yield at a temperature below 200 ºC, the exact temperature depends on the grade of steel. A beam, designed to resist bending, has a relatively large axial resistance and, if restrained, may have an affect structure at some distance from any source of heat. In building fires, damage to bracing members has been observed 40 metres away from the fire. 6.2.4.1.2 Buckling Restrained members may buckle to relieve induced compression. For simply supported members this may not cause a problem but, for continuous members, bending resistance at supports may be lost. Buckled steel can cause problems on cooling as the buckling may not be reversed and the steel becomes shorter than its initial length. Connections may be pulled apart. Potentially the tensile force generated is equal to the yield resistance of the member. Failures have been observed in both bolted and welded connections and also in the section itself. Buckling can also occur in any member in compression, when the buckling resistance falls to the level of the applied or design load. The onset of this type of buckling may be exacerbated by axial restraint. However, often, if supporting structure is capable of exerting compressive restraint, then it is also capable of taking up load when a member starts to buckle. This is a complex mechanism which depends on the extent of a fire as well as the structural form. 6.2.4.1.3 Thermal bowing Any section which is non-uniformly heated will tend to bow. For most sections the free bowing is a simple function of the temperature difference across the section. A 500 mm deep section, 12 metres long, with a temperature difference of 300 ºC will bow by about 125 mm. A linear gradient will cause no stress in a steel member. A non-linear gradient will cause longitudinal shear 152-RP-48 Rev 02, Feb 2006
Page 160 of 261
fireandblast.com stresses to be induced. In some types of partially protected steel beam, compression flanges can, in the early stages of a fire, go into tension. In a continuous member, thermal bowing will lead to very large induced restraining moments which are added to any existing moments (Figure 6-2). This can lead to failure of connections and buckling of compression flanges and webs. Deformation caused by thermal bowing can cause disruption of services and effect equipment performance.
Increase due to thermal bowing
Figure 6-2 The effect of thermal bowing on the bending moment in a continuous beam. 6.2.4.2 Load induced phenomena 6.2.4.2.1 Bending Beams will generally withstand large deformations before they are unable to support their design load. In fire tests and actual fires deformations in excess of span/20 are common. Continuous beams may be more vulnerable because of the addition of thermally induced moments at their ends. This may make laterally torsional buckling of some cross sections more likely. In many forms of construction, as deformations increase, tensile membrane action may become increasingly dominant. In plated construction, this will supplement the bending resistance and can sometimes carry all imposed loads. Often, if a beam supports a plated floor, the beam and plate can act together in fire, although not designed to do so. This can enhance strength and stiffness. Large deformations due to loss of bending stiffness will affect connections, as described above. 6.2.4.2.2 Tension Tension members will lose strength in direct proportion to the loss of yield strength. Isolated tension members are rare in any structure so, as a tension member loses strength and lengthens under load, loads redistribution tend to occur. Elongation can be significant. At 550 ºC, a tension member carrying 50 % of its normal resistance will elongate by about 1.25 %. This Assumes a stress induced component of 0.5 % and a thermal expansion component of about 0.75 %. For a 6 metre length this is 75 mm. 6.2.4.2.3 Compression A member in compression will fail at a lower temperature (about 80 ºC lower than a bending member at the same load level). This is because the stiffness of carbon steel reduces at a faster rate than the strength.
152-RP-48 Rev 02, Feb 2006
Page 161 of 261
fireandblast.com For most compression members, the applied stress in fire may be increased due to restrained thermal expansion, see above. 6.2.4.3 Brittle and ductile failure Generally, in highly redundant structures, any mode of failure will be ductile as there will be redistribution of load. However, failures such as those caused by induced thermal stresses on welds and bolts will be brittle but may be followed by an immediate redistribution of load to other parts. The consequences of the failure of large elements in redundant structures need careful consideration. For example, Topsides with significant cantilevered decks, which support the TR at the extremity, are prone to progressive local collapse, especially where critical MSF deck braces are required to support the cantilever. Localised failure due to yielding under fire however will in most cases redistribute the gravity loads elsewhere to unaffected areas, except under extreme e.g. riser rupture type scenarios, thus, as damage and local failures accumulate, the final failure may be sudden as redistribution of load becomes impossible. 6.2.4.4 Examples of structures following fire
Figure 6-3 Tensile membrane action in the web of a beam (photo by permission of Corus plc, [6.6, 6.7])
152-RP-48 Rev 02, Feb 2006
Page 162 of 261
fireandblast.com
Shear capacity maintained by unsplit side of plate
Tensile force induced on cooling
Fractured end plate
Typical split in connection occurring on cooling Figure 6-4 Failure of a welded connection on cooling
(Photo by permission of BRE, [6.8])
6.2.5 Escalation issues The discussion of failure leads onto a major issue for the robust design of installations against major accident hazards. The failure of a component or part of a system may give rise to a cascading series of events leading to catastrophic failure or loss of life. A systematic, structured approach to escalation analysis should be adopted to determine if, how and when an event can escalate to endanger personnel. The escalation analysis should comprise: •
The assessment of potential escalation paths from an initiating event towards a major accident hazard as defined in the Safety Case or towards a “safe” shutdown;
•
Identification of the mechanisms by which that initial event could escalate to impinge on key safety systems or facilities (such that the available safety systems can no longer function to slow or stop the escalation);
•
Evaluation of the probability of each escalation path and the time duration from the initial event.
•
Re-evaluation of the design to minimise damage to or failure of SCEs and produce an ALARP solution
Appropriate consideration should also be given to the actions of key personnel in responding to an incident, taking into account the effects of the hazard under review. In the case of fire, these effects would comprise heat, smoke other products of combustion, the impacts to be considered would be injury, burns, obscuration of vision and impaired breathing and judgement. The growing scale of the incident should be understood and the dynamic of the incident growth such that there were not unrealistic expectations of personnel performance, e.g. speed of running, ability to carry or assist injured colleagues etc. This assessment should include how operators have contributed to the detection of the fires (especially in the case of a Normally Unattended Installation) as well as how they respond. The 152-RP-48 Rev 02, Feb 2006
Page 163 of 261
fireandblast.com speed and accuracy of detection will impact the potential escalation paths of the initiating incident and if additional detection information from operating personnel contributes to an accurate diagnosis of the event underway, this should be included in the emergency response assessment. In the UKCS, the requirement for defining Safety Critical Elements is included in Statutory Instrument 1996 No. 913 “The Offshore Installations and Wells (Design and Construction, etc.) Regulations 1996,” [6.9] where Safety Critical Elements means “such parts of an installation and such of its plant (including computer programmes), or any part thereof •
the failure of which could cause or contribute substantially to; or
•
a purpose of which is to prevent, or limit the effect of, a major accident.
It can be seen that equipment or devices that prevent, slow or stop the escalation are by definition safety critical elements. The discussions of acceptance criteria and failure should be linked to the review of methods of prevention (Section 3.3), detection and control (Section 3.4) and mitigation (Section 3.5). The consolidation if these issues will contribute to the definition of the Performance Standards (see Section 3.6) in the context of fire hazards and their management mechanisms. If a major fire occurs then safety of the occupants is the major priority. It is important to give occupants sufficient time, either to escape or to sit it out in the Temporary Refuge until the danger has passed. Depending on the location of a fire, any escape route must be adequately insulated to be tenable. Structurally, deformation leading to disruption of another system, or leading to an escape route or refuge becoming untenable must be considered to be failure. Deformation is controlled by design (computer simulation etc) and by the application of passive protection. For further details on impacts to human beings and therefore understanding the limits to escalation, see Section 6.7.
