Ukooa Fire and Explosion Guidance

Fire and explosion guidance Part 1: Avoidance and mitigation of explosions
ISSUE 1 October 2003
Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither UKOOA, nor any of its members will assume liability for any use made thereof. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without prior written permission of the publishers. Crown copyright material is reproduced with the permission of the Controller of Her Majestys Stationery Office. Copyright 2002 UK Offshore Operators Association Limited
UKOOA FIRE AND EXPLOSION GUIDANCE Part 1: Avoidance and mitigation of explosions
PUBLISHED BY UK OFFSHORE OPERATORS ASSOCIATION London Office: 2nd Floor, 232-242 Vauxhall Bridge Road, London, SW1V 1AU. Tel: 020 7802 2400 Fax: 020 7802 2401 Aberdeen Office: 9, Albyn Terrace, Aberdeen, AB10 1YP Tel: 01224 626652 Fax: 01224 626503 Email: info@ukooa.co.uk Website: www.oilandgas.org.uk
Issue 1, October 2003
Foreword
This document has been prepared under a joint industry project sponsored by UKOOA and the UK HSE. The project was managed by fireandblast.com limited, and the production of the initial text and of the back up documentation was undertaken by a consortium headed by MSL Engineering Ltd. The other members of the consortium were Aker Kvrner, Century Dynamics, Genesis Oil and Gas, IC Consultants, Morgan Safety Solutions and WS Atkins inc. This document is part of a series being produced by UKOOA and HSE on fires and explosions, the full series being: Part 0 Part 1 Part 2 Part 3 Hazard management (formerly FEHM) Avoidance and mitigation of explosions Avoidance and mitigation of fires Detailed design and assessment guidance
This Part 1 document is taken from MSL Engineering Reports C26800R006 Rev 2 and C26800R007 Rev 2.
Part 0:- Fire and explosion hazard management
Describes Hazard Management principles and practices with particular emphasis on the management of fire and explosion hazards
Part 0
Part 1:- Avoidance and mitigation of explosions

Describes design considerations for the prevention, control and mitigation of explosions
Part 1
Part 2
Part 2:- Avoidance and mitigation of fires

Describe design considerations for the prevention, control and mitigation of fires
Part 3
Part 3:- Design practices for fire and explosion engineering

Contains advice on the engineering implementation of the measures outlined in principle in Parts 1 & 2
Basis Documents for Parts 1, 2 & 3