6.3 Acceptance criteria 6.3.1 General Structures are designed for several limit states and what is acceptable for one limit state may not be acceptable for another. When considering collapse, deformation may not be considered, but when considering effects on safety critical elements and disruption to production, deformation is clearly important. In fire, acceptance criteria are set for any components tested in a standard fire resistance test. In addition, in critical areas more stringent requirements may be set by the safety authorities or specified by the client. The most straightforward criteria are the failure criteria specified in fire resistance test standards.
6.3.2 Criteria used in standard fire tests Fire resistance test standards such as BS476, ISO834 [6.10] or EN1363 [6.11] use three failure criteria for structural elements They provide a means of quantifying the ability of an element to withstand exposure to high temperatures, by setting criteria by which the load bearing capacity, the fire containment (integrity) and thermal transmittance (insulation) functions can be evaluated. Linear structural elements such as beam only have to satisfy the load bearing criterion as they are do not form a barrier to the spread of a fire. Separating elements, which directly prevent the spread of fire, such as a bulkhead have to satisfy all three criteria. 152-RP-48 Rev 02, Feb 2006
Page 164 of 261
fireandblast.com For buildings, as a consequence of European Harmonization, fire resistance is increasingly being expressed in terms of “resistance to collapse” (R), ”resistance to fire penetration (E) and “resistance to the transfer of excessive heat” (I), all of which are describe in more detail below. This terminology may be adopted for offshore structures in due course. Resistance to collapse (R) is the ability to maintain load bearing capacity (which applies to load bearing elements only) or the ability not to collapse (non-load bearing elements only). The use of the term “resistance to collapse” can be applied to load bearing and non-load bearing elements and as such is preferred. For loaded beams and floors, failure is deemed to occur when the deflection reaches span / 20 or, when the deflection is greater than span / 20, the rate of deflection exceeds span2 / (9000D). D is the distance from the top of the element to the bottom of the design tension zone. All dimensions are in millimetres. As well as experiencing large deformations beams experience large strains. Tests and calculation have shown that strains in excess of 3 % are common in the bottom of an I - beam in a fire test. For steel beams, the application of any of the deformation criteria will have a small effect as the difference between the time to collapse and the time when any of the criteria might apply is small. Fire containment or the resistance to fire penetration (E), is the ability to maintain the integrity of the element against the penetration of flames and hot gases (this applies to fire-separating elements). Integrity failures should be rare in fire resistance tests for essentially steel elements. Problems are more likely to occur in actual fires at junctions between elements. Thermal transmittance refers to the resistance to the transfer of excessive heat (I) and is the ability to provide insulation from high temperatures (this applies to fire separating elements). An insulation failure is deemed to occur when the average temperature rise on the unexposed face of a separating element exceeds 140 ºC or the maximum temperature rise exceeds 180 ºC, whichever occurs first. These limits are to prevent combustion of any material which may be close to the unexposed face. Their origins are unknown and, in many cases, the limits may be excessively conservative. In a fire test an insulation failure will occur because the insulation is not adequate, or, it may occur because the insulation becomes detached, often called a “stickability” failure. Often tests on vertical separating elements are carried out on unloaded, unrestrained elements. Results from such tests must be interpreted with care and the systems tested must be carefully installed. Table 6-4 Performance requirements for elements of construction Component Load bearing beams and columns Load bearing floors, walls and partitions non load bearing separating floors, walls and partitions
Requirement R R,E,I E,I
6.3.3 Relationship between criteria used in standard fire tests and actual performance in real fires In the UK, fire tests are carried out on small elements. Beams generally have a span of 4.5 m and columns, which in any case are rarely tested, are 3.2 m high. Wall panels are tested at 3 m x 3 m. Elements in real structures are often many times the size tested or have no associated test evidence. Structurally, there will often be little to learn from a Standard Fire Test and designers must look elsewhere, at the limited evidence available from some large scale tests or rely on their 152-RP-48 Rev 02, Feb 2006
Page 165 of 261
fireandblast.com FE models. Even if the test is considered to be reasonable, any time measured in the test should not be thought as actual time in any real fire. In many cases, for a passive fire protection material, the results of fire resistance tests are all the information that is available. Designers must decide whether the heating regime in the test adequately represents the design scenario. If it is important to limit deformation then, interestingly, the “stickability” of the material and its ability to deform is less important than it would be for a case in which large deformations or strains are permitted. Fire resistance test results on passive fire protection tests in the cellulosic fire should be used with extreme care when considering performance in any hydrocarbon fire. A jet fire rating equivalent to an A or H rating has been proposed in the latest draft version of the ISO (22899-1) [6.12], (based on the jet fire test criteria proposed in ISO 13702 [6.13]) specified as: Type of application / Critical temperature rise (°C ) / Type of fire / Period of resistance (minutes)
6.4 Methods of assessment 6.4.1 General There are two possible approaches to carrying out structural analysis for the fire condition. Design codes such as BS5950-8 [6.14] and EC3-1-2 [6.15] offer simple ways of checking elements. However, the codes were written for building structures and will not always be suitable for highly redundant offshore structures. Alternatively there are various types of finite element analysis available which are capable of analysing large substructures or even the whole structure. It is also possible to simply modify the existing “normal” or cold analysis by adopting elevated temperature material properties. In order to analyse any structure in fire a thermal model is required. For simple linear elements, all that is required is the temperature distribution across the section at the mid point. This may be computed using a 2-D thermal analysis. For more complex elements and whole structures, ideally, the complete temperature history of all parts of the structure is required although some simplification may be possible. In carrying out a thermal analysis, the modelling of proprietary fire protection is not straightforward. For fairly simple insulating materials, it should be possible to obtain a reasonable estimate of the thermal properties. Intumescent materials behave in a very complex manner, as they react differently in different situations. The local thickness of steel and the heating rate are important. When carrying out any analysis, it is necessary to establish the applied loads on the structure. BS5950-8 [6.16] and EC3-1-2 [6.17] allow loads to be reduced below the normal design values in fire as it is considered that the probability of fire and full design load occurring at the same time is rare. BS5950 is slightly more conservative than the Eurocodes. For an offshore structure, the partial factors should be agreed between all parties. It is also important to use appropriate mechanical material properties. BS5950-8 and EC3-1-2 effectively specify identical material properties for use in fire. However, BS5950 specifies different strain limits for different types of element and mode of behaviour, the elements referred to comprise composite structures not seen in the offshore industry (steel and concrete arrangements, see Sections 6.4.3.3 and 6.4.3.4 for more details).
6.4.2 Partial factors for fire In determining the structural resistance required, the applied loads on the structure at the time of fire must be calculated. Both BS 5950-8 [6.16] and the Eurocodes allow reductions in some applied loads in fire reflecting the accidental limit state. These reductions, which are for buildings, are summarised in Table 6-5. For BS5950-8, the reductions are expressed as factors, for the 152-RP-48 Rev 02, Feb 2006
Page 166 of 261
fireandblast.com Eurocodes the reductions are expressed as Ψ1,1 factors. The use of Ψ1,1, rather than Ψ2,1, is expected to be recommended in the UK National Annex to EC1-1-2 [6.18]. In fire, the applied force or moment is given by: Gk + Ψ
fi
Gk
is the characteristic value of a permanent action
Qk,1
is the characteristic value of the leading variable action 1
ψ fi
is the combination factor for fire situation, given either by (frequent value) or (quasipermanent value) according to paragraph 4.3.1(2) of EN 1991-1-2 [6.19].
Qk ,1
where
It is expected that, in the UK, the more conservative frequent value, ψ1,1, will be used for ψfi Table 6-5 Applied load reductions in fire BS 5950-8
Eurocode
γf
ψ1,1
Office
0.50
0.50
Escape stairs and lobbies
1.00
0.70
Other (including residential)
0.80
0.50
Storage
1.00
0.90
Snow
0.00
0.20
Wind
0.33
0.20
All
1.00
1.00
Type of load Imposed
Permanent
Location/type
The values in the above table have been derived for buildings and may not be applicable to offshore structures. They are based on statistical evidence and are almost certainly conservative. It should be possible to derive similar information for offshore structures and subsequently eliminate possible costly over design. As an illustration of what might happen consider wind loading. The design case for wind might be for a once in 50 year’s gust. During a fire, a structure might be vulnerable for a few hours. For the same level of reliability, the wind load might be only 20 % of the 50 year level.
6.4.3 Methods in structural design codes 6.4.3.1 Introduction Many countries have structural design codes for fire and shortly the Eurocodes will be finalised. Almost without exception, these codes are for building structures and may only be of limited use for offshore structures as building structures are generally much simpler than offshore structures with less interaction between different elements. An important consideration when assessing structures or structural elements in fire is that, compared with cold, design, large deformations and strains are allowed. The strength of steel is normally expressed as the stress corresponding to 2 % strain, and deformation limits in fire resistance tests are about 20 times greater than might be allowed in cold design. 152-RP-48 Rev 02, Feb 2006
Page 167 of 261
fireandblast.com The assessment methods can be used for beams and compression members. Little information is given for plated structures. It is normal to assume that members are unrestrained. Problems relating to expansion and restraint were discussed earlier in Section 6. 6.4.3.2 Member analysis In a member analysis, the applied loads are calculated using the appropriate partial load factors. The end reactions are generally calculated making the same assumptions that were made for the initial design. The effects of thermal restraint and any second order or P-delta effects are ignored. Only load carrying ability is considered so deformations are ignored. For compression members it is normal to consider the possibility that the degree of end fixity may increase in fire leading to a reduction in effective length. Codes such as EC3-1-2, allow the effective length in fire to be 50 % of the system length, although, in the UK this may be conservatively limited to 70 %. The reduction is based on two factors. Firstly, in a building a column will be constructed as a continuous member and secondly, it can reasonably be expected that the temperature at the ends will not be as high as at the mid-height position. The method is useful for beams or columns which are not heavily restrained and for simple ties. 6.4.3.3 BS5950-8 BS5950-8 covers both non-composite construction and composite construction (steel acting with concrete). For non-composite all the guidance relates to beams, columns and tension members. It gives some guidance on unprotected steel but this is limited to 30 minutes fire resistance in the standard cellulosic fire and would not normally be applicable offshore. For beams it gives two methods of assessment. The load ratio – limiting temperature method is largely based on fire resistance test results and is principally for I - section beams. The load ratio is the ratio between the member resistance in fire and the normal, cold, member resistance. The code assumes that the strength of a beam can be characterised by the temperature of the bottom flange and that, in some circumstances, a colder top flange will be beneficial. However, a colder top flange is assumed to be supporting a concrete floor. No guidance is given for beams supporting steel plated floors. The second method is based on moment resistance. From knowledge of the temperature distribution across the section and the material properties at elevated temperatures, the plastic bending resistance may be computed. This method is useful for unusual sections but cannot be used without the temperature distribution. Where a comparison can be directly made, this method is slightly more conservative than the load ratio – limiting temperature method. For members in compression, the only method given is the load ratio – limiting temperature method and the information is, again, based on standard fire resistance test data. For compression members with comparatively low slenderness, there is a built in assumption that the column will have an effective length in fire of about 85 % of the assumed cold effective length. BS5950-8 gives simple interaction formulae to allow the load ratio to be calculated for both beams and columns. A method for checking concrete filled structural hollow sections is given. However, the method given EC4-1-2 is more robust and is recommended. In a useful annex, BS5950-8 gives guidance on re-use of steel following a fire and what one should look for when inspecting a building. 6.4.3.4 EC3-1-2 EC3-1-2 is for non-composite construction only. EC4-1-2 deals with composite construction. 152-RP-48 Rev 02, Feb 2006
Page 168 of 261
fireandblast.com For use in the UK (for buildings) both codes will have a national annex. All Eurocodes contain some nationally determined parameters. They also contain some informative annexes. For any country, the National Annex will give values for the nationally determined parameters and guidance on the use of informative annexes. The structural Eurocodes are all written in the same format. The design methods start with tabular data. This is followed by simple design methods and finally there is some guidance on advanced methods. EC3-1-2, however, has no tabular data as the only useful data would be on the protection of steels using proprietary fire protection materials. The bulk of the design information is in the form of simple calculation methods. It concludes with some guidance on advanced methods. The term “simple” is sometimes a misnomer, as a small program or spreadsheet is required. For beams in buildings, EC3 is generally less conservative than BS5950-8. However, for beams not supporting concrete floors it is very similar to BS5950 8. EC3 starts from the assumption that beams are uniformly heated. Their bending resistance is reduced by the reduction in yield strength. It then allows an “adaptation” factor to be applied that may take into account of a temperature gradient and, for a continuous beam, colder support conditions. For compression members, EC3 gives a simple method in which a non-dimensional slenderness is calculated which leads to a reduction in the squash resistances. The method is a modified form of all other Eurocode strut formula. EC3-1-2 gives some guidance on members made from sheet steel with class 4 cross-sections. These thin sections rapidly heat up and quickly lose strength. The guidance is for completeness and academic interest. The strength of bolts and welds at elevated temperatures was given earlier in Table 6-2, EC3-1-2 gives some guidance on checking connections in fire. For example, for a bolt, EC3 states:
Fv ,t ,Rd = Fv,Rd kb,θ
γM2 γ M , fi
Where;
kb, θ
is the reduction factor determined for the appropriate bolt temperature from Table 6-2.
Fv,Rd
is the design shear resistance of the bolt per shear plane calculated assuming that the shear plane passes through the threads of the bolt
γM2
is the partial safety factor at normal temperature
γM,fi
is the partial safety factor for fire conditions
The important point to make is that although the reduction factor from Table 6-2 is lower than for structural steel, the partial factor at normal temperature, γM2, is 1.25 and the factor for fire, γM,fi, is 1.0. Thus the effect of the reduction factors is somewhat ameliorated. Guidance is also given on advanced calculation methods. In this context, this refers to finite element modelling. It states that the model for mechanical response shall take account of:
•
The combined effects of mechanical actions, geometrical imperfections and thermal actions;
•
The temperature dependent mechanical properties of the material;
•
Geometrical non-linear effects;
152-RP-48 Rev 02, Feb 2006
Page 169 of 261
fireandblast.com
•
The effects of non-linear material properties, including the unfavourable effects of loading and unloading on the structural stiffness.
EC3-1-2 and EC4-1-2 have their roots in the ECCS Model code on fire engineering [6.20]. This code also includes information on fires, covered by EC1-1-2. It also contains a commentary on many of the clauses. In due course, conflicting national standards will be withdrawn. At the time of writing, the situation is:
•
The loading code, EC1-1-2 was published at a full European standard in 2002. EC3-1-2 and EC4-1-2 are undergoing final editing and should be available during 2005. For all three codes, the UK National Annexes are expected in 2007.