Contains base position papers as guidance was developed. Available on www.fireandblast.com for those wishing to understand the logic and data gathered for the positions taken in the guidance
The treatment described in this part of the guidance draws on the experience gained during the period since the Interim Guidance Notes [1] were prepared. This has allowed simplifications to be made and a more clearly defined approach to be adopted in some circumstances, without compromising safety.
This Guidance does not have the force of a Standard and contains information on good practice which may or may not be on a firm scientific basis and may require clear justification. Where this is the case the uncertainties are highlighted and the limitations of the methods are identified. There is a recognized need to provide such guidance to avoid decisions being made out of context during the explosion assessment process. The term assessment is taken to include the assessment of a design in progress and the assessment of an existing installation. This part of the Guidance identifies methodologies for explosion assessment, the circumstances in which the methods may be applied and their limitations. Part 3 of the Guidance will deal with the detailed implementation of these and other methodologies. Alternative methods to those presented may be used so long as they are justified by a risk assessment and provided their use leads to reducing risks to As Low As Reasonably Practicable (ALARP).
Contents
1 Introduction ........................................................................................................................... 7 1.1 History ......................................................................................................................... 7 1.2 Objectives .................................................................................................................... 7 1.3 Fire and Explosion Hazard Management .................................................................... 8 1.4 Overview of Guidance ............................................................................................... 10 Explosion hazard philosophy .............................................................................................. 12 2.1 General ...................................................................................................................... 12 2.2 The explosion hazard ................................................................................................ 14 2.3 Goals, aims and Principles ........................................................................................ 17 2.4 Legislation, standards and guidance ......................................................................... 18 2.5 Inherently safer design .............................................................................................. 20 Explosion hazard management .......................................................................................... 28 3.1 General ...................................................................................................................... 28 3.2 Safety Management Systems.................................................................................... 29 3.3 Risk reduction............................................................................................................ 33 3.4 Risk screening ........................................................................................................... 36 3.5 Hazard identification and scenarios........................................................................... 38 3.6 Detection, control and mitigation ............................................................................... 41 3.7 Control systems and Safety Critical Equipment......................................................... 47 3.8 Mitigation and consequence minimization ................................................................. 51 3.9 Acceptance criteria .................................................................................................... 58 3.10 Implementation and monitoring ................................................................................. 60 3.11 Analysis methods ...................................................................................................... 61 3.12 Existing installations .................................................................................................. 65 INTERACTION WITH FIRE HAZARD MANAGEMENT ..................................................... 69 4.1 Overview fire and explosion hazard management..................................................... 69 4.2 Common areas .......................................................................................................... 70 4.3 Considerations by design phase................................................................................ 70 4.4 Special issues relating to installation type ................................................................. 73 4.5 Potential areas of interaction and conflict .................................................................. 75 4.6 Explosion damage to passive fire protection (PFP) Systems .................................... 76 4.7 Use and effectiveness of deluge ............................................................................... 76 4.8 Operational issues..................................................................................................... 79 Derivation of explosion loads.............................................................................................. 80 5.1 Introduction to explosion load determination ............................................................. 80 5.2 Tasks for the determination of explosion loads ......................................................... 82 5.3 Determination of explosion frequency ....................................................................... 84 5.4 Dispersion.................................................................................................................. 85 5.5 Ignition ....................................................................................................................... 89 5.6 Explosion overpressure determination ...................................................................... 89 5.7 Development and application of Nominal Explosion Loads....................................... 98 5.8 Impulse and duration related to peak overpressure ................................................ 101 5.9 Design explosion loads............................................................................................ 102 5.10 Generating Exceedance curves .............................................................................. 105 5.11 Loads on piping and equipment .............................................................................. 111 5.12 Reporting Template for ALARP demonstration ....................................................... 116
5.13 6 The NORSOK Procedure for probabilistic explosion simulation.............................. 117
RESPONSE TO EXPLOSIONS........................................................................................ 119 6.1 Overview of explosion response.............................................................................. 119 6.2 Information required for explosion response calculations........................................ 121 6.3 Response considerations ........................................................................................ 123 6.4 Material properties for explosion response.............................................................. 127 6.5 Structural performance standards ........................................................................... 132 6.6 Structural assessment ............................................................................................. 135 6.7 Response prediction methods ................................................................................. 138 6.8 Single Degree of Freedom Idealisations.................................................................. 142 6.9 Non-Linear Finite Element Analysis......................................................................... 151 6.10 Response of the Primary Structure.......................................................................... 154 6.11 Response of equipment, pipework and vessels ...................................................... 159 6.12 Areas of uncertainty................................................................................................. 163 DETAILED DESIGN GUIDANCE/DESIGNING FOR EXPLOSION RESISTANCE .......... 164 7.1 General .................................................................................................................... 164 7.2 The Design Sequence ............................................................................................. 164 7.3 Best practice in explosion hazard design ................................................................ 174 7.4 Industry and Regulatory Authority Initiatives ........................................................... 178 REFERENCES ................................................................................................................. 180
APPENDIX A ACRONYMS .................................................................................................. 188 APPENDIX B - GLOSSARY OF TERMS ................................................................................ 192 APPENDIX C - CHECKLISTS................................................................................................. 215
1
1.1
Introduction
History
Following the Piper Alpha disaster a large Joint Industry Project called Blast and Fire Engineering for Topsides Structures (Phase 1) was carried out between May 1990 and July 1991. The main deliverable from this project was the Interim Guidance Notes (IGNs) [1] and 26 background technical reports written by the participants and published by the Steel Construction Institute (SCI) in November 1991. The development of the Interim Guidance Notes was a major step forward which consolidated the then existing knowledge of fire and explosion hazards. At about this time the Fire and Blast Information Group (FABIG) was set up and has subsequently issued a number of Technical notes on specific aspects of fire and explosion engineering [2 to 8]. Three further phases of the Blast and fire engineering project JIP were conducted from 1994 to 2001, Phase 2 [9], Phase 3a and Phase 3b [10] consisting mostly of experiments to define and determine explosion overpressure load characteristics and to provide a basis against which load simulation software may be validated. Other valuable work, mostly executed in Norway and following the probabilistic approach, has resulted in the new NORSOK guidance documents [11,12] which are amongst the source documents for this Guidance. The results of these and other major investigations are summarised in the new Engineering Handbook published by CorrOcean [13]. During the same period, the HSE and others have funded approximately 300 individual projects and a number of Joint Industry Projects (JIPs) at a cost of 31million, which have contributed significantly to the understanding of the key issues. The relative maturity of the subject has enabled a better defined approach to be adopted in this Guidance document relying more on good practice which has been developed and implemented over the intervening years.
1.2
Objectives
The primary objective of this document is to offer guidance on practices and methodologies which can lead to a reduction in risk to life, the environment and the integrity of offshore facilities exposed to the explosion hazards. Risk is defined as the product of the probability of an event and its consequences. Alternative definitions are given in the Glossary, Appendix B. Preventative measures are the most effective means of minimising the probability of an event and its associated risk. The concepts of Inherently Safer Design or Inherent Safety are central to the approach described in this document both for modifications of existing structures and new designs. This document consolidates the R&D effort from 1988 to the present day, integrates loading and response development and provides a rational design approach to be used as a basis for design of new facilities and the assessment of existing installations. This Guidance is intended to assist designers and duty holders during the design of, and in making operational modifications to, offshore installations in order to optimise and prioritise expenditure where it has most safety benefit.
An additional intent of this Guidance is to move the decision-making processes within the fire and explosion design field as much as possible towards a Type A process from Type B or C as defined in UKOOAs document on decision-making, the key figure of which is illustrated in Figure 1 below [14].
Means of calibration
Significance to decision Making process