6.4.4 Finite element modelling 6.4.4.1 General The use of Finite Element (FE) modelling is now becoming the norm. Packages exist which can carry out both thermal and structural modelling, incorporating Computational Fluid Dynamics (CFD), which will allow the growth and spread of fire to be modelled. Finite element models can range from frame models with simple linear elements to complex models utilising a number of element types, some of these applications are discussed in the following sections. In all examples and applications, the FE package being used should have been validated against test data and the engineers using the package should be trained and preferably experienced in the types of analysis being undertaken. 6.4.4.1.1 Frame models Trusses comprising slender members or portal-like structures can be analysed as simple frames, however the analysis should be non-linear and capable of dealing with large displacements. Ideally the models should be 3D as 2D will not pick up some buckling modes. 6.4.4.1.2 Complex models Complex finite element models should give the best prediction of structural performance. However, any model is only as good as its input data. There is little point carrying out an expensive FE analyses unless the thermal history is known with a degree of confidence and the design scenarios assumed are reasonable. For more information on FE modelling see Section 6.4.4.8. 6.4.4.1.3 Modified “cold” model It is sometimes reasonable to use the same structural model as was used for the normal, cold, design in fire. Applied loads are appropriately factored and elevated temperature values for yield stress and Young’s modulus are used. For a structure, or parts of the structure, which are not highly restrained or which are not highly redundant the method may give reasonable answers but it is impossible to say whether the results from such an analysis are conservative or unconservative. 6.4.4.2 Structural modelling Before any FE analysis is carried out the conceptual model of the structure should be carefully checked and possibly agreed with any potential certification authority. Consideration should be given to the need to include initial imperfections and whether a dynamic option should be included in the analysis. It is important that any analysis includes all non-linear effects and that it can model membrane action. The sensitivity of any analysis to the mesh density should be investigated 152-RP-48 Rev 02, Feb 2006
Page 170 of 261
fireandblast.com (although not necessarily for each job). Experience has shown that FE analyses of the same fire and structural scenario using the same software, carried out by more than one group, can produce widely different results. The differences are often due to differences in the conceptual model. The assumptions regarding boundary conditions must be justified. If a substructure is being analysed, the boundary condition assumptions regarding restraint thermal expansion can greatly affect results. Also, at junction between two elements is there a load path and should adjacent nodes be connected and in what way? Is the mesh sufficiently fine? Is the analysis being carried out by an experienced engineer? These are all very important considerations which must be addressed if the results are to be trusted. In some areas it may be possible to carry out some preliminary “scoping” analyses to get some idea what answers might be expected from the FE. Following any analysis, the results should be carefully examined and anything that looks unusual should be investigated. It may be correct or it may be due to an error in the conceptual model. Compared with an elemental approach, any FE approach based on the same temperature distribution should give more reliable results. However, many FE models will not properly predict localised behaviour such as connection failure due to the need to refine the mesh density, unless the analyst is aware of the possibility of such failure and has made an allowance for it in the model. The main problems in any FE modelling start with the fire. In order to get a reliable estimate of structural behaviour a reliable fire model is required. Often, designers will impose the Standard Fire (hydrocarbon, cellulosic etc) on the structure. This may meet any regulatory requirements but it can never model reality. In any real fire scenario, the heat flux impinging the structure will be different from place to place and will vary in time. Imposing the Standard Fire will not allow effects due to temperature differences to be modelled. 6.4.4.3 CFD Computational fluid dynamics (CFD) can potentially predict the growth and movement of air, smoke, and flame. CFD is probably more complex than structural mechanics and although, researchers have been working on CFD for many years it is still in its infancy. In building design, it is used to predict smoke movement but many think it is not particularly good at predicting preflashover fires. This should be less of a concern for any form of hydrocarbon fire as the preflashover phase will be less significant. At present, the above cautionary advice for structural modelling, applies even more to CFD modelling. Knowledge of fire and an understanding of what a particular package is doing are paramount. 6.4.4.4 Eurocode requirements for advanced models The structural Eurocodes all contain similar advice on using advanced models. The relevant parts are summarised below: The analysis should include:
•
The effects of non-linear material properties, including the effects of unloading on the structural stiffness and the effects of cooling;
•
Validation of advanced calculation models;
•
The validity of any advanced calculation model shall be verified;
•
A verification of the calculation results shall be made on basis of relevant test results;
•
The critical parameters shall be checked, by means of a sensitivity analysis, to ensure that the model complies with sound engineering principles.
152-RP-48 Rev 02, Feb 2006
Page 171 of 261
fireandblast.com Some of these requirements may appear to be very severe. It is recommended that they need not be followed for every structure analysed but they do emphasise the need to use validated software.
6.4.5 Definition and assessment of secondary steelwork In deciding which structural members need to have their performance checked in fire the required performance for the structure for each particular limit state must be considered. All primary elements of structure will need to be assessed and will probably require some form of fire protection. A secondary member is one which, for the particular fire limit being considered, will not cause failure of a primary member or loss of compartmentation by its removal. All secondary members require assessment but may not require protection. For example, a secondary beam, spanning between larger primary beams and supporting a plated floor may be sacrificial in fire. For the fire scenario under consideration, deformation of the floor may be unimportant. A steel plated floor system will often be able to act as a membrane and not require additional support. The beam may not be critical for giving restraint to the primary beam. However, in a severe fire heat may be conducted along an unprotected beam into the primary beam and thus reduce the fire resistance of the primary beam. For practical reasons it might be better to protect the entire secondary beam rather than simple coating the ends. Secondary members, which when cold, restrain a primary member may require fire protection to continue fulfilling this function when hot. However, experience has shown that at the reduced applied loads in fire, the restraint may not be necessary. For example, loads may be resisted by membrane action and the restraint may not be required. It is important to consider that it does not follow that a member which carries load will always be required in fire. The function of all members should be looked at. Only members which may fail or deform in fire leading to a performance requirement not being met should be considered for protection. Simple design methods are not able to provide information on whether secondary members require special consideration. Only a full non-linear FE analysis will provide this information.
6.5 Attachments and coat-back An unprotected secondary member attached to a protected primary member will allow heat to be conducted into the primary member and may reduce its fire resistance. Most operators’ specifications require a length of any attachment to primary steelwork protected with passive fire protection to be similarly protected. The attachment acts as a heat conductor into the primary steelwork. Hence, it can introduce a localised hot spot at its connection with the primary member. The extent of the hot spot depends on the relative geometries of the primary member and the attachment. The purpose of the coatback is to reduce heat conducted through the attachment into the primary member and hence limit the extent and severity of the local hot spot. In this way, the potential of premature failure can be avoided. The coat-back length needs to be adequate to achieve this objective. A joint industry study [6.21] of the effects of coat-back on the primary member temperature demonstrated the following:
•
The required coat back length should be determined based on the local average temperature which can be tolerated in the primary member at the attachment location. As the coat-back temperature increases this temperature reduces. However, beyond 150 mm, any further reduction is small.
•
The ratio of the cross sectional area of the attachment to that of the primary member was found to have a significant influence on the temperature. The ratio of the section factors (Hp/A) has secondary significance.