Codes & standards
pr ac t ic e
m ge t en
Decision context type

Nothing new or unusual
Codes and standards Verification Peer review Bench marking Internal stakeholder consultation External stakeholder consultation
G oo
A Well understood risks Established practice

No major stakeholder implications
g rin is ee lys n na CBA gi da , En se R A ba g. Q sk e. Ri
d ju
Lifecycle implications Some risk tradeoffs / transfers Some uncertainty or deviation from Standard or best practice Significant economic implications
Company Values Societal values
Very novel or challenging Strong stakeholder views and perceptions Significant risk trade offs or risk transfer Large uncertainties Perceived lowering of safety standards
Figure 1 - The UKOOA decision making framework
The framework in Figure 1 defines the weight given to various factors within the decision making process, ranging from those decisions that are dominated by purely engineering matters to those where company and societal values predominate. A substantial number of installations will lie in Areas A or B of the chart resulting in an approach which involves codes and Guidance based on experience and best practice (as described in this document) and supplemented by risk based arguments where required. The philosophy of using past experience for the estimation of explosion loads has also been applied to the definition of explosion design load cases, the estimation of dynamic pressure loads, and to the assessment of explosion response.
1.3
Fire and Explosion Hazard Management
A thorough understanding of all hazards and hazardous events, including fires and explosions, is at the heart of the Safety Management System (SMS) and it should be proactive to reduce risks. This overall process is outlined in the OGP Guidelines for the Development and Application of Health Safety and Environment Management Systems. These Guidelines add more detail to this process and applies it to fires and explosions. For these hazardous events the management process is given below: identification of the hazardous events (coarse assessment); analysis and assessment of the hazardous events (type, areas affected, magnitude of the consequences, duration, likelihood, etc.); reduction of the risks from fires and explosions through inherently safer design;
design to reduce the likelihood, scale, intensity, duration and effects of each hazardous event; identification and specification of the particular prevention, detection, control and mitigation measures needed for each hazardous event confirmation of the suitability and effectiveness of each of the measures selected; specification of the measures adopted; communication and implementation; verification; documentation.
The hazard management process should be employed in a timely manner and in accordance with the type, severity and likelihood of each hazardous event. It is essential that all parties who can contribute to the reduction of hazards, particularly design engineering disciplines and those who will have to operate and maintain the plant, understand the hazards and are involved during the appropriate stages of the lifecycle. The lifecycle approach shows how to prepare and implement a strategy for the management of fire and explosion on an offshore installation throughout its life, i.e. from design through commissioning and operations to decommissioning. This is developed firstly by inherently safer design, followed by prevention of identified fire and explosion hazardous events and then by the selection of detection, control and mitigation measures. The fire and explosion assessment process is used in the lifecycle to provide information on which to base decisions and design systems. Thereafter, it is used to assess these arrangements to make sure that the high level performance standards have been achieved. The FEHM process can be applied to new or existing installations: for new installations it should start during feasibility studies and be fully developed during detail design. The results should then be communicated to personnel operating the installation to ensure that they know the purpose and capability of all the systems, can operate them properly and that adequate maintenance schemes are in place; for an existing installation the process should be applied to current arrangements and modifications. These should be assessed to determine if the high level performance standards are achieved and that risks are as low as is reasonably practicable.
The management of hazards to reduce the risks involves many interests which may often appear to conflict with each other. The process is a multi-disciplinary activity, involving all levels of personnel from senior management to junior staff from a number of different organisations. It is important that the input and activities of these personnel are fully coordinated and managed. The SMS of each organisation should identify the relevant roles and responsibilities. A more comprehensive and homogeneous view of the role of fire and explosion hazard management within the overall Hazard Management System (HMS) can be found in Part 0 of this guidance, Fire and explosion hazard management. More information on specifically fire and explosion hazard management can also be found in Clauses 3 and 4 of this Part 1 of the Guidance.
1.4
Overview of Guidance
The main clauses of the Guidance summarise the content of the basis documents. Clause 2, Explosion hazard philosophy [15], defines the goals which should be achieved in designing for and managing explosion hazards. This clause sets out the process by which it is decided what has to be done in any particular context and what factors to take into account. This is achieved by a screening process of the proposed or existing installation so that resources may be effectively targeted where they are needed. The principles of Inherent Safety are presented and appropriate methods of analysis dependent on the expected risk level are identified. The tasks identified are linked with the relevant phase of a design project or the stage in the life of the installation. Clause 3, Explosion hazard management [16], describes the features of an effective Safety Management System, discusses the choice and management of detection, control and mitigation systems and identifies the main characteristics of the hazard discussing minimisation of the consequences of residual events which lead to an explosion event. Clause 4, Interactions with fire hazard management [17], identifies situations where fires may precede or follow an explosion and deals with common areas in fire and explosion management, areas of potential conflict between the management of these two types of hazardous event and the role of deluge in the mitigation of fires and explosions. Clause 5, Derivation of explosion loads[18,19] describes how appropriate design explosion overpressures and dynamic pressures are derived. In this clause there is a review of the available methods for the simulation of explosions and the selection of the appropriate tools. Workbook methods of calculation of the dispersion of a gas cloud are discussed. A method of the development of nominal overpressures is described and the desirable characteristics of data on which such nominal overpressures could be based is discussed. The generation of exceedance curves is discussed along with their use in the definition of achievable design explosion load cases for response analysis. Methods for the calculation of drag and dynamic pressure loads on piping and equipment are given. Guidance is then given on the information to be presented when preparing an ALARP justification. Finally a brief review of the NORSOK protocol [12] is included. Clause 6, Response to explosions [20], describes the determination of the response of structures and SCEs to explosion loads. A description of the dynamic nature of the response leads to a definition of the material effects of large strains and strain rates. Performance standards are given for component and member response. Available methods for calculating the response of structures and equipment are presented with their relative merits and limitations. Clause 7, Guidance on detailed design [21], brings together the approaches identified in the other clauses and incorporates additional design and operations experience to provide guidance on methods of detailed design. The guidance is presented in the context of best practice and identifies other industry initiatives which have generated detailed design and operating practice guidance. This subject area will be re-visited in Part 3 of the Guidance.
10
Task Installation screening Scenario definition
Description Determine installation category low risk or higher risk Define leak position, material type, hole size, release rate, ignition time and frequency
Main References in this Document 3.4 0 2.2, 3.3, 2.5, Clause 3 Clause 5
Prevention, control, Investigate the hazard with a view to prevention, mitigation detection, control and mitigation to reduce the severity and frequency of the hazard Determination of Determine the explosion loads, overpressure, explosion loads duration and dynamic pressures on the structure and other SCEs to be used in design Determination response Evaluation of Determine the response of the structure and other SCEs to explosion loads including overpressure, dynamic pressures, strong shock and missiles Test results of response analysis against the appropriate performance standards, demonstrate that ALARP has been achieved
Clause 6
2.3, 0, 6.5, 6.11, 6.12, 7.3
11
2
2.1
Explosion hazard philosophy