152-RP-48 Rev 02, Feb 2006
Page 172 of 261
fireandblast.com
•
The effect of the attachment on the temperature increased with increasing fire resistance period. Thus, to maintain the same temperature in the primary member a longer coat-back length would be required for a 2 hour duration than for 1 hour.
•
Within the limits of the study, it was found that the section shape (of both the primary member and attachment) had negligible effect.
•
The properties of fire protection material have a small effect on coat-back length.
6.6 Process responses 6.6.1 General A key requirement for any design is knowledge of the quantity, composition and properties of the fluids to be processed and of the associated operating conditions (temperature, pressure, flow rate etc.). The section is primarily concerned with the response of pressurised systems to fire. In a fire, a pressurised system (e.g. vessel, pipeline or heat exchanger) will fail through weakening of the containment material with temperature and time and/or over-pressurisation caused by heating up the fluid contents. Generally, offshore systems are fitted with pressure relief systems to prevent over-pressurisation and blowdown systems to prevent loss of containment. Relief systems automatically release the contained fluid if the fluid pressure within the system exceeds the system’s lowest design pressure. These systems usually consist of relief valves or bursting discs and they are designed to initiate at the set pressure without the intervention of the operator. Blowdown systems are mechanisms for release of the vapour content from the system as a result of operator action or as part of automatic control sequences. A system is normally blown down as part of a planned shutdown or an emergency such as a fire that may weaken a plant component so that it fails below the relief system set pressure. In both relief and blowdown systems, it is necessary to dispose of the fluid safely, usually by burning it in a flare stack or venting to atmosphere. There are numerous references that discuss relief devices and relief sizing; examples are Parry (1992) [6.22], Diers (1992) [6.23], CCPS (1998) [6.24], HSE (1998) [6.25] and Energy Institute (2001) [6.26]. Roberts et al. (2000) [6.27] have reviewed the literature available (up to 2000) on the response of pressurised process vessels and equipment to fire attack in regard to the new data available since publication of the IGNs [6.28] and the remaining gaps in knowledge.
6.6.2 Relief Traditionally, API 520 (2000) [6.29] has been used to size pressure relief valves for non-reactive systems using heat inputs derived from the fourth edition of API 521 (1997) [6.30]. These heat inputs have not been changed in the fifth edition of API 521 (2005) [6.31] although it is now recognised (e.g. Energy Institute, 2003) [6.32] that more severe fires can occur than those assumed by API. It should be recognised that pressure relief will not protect a vessel or pipeline from failure if there is a high heat load to wall in contact with gas or vapour is this will rapidly heat up to a temperature where the steel weakens. However, if the vessel/pipeline can be prevented from failure due to weakening, e.g. by PFP (or deluge although it is not currently taken into account), then the pressure relief valve can be effective under fire loading providing that the possibility of two-phase flow is adequately considered. There are a considerable number of standards for relief valve sizing e.g. API 520 [6.33], API 2000 [6.34], NFPA 30 [6.35] and NFPA 58 [6.36] (for LPG) and ISO 4126 [6.37]. These are reviewed by the Energy Institute (2001) [6.38] and recommendations are made, based on experimental data, for the safe and optimum design of relief systems. Their publication also goes into detail on which is the most appropriate relief device for the different situations. In particular, they consider the advantages and disadvantages of using:
•
Conventional spring-loaded relief valves;
•
Balanced relief valves;
•
Air assisted relief valves;
152-RP-48 Rev 02, Feb 2006
Page 173 of 261
fireandblast.com
•
Buckling pin valves;
•
Bursting discs; and
•
High integrity pressure protection systems.
They provide advice on relief system design, sizing of relief system systems and design of flare and vent systems. In general, the recommendations complement those of API 520 and API 521 but, in the specific case of two-phase discharge, they suggest that the API method may not be adequate, particularly in the case of high-pressure discharge. This conclusion is based on experiments (described in an appendix [6.38]) involving the two-phase discharge of mixtures of natural gas, propane and condensate through orifices and relief valves.
6.6.3 Relief sizing The method of relief sizing depends on the nature of the fluid being relieved. API 520 (Part 1) and API 521 give equations to calculate the discharge areas for pressure relief devices on vessels containing super-critical fluids, gases or vapours and for non-flashing liquids. The Energy Institute (2001) have reviewed these equations and suggest that they give similar results to BS 6759 [6.39] and ISO 4126 [6.40] and hence any of these standards may be used. On the basis of comparisons with experimental data, the Energy Institute (2001) suggest that the homogeneous equilibrium model (HEM) gives the best predictions for two-phase relief flows and is preferred to the API method. They suggest that the HEM method deals naturally with cases where the flow upstream is gaseous and where condensate is formed. These cases may not be calculated accurately with the API method. Since both the API method and the pure HEM method involve flash calculations, they consider that there is little benefit from the simplification represented by the API method. The Energy Institute gives details of application of the HEM method. Whilst the HEM method for two-phase relief has been validated by tests, there is still no recognised procedure for certifying the capacity of pressure relief valves in two-phase service.
6.6.4 Blowdown The emergency depressurisation of process vessels is complex and the behaviour of the process vessel during depressurisation varies depending on the vessel contents and the conditions of the vessel. During depressurisation at ambient temperature, the temperature of the vessel may drop dramatically as the contents are released, leading to the need to consider the minimum design temperature requirements of the vessel. At the same time, however, if the vessel is exposed to an engulfing fire, the behaviour of the vessel will be very different and the pressures and temperatures experienced will significantly differ from those normally considered. The design of depressurisation systems must therefore address both the depressurisation and also the characteristics of any impinging flame, which may be the cause of the emergency depressurisation. The Energy Institute (2003) performed a survey of methods used by industry for protection against severe fires and, from the responses and information received, concluded that:
•
There is little consistency in the design methodology used, even within a single company;
•
Some said they had limited in-house expertise and engaged a specialist design contractor; and
•
Some applied API RP 521 (1997) and assumed that by designing to that code, the risk was adequately addressed.
The new version of API RP 521(2005) recommends that a vapour depressurising system should have adequate capacity to permit reduction of the vessel stress to a level at which stress rupture is not of immediate concern. For sizing, this generally involves reducing the equipment pressure from initial conditions to a level equivalent to 50 % of the vessel design pressure within approximately 15 minutes. This criterion is based on the vessel wall temperature versus stress to rupture and 152-RP-48 Rev 02, Feb 2006
Page 174 of 261
fireandblast.com applies generally to carbon steel vessels with a wall thickness of 25 mm or more. Vessels with thinner walls generally require a somewhat greater depressurising rate. It should be noted the blowdown systems are designed for vapour only flow. If the rate of depressurising is increased, there is an increased likelihood of two-phase flow occurring with consequences to the method of sizing calculation used and the need for the knockout pot in the flare header to be sized for this two-phase flow. The required depressurising rate depends on the metallurgy of the vessel, the thickness and initial temperature of the vessel wall, and the rate of heat input. For multi-component fluids, these need to be calculated over a series of time intervals that adequately take into account changes in the nature of the fluid, e.g. the latent heat of vaporisation. The recommendations in API 521 are typical for conditions in a refinery or chemical plant. However, they are not intended to cover all fire scenarios, e.g. impinging jet fires or confined fires, foreseeable for offshore installations. Gayton and Murphy (1995) [6.41] suggest that in more severe fires, rupture can occur well within the 15 minute criterion used by API. Roberts et al. (2000) [6.42] discuss application of the Shell BLOWFIRE program to give vessel wall temperature-time relationships as input to the ANSYS finite element program predicting thermal mechanical response of a second stage separator with a wall thickness from 16 to 20 mm. The BLOWFIRE predictions were that after an initial pressure drop on opening, the pressure could then increase and the ANSYS programme suggested that failure could occur at 6 minutes. It was suggested that the worst case might be partial fire engulfment where local heating of the shell causes local material expansion and the expanding material pushes against colder, unheated sections, leading to premature buckling and an increased probability of failure. The general implication is that process plant fitted with protective systems designed to API RP 521 or a similar standard may be insufficient to prevent failure of the pressure system before the inventory has been safely removed in a severe fire.
6.6.5 Blowdown system design As indicated above, the API 521 approach to the design of blowdown systems covers most of the key aspects but may underestimate the heat load in some credible offshore fire scenarios and may not be accurate if there is two-phase flow. The Energy Institute (2001) [6.43] recommend that the Gayton and Murphy [6.44] “fire risk analysis” approach is adopted to at least confirm the expected thermal loads and that the HEM method is used if two-phase flow is anticipated. The Energy Institute (2001) summarised the Gayton and Murphy approach. 1. For each item of equipment, define the type of fire (pool, jet, partial or total engulfment) likely to affect it. 2. Calculate the rate of heat input appropriate to that type of fire. 3. Calculate the rate of temperature rise of the vessel wall neglecting heat transfer to the contents. This simplification is appropriate for jet or other fires, which might affect only a small area of the vessel. More complex methods can allow for heat transfer to the contents. 4. Estimate the time to vessel rupture. From this temperature-time profile prepare a yield – stress-time profile and a corresponding rupture pressure-time profile. Compare this to the actual pressure vessel versus time for the required blowdown time. 5. If the time to rupture does not meet the established safety criteria (such as time to evacuate), then design changes may be necessary to improve the vessel protection. These may be a reduction in blowdown time, or application of fire protection insulation, or changes to the plant layout to reduce the fire exposure. The information given in this (UKOOA/HSE) guidance allows the simplified vessel wall approach to heat transfer to be followed but, if heat transfer to the contents is taken into account, sophisticated modelling is required. However, whilst there are validated models for blowdown under ambient conditions (e.g. BLOWDOWN; Haque et al., 1992 [6.45]), there appears to be no experimental data on blowdown under fire loading and hence there are no validated models. However, LPG tank pool fire (Moodie et al., 1998 [6.46]) and jet fire data (Roberts and Beckett, 1996) [6.47] has been used to partially validate models, e.g. BLOWFIRE, that are designed to cover a range of discharge 152-RP-48 Rev 02, Feb 2006
Page 175 of 261
fireandblast.com devices i.e. the models have been used to predict the pressure relief results. API (2005) and the Energy Institute (2001) give the equations for calculating the blow down orifice. In 2003, the Energy Institute published interim guidelines for the design and protection of pressure systems to withstand severe fires. In this, the heat transfer to the vessel is split in terms of radiative and convective fractions and the heat transfer to the vessel contents is discussed in a similar way (see Section 5.5). They give an iterative procedure based on calculating, for each process segment (isolatable section) and each time step: 1.
Pressure;
2.
Temperature in all fluid phases;
3.
Fluid composition in each phase;
4.
Flow rate through the orifice;
5.
Liquid levels;
6.
Temperature in the metal;
7.
Temperature downstream of the orifice;
8.
Heat transfer at all interfaces; and
9.
Stresses to which the pipes and equipment are exposed.
These are related to the:
•
Acceptance criteria for failure;
•
Given total capacity of the flare system;
•
Method for initiating depressurisation (manual or automatic); and
•
Time delay for initiation of depressurisation.
The Energy Institute approach is based on that of Hekkelstrand and Skulstad (2004) [6.48]. They have refined their approach with the emphasis on using fast depressurisation making the maximum use of the flare stack capacity and on minimising the use of passive fire protection.
6.6.6 Failure criteria In order to know what measures to take, if any, in protecting an object against fire, it is necessary to know the maximum acceptable temperature of the object and the minimum allowable time to reach this temperature. Different references suggest different critical temperatures. Some of those in most common use are summarised in Table 6-6.
152-RP-48 Rev 02, Feb 2006
Page 176 of 261
fireandblast.com Table 6-6 Commonly used critical temperatures Temperature (Celsius)
Source
Criterion
Structural steel onshore
ASFP, 2002 (BS 5950)
Temperature at which fully stressed carbon steel loses its design margin of safety
427
LPG tanks (France and Italy)
API 521 (1997)
Based on the pressure relief valve setting
400
Structural steel offshore
300
550 - 620
Use
ISO 13702, 1999
Temperature at which the yield stress is reduced to the minimum allowable strength under operating loading conditions
LPG tanks (UK and Germany)
LPGA CoP 1, 1998
Integrity of LPG vessel is not compromised at temperatures up to 300 ºC for 90 minutes.
200
Structural aluminium offshore
ISO 13702, 1999
Temperature at which the yield stress is reduced to the minimum allowable strength under operating loading conditions
180
Unexposed face of a division
ISO 834 BS 476
Maximum allowable temperature at only one point of the unexposed face in a furnace test
140
Unexposed face of a division
ISO 834 BS 476
Maximum allowable average temperature of the unexposed face in a furnace test
45
Human skin
40
Surface of safety related control panel
Hymes et al., 1997 ISO 13702
Pain threshold Maximum temperature at which control system will continue to function
Failure of a steel component will occur at the time at which the superimposed stress exceeds the material strength and/or deformation limit. Knowledge of the time to failure is critical in deciding on the remedial methods to be applied to delay failure. The time to failure of a vessel or pipe work depends on the severity of the fire, the extent and type of fire protection, and the pressure response and can vary between a few minutes and a few hours. The Energy Institute (2003) considered three calculation methods:
•
Ultimate Tensile Strength (UTS) with a safety factor;
•
Flow stress (combining UTS and elongation stress); or
•
Creep rupture stress (where both temperature and time are taken into account).
In theory, the most appropriate failure criterion is the creep rupture strength, rather than the tensile strength since, as the time to rupture goes to zero; the creep rupture strength becomes equal to the tensile strength. However, in view of the complexity of creep rupture calculations (see, for example, Benham et al., 1996 [6.49]), tensile failure criteria are often used. In severe fires, the rate of temperature rise in the wall above the liquid level or in a gas/vapour only system is very high (of the order of 100 to 200 K min-1 depending on the steel thickness) and the material strength falls rapidly once the temperature exceeds 500 °C. In these circumstances, where the time involved is very short, the use of UTS may be acceptable if used with an appropriate safety factor. However, BS 7910 (1999) [6.50] suggests that the proximity to plastic collapse should be assessed by determining the ratio of the applied stress to the flow stress, where the flow stress is defined as the average of the yield and tensile stresses. Use of a flow stress of the average of, say, the 0.2 % elongation stress and the UTS would be a more conservative measure. However, if the rate of temperature rise is much slower, e.g. with a system protected by PFP, it is more appropriate to use the creep rupture stress. No consensus was reached within the Energy Institute working group on which method of assessing stress is the most appropriate for response to severe fires. It was 152-RP-48 Rev 02, Feb 2006
Page 177 of 261
fireandblast.com stated that the ambiguity remains because of the lack of validation data. Offshore vessels tend to be of a more complex design than storage vessels and will have stress raisers such as: o
Different thicknesses of material;
o
Inlet and outlet connections with constraining piping, manways etc;
o
Different types of weld materials and configurations;
o
Reaction forces during emergency depressurisation;
o
Vapour-liquid interface.
The Energy Institute states that it is not clear which of these features are critical in assessing failure or to what degree, if any, current failure criteria are conservative. Experiments are required to assist in the validation of models intended to assess such features. Unless the failure criteria are properly set, it is difficult to see how time to failure or realistic blowdown rates can be properly set. In 2004, Salater and Overa [6.51] presented data from jet fire trials (170 – 190 kW m-2 incident heat flux) on pipes pressurised with nitrogen to 85 to 90 % of their design pressure. The experiments were aimed at taking the pipes to failure and determining the failure criteria that most closely represented the results. They use Equation 5-7 to model the heat transfer to the pipe and found good agreement with the measured values for small pipes but found that the model overestimated the temperatures above 600 ºC for 250 mm pipes. It was found that pipe failure was adequately predicted by comparing the equivalent stress (von Mises) with the UTS. However, they emphasise that the pipe corrosion allowance should not be used when making the calculations and that good high temperature UTS data is needed. Hekkelstrand and Skulstad (2004) [6.52] have incorporated these results in the latest edition of their guidelines. They imply that the method may be applicable to pressure vessels containing vapour and liquid but the complexities identified above are not explicitly considered. They also provide some data on the high temperature properties of steels. Data is also available by Burgan (2001) [6.53] and Billingham et al. (2003) [6.54]. A range of assessment criteria and methods for the design of piping systems and supports against fires and explosions has been developed by SCI and published by the HSE, [6.55]. In addition to a range of simplified assessment methods, the document advises that non-linear finite element analysis permits the rupture calculations of a piping system to be based on more accurate methods which accounts for the reserve strength inherent in many design codes. It also overcomes the approximations that have been identified with the use of simplified methods.
6.6.7 Performance standards 6.6.7.1 General Use of performance standards came to prominence following issue of the Prevention of Fire and Explosion and Emergency Response Regulations (PFEER, [6.56]) and UKOOA Fire and Explosion Hazard Management Guidelines [6.57] in 1995. Performance standards are closely related to:
•
Engineering Acceptance Criteria;
•
Rule sets used in Quantitative Risks Assessments (QRA); and
•
Design Accidental Loads (DALs).
The use and interrelationship of these are considered in this section. According to the PFEER regulations [6.58], “a performance standard is a statement, which can be expressed in qualitative or quantitative terms, of the performance required of a system, item of equipment, person or procedure, and which is used as the basis for managing the hazard, e.g. planning, measuring, control or audit, throughout the lifecycle of the installation”. There are two levels of performance standards: 152-RP-48 Rev 02, Feb 2006
Page 178 of 261
fireandblast.com
•
High level performance standards are applied to the installation as a whole or to the major systems that comprise the installation. These are the goals for safety of the installation and relate to overall risk to persons on the installation. These standards are verified from the results of assessments of low level performance standards. High level performance standards are normally risk-based. For example, HSE use [6.59, 6.60] the following:
1. An unacceptable risk is one where the individual risk of a fatality is 10-3 per year or more for a worker or 10-4 per year or more for a member of the public. 2. A broadly acceptable risk is one where the individual risk of a fatality is 10-6 per year or less. 3. A tolerable risk is deemed to exist in the range between 10-3 and 10-6 per year for a worker. All tolerable risks must be demonstrated to be as low as is reasonably practicable (ALARP).
•
Low level performance standards are used to describe the required performance of lesser systems, which may contribute to the high level performance standards. Performance standards at this level relate to the principal safety critical systems used to detect, control and mitigate the major hazards. The selected systems should make a significant contribution to the overall acceptability of the hazard management arrangements. The performance standards should be directly relevant to the achievement of the system goal and the performance standards should be expressed in terms that are verifiable.
•
An important principle in setting performance standards is that the number and level of detail should be commensurate with the magnitude of the risk being managed.
•
Typically, the lower level performance standard for the resistance of pressurised systems to fire attack would be that isolation, depressurising and fire protection systems are functional, fit for purpose and available on demand.
Requirements and guidelines for the control and mitigation of fires and explosions on offshore production installations are given, and an approach used that is similar to the UK performance standards approach [6.61]. This reference states that, in the process of fire and explosion evaluation and risk management, any risk reduction measures should be recorded so that they are available for those who operate the installation and for those involved in any subsequent change to the installation. For this record, the reference uses the term “strategy”. Two strategies are introduced, namely a Fire and Explosion Strategy and an Evacuation, Escape and Rescue Strategy. The strategies should describe the role and any functional requirements for each of the systems required to manage possible hazardous events on offshore installations. The functional parameters (integrity, reliability, availability, survivability and dependency), and the associated specifications, are equivalent to the performance standards approach in the UK safety legislation. 6.6.7.2 Engineering acceptance criteria Typically, the engineering acceptance criteria for a pressurised system to resist fire attack would be that stresses, deformations and/or temperatures remain below values that would compromise the integrity of the system. The criterion given in the API RP 521 aims to achieve this by depressurising the system at a recommended rate. However, this may be inappropriate and inadequate for offshore installations, for which it was not originally intended. 6.6.7.3
Design accidental loads
Design Accidental Loads (DAL) are loads for those accidental events where the associated risks exceed the risk tolerability criteria. Therefore, the designed facility should successfully resist the DAL. This would require a lengthy iterative approach whereby a QRA is carried out first to identify those events and loads that cause the exceedance of risk tolerability criteria. Therefore, an approximate approach has been used which defines DAL as being associated with those events that have the order of magnitude of initiating frequency greater or equal to the tolerable outcome frequency. For example, when the tolerable outcome frequency is 5 x 10-4, the DAL are those loads with the initiating event frequency of 10-4 and higher. 152-RP-48 Rev 02, Feb 2006
Page 179 of 261
fireandblast.com The requirements for successful resistance of a facility to DAL are expressed in the form of performance standards. Typically, the performance standard would state that a pressure vessel should survive and remain functional during a postulated fire scenario. Again, in the terms of engineering acceptance criteria this means that applied stress in the vessel is not to exceed a defined allowable stress throughout the duration of a fire and thereafter. 6.6.7.4
Link between engineering acceptance criteria and QRA
As implied by the above, the link between engineering acceptance criteria related to pressure systems and QRA may be made using the following approach: o
Rule sets in a QRA are set to reflect the standards to which safety critical systems are to perform, e.g. no escalation of the initial fire event in an area.
o
This rule set assumes that isolation and depressurising systems, and a dedicated deluge cooling system are functional, available on demand and survive the initial fire (performance standards).
o
The systems are designed to meet the normal engineering acceptance criteria for stress, deformation, temperature etc.
o
DALs are determined for the systems whose risk, calculated by QRA, exceeds the risk based performance standards.
o
The pressure systems are redesigned to resist the DALs.
Before formal industry guidance could be given on such links, guidance is needed on the rule sets to use in QRA, the determination of DALs and appropriate engineering acceptance criteria. 6.6.7.5
Overview
Performance standards related to the resistance of pressurised systems to fire attack depend on having robust engineering acceptance criteria and a robust method to determine if these are met. At present, these do not exist. Quantitative Risk Assessment is used to confirm that high level performance standards are achieved, and the QRA rule sets also depend on having robust engineering acceptance criteria. Design Accidental Loads are determined for the risks calculated by the QRA that exceeded the risk based performance standards and the facility is designed to resist these DALs. Guidance is needed on the rule sets for use in QRA, the determination of DALs and appropriate engineering acceptance criteria and on how these linked together.
6.7 Personnel 6.7.1 General Fires have the potential to cause severe harm and death to personnel offshore as a result of the evolution of both heat and toxic combustion products. This potential is present both in the immediate vicinity of the fire but also through transport of hot products at remote locations through the action of buoyancy and wind. Inhalation of toxic and irritant smoke is the largest single cause of fatalities in both onshore and offshore fires. The objective of any system to mitigate the effects of fire on personnel must be to remove the fire hazard either through fire extinguishment, reduction of the received insult or separation of personnel and fire hazard. This section outlines the main issues to be considered in defining and quantifying the fire hazard effects on personnel offshore and what preventive measures may be available to a designer to minimize this hazard.
152-RP-48 Rev 02, Feb 2006
Page 180 of 261
fireandblast.com
6.7.2 Characteristics of fires relevant to human response 6.7.2.1 Hazards of fire to personnel The fires which can occur offshore are many and varied. The major concern lies with the process fluids themselves. These can give rise to fireballs, vapour cloud, jet, or pool fires. However, other fuels are present on the plant such as plastics, hydraulic fluids, cabling, seals, paints, etc. These may become involved in the later stages of a process fluid fire or be the main fuel consumed. General fires, not specific to the chemical process industry or offshore, involving the structure and contents in the accommodation, control rooms and other occupied buildings on the installation must also be considered. All these fires produce heat in the form of radiant and convective fluxes. In particular exposure to high radiant heat fluxes can produce severe burns to the skin and even ignite clothing. Smoke is also produced. Here smoke is taken to comprise the airborne solid and liquid particulates and gases evolved when a material undergoes pyrolysis or combustion together with the quantity of air entrained or otherwise mixed into the mass. Smoke contains a complex mixture of: a. Asphyxiant gases such as carbon monoxide and hydrogen cyanide which cause partial/full incapacitation and death: b. Irritant products (gases and aerosol) which at low and medium exposures cause partial incapacitation thus hindering evacuation, while at high exposures may lead to delayed death. The main irritants are acid gases for example hydrogen chloride and low molecular weight aldehydes such as acrolein and formaldehyde. These materials attack the eyes and respiratory tract: c. Particulates sometimes referred to as soot. These particulates may be either nonirritant or irritant. In the former case vision is obscured making way finding difficult, while the latter, as well as impairing vision, can also again act as an irritant to the eyes and respiratory system. Both make evacuation from the scene of the fire more difficult. The combustion product plume will also be at elevated temperature. Movement beneath or within a smoke layer may result in exposure both to radiant and convective heat fluxes. Such exposure may give rise to hyperthermia and skin burns while inhalation of hot products may result in burns to the respiratory system. Finally the lack of oxygen in the fire plume may induce a condition known as hypoxia. This can cause dizziness and ultimately loss of consciousness. Movement of a smoke plume around the installation under the combined influence of the wind and inherent buoyancy must also be considered since its influence may extend beyond the immediate vicinity of the fire. The potential for smoke movement must always be considered; particularly when the identification and design of escape routes and muster points is undertaken. This is a difficult area which can only be approached using models based on computational fluid dynamics or physical modelling. Experience with the applications of both these techniques to smoke movement remains however very sparse and the conclusions should be treated with caution. 6.7.2.2 Specification of fire hazards The heat hazards from a fire are expressed in terms of heat flux and temperature. Thus the dimensions, shape and surface emissive power of the flame can be used to compute a received radiant heat fIux generally in kW m-2 to personnel in the vicinity. The temperature and emissivity of the combustion gases allows specification the thermal environment to which personnel might be exposed if they must enter the fire plume. In general the production of toxic and irritant species in a fire is expressed as a yield - the amount generated per unit mass of fuel burned. This product is then mixed with air entrained into the fire 152-RP-48 Rev 02, Feb 2006
Page 181 of 261
fireandblast.com plume and the hazard of asphyxiant and irritant gases and liquid irritants is expressed as a concentration in air, either in volume or mass terms as ppm or mg l-1 respectively. There does not appear to be a standard form for specifying the smoke hazard. Several may be encountered. It can again be quantified as a mass concentration of product in the fire plume or alternatively in terms more closely related to the hazard presented by smoke - a loss of visual capability. Some parameters used include visibility – the distance in metres at which unilluminated objects can be seen through smoke, an obscuration (%) – the amount of attenuation of light over a given path, or an optical density. The latter is alternatively defined in terms of either natural (De) or common (D10) logarithms:
De = -loge(I/I0) = KCL .................................................................... Equation 6-1 D10 = -10log10(I/I0) = (10/2.303) KCL.............................................. Equation 6-2 Where
I and I0are the light intensities with and without smoke, C
is the mass concentration of particles,
K
is the specific extinction coefficient, and
L
is the path length through the smoke.
K is a property of the type of smoke and depends on its size distribution and optical properties. There is limited data available though some measurements for flaming and non-flaming fires involving plastics suggest figures of 7.6 and 4.4 m2 g-1 (Mulholland, 2002) [6.62]. The product of K and C is known as the extinction coefficient and has dimensions of m-1. It has been shown that the optical density expressed as a unit path length (D10/L (dB m-1)) correlates reasonably well with general visibility through smoke with an optical density of 1 dB m-1 corresponding to a visibility of ~10 m. Smoke production is often specified in terms of the volume in m3 s-1 of unit optical density smoke issuing from a fire. A further smoke measure often quoted is the mass optical density, Dm. This is more easily measured in experimental tests and is related to the optical density measured in a volume flow of combustion products V, resulting from a mass loss of smoke producing material ∆M:
Dm = D10 V / 10 L ∆M ..................................................................... Equation 6-3 Mullholland [6.62] has tabulated existing data on Dm from various materials. 6.7.2.3 Typical hazard levels offshore Two distinct types of fire are likely to occur offshore. The majority will result from releases of process fluids and involve flammable liquids and gases. These will be characterized by an absence of growth and decay phases so that they will reach their full potential output soon after ignition but most will occur in well-ventilated open conditions. Hence the general levels of toxic species and smoke production will be low. Indeed some fires, for example methanol and natural gas will produce little if any smoke. The major hazards from these fires will result from the high heat fluxes generated. The exceptions to such a rule are large pool fires involving the heavy hydrocarbons such as crude oil, which may produce copious quantities of dense smoke and the situation of significant confinement which restricts ventilation. In these circumstances – vitiated fires - the lack of oxygen 152-RP-48 Rev 02, Feb 2006
Page 182 of 261
fireandblast.com in the combustion zone results in an increase of incomplete products of combustion including carbon monoxide and smoke. Tewerson (2002) [6.63] has summarized current knowledge on the rates of species production from the combustion of a wide range of materials including some simpler hydrocarbons and solid building materials. This provides a useful compendium of information, particularly for well-ventilated fires. Tewerson also noted that the levels of species production for under-ventilated confined fires can be parameterized in terms of the equivalence ratio, defined as the fuel air ratio relative to stoichiometric conditions and has presented data which suggest that for solid phase fires the rates of production of incomplete products may increase by factors of ~5-10 over the well-ventilated situation. Thus Chamberlain [6.64] measured concentrations of oxygen, carbon monoxide and smoke of 12 %, 2 % and 2.0 g m-3 respectively for confined jet fires where for such fires without containment carbon monoxide concentrations