General
A release of hydrocarbon with immediate ignition will result in a fire; release of a flammable vapour or gaseous hydrocarbon. If this is followed by later ignition the result may be an explosion. Explosion events, their elimination, prevention, detection, control, mitigation and consequences are the subject of this Guidance. In this Guidance, the goals which should be achieved in designing for and managing the explosion hazard are identified. The legislative basis is reviewed and some high level performance standards are given. (Terms in italics are defined in the Glossary given in Appendix B). The features of an effective Safety Management System (SMS) are identified and the choice and management of detection, control and mitigation systems is discussed. The main characteristics of the explosion hazard are identified and the relevant issues relating to interaction with fire hazard management are discussed. The techniques of inherently safer design described in this Guidance are central to the approach to eliminate, prevent and mitigate the explosion hazard for new designs. In order to focus effort where it is most needed, a risk screening method is described which classifies installations and compartments according to their risk level. The measures for frequency and consequence severity are based on process complexity and the exposure potential for people on board. These measures are combined in a risk matrix to give low, medium and high risk categories. The risk level is an indication of the level of sophistication to be used in the explosion assessment process. A number of explosion scenarios on various installations have now been assessed using the techniques described in this Guidance. It is proposed that this data be used in the determination of nominal overpressures or for use in the early quantification of explosion hazards for new offshore facilities. These nominal overpressure values should be available for inclusion in Part 3 of this Guidance. Methods of deriving useable nominal explosion loads are discussed in 5.7. In other situations a scenario based approach will generally be used where release scenarios are postulated and their consequences and probabilities of occurrence determined. For existing installations, reliable estimates of explosion loads may be available from previous assessments. An essential part of the process of explosion assessment is the determination of the design explosion loads. The worst credible case of a stoichiometric cloud engulfing the whole installation or filling an entire compartment will frequently give rise to loads which are too severe to be reasonably practicably designed against. Design explosion loads are selected on the basis of their frequency of occurrence and should be accommodated by the Safety Critical Elements (SCEs) of the installation which will include parts of the structure. Explosion loads will include both overpressure loads and dynamic pressure loads on piping and equipment which are due to the movement of gases around them. It is suggested that the number of SCEs which need to be considered in detail is reduced by classification into criticality categories with respect to the explosion process.
12
Reducing risks to ALARP must be demonstrated in all cases, both through the justification of the choice of design load and from a determination of the impairment frequency of the SCEs under these loads. The supporting structure, panels and barriers must be shown to resist the design explosion loads without collapse and with minimal risk of impairment of the Temporary Refuge (TR), escape routes or means of escape. The structure therefore is required, globally, to be robust enough to resist the loads without excessive deformation and ductile enough to undergo local deformations, preferably without rupture. The extreme design event explosion load cases are represented by the Ductility Level Blast (DLB). This is determined using the associated frequencies of occurrence or exceedance and the space averaged overpressures derived for the relevant scenarios. An acceptable level of risk should be identified within the ALARP framework, which identifies the acceptable frequency of exceedance of the severity of these scenarios. Typically this frequency of exceedance will be of the order of 10-4 to 10-5 per year depending on the risk to people on board, the impact on the SCEs and the overall individual risk from all sources. There is at present a lack of consistency in the methods used for the generation of exceedance curves. The HSE has embarked on a study to clarify these, the results of which should be available for inclusion in Part 3 of this Guidance. A lesser explosion event, the Strength Level Blast (SLB), is also recommended which examined using elastic response techniques. This additional load case may detect additional weaknesses in a design and serves as a robustness check of the structure, other SCEs and their supports. Guidance is given on the information required by the response disciplines from the explosion loading specialists. A common terminology has been developed to facilitate the transfer of complete and unambiguous information between the disciplines. The determination of the acceptability of the results of an assessment is also discussed. The aspects include comparison with high and low level or element specific performance standards and risk acceptability criteria. The guiding principle here is that risks should be reduced to ALARP. Guidance on detailed design is included which brings together the approaches identified in the other sub-clauses and incorporates additional design and operations experience. Other industry initiatives which have generated detailed design and operating practice guidelines are presented and discussed. This clause is based on References [15] Explosion hazard philosophy and [16] Explosion hazard management. Further detailed information on all the topics addressed in this clause may be found in these Basis Documents. Further material has been included from Reference [22]. This clause defines the approach to be taken in the assessment of explosion overpressures and related phenomena and describes how those factors are incorporated into the features of the installation to bring about a position where the risk from explosion events is reduced to as low as reasonably practicable (ALARP).
13
The approach described in this Guidance will enable explosion scenario design load cases to be rigorously defined, having previously identified the potential explosion scenarios. These design loadings will have an associated probability of exceedance. The techniques used in determining structural, equipment or pipework response provide results with a much reduced variability compared with those used in the determination of the explosion loading. The load exceedance data can therefore safely be applied to the response results, with negligible reduction in reliability. These results can then be used in Quantitative Risk Assessment (QRA). The structure and other Safety Critical Elements (SCEs) should be designed for the identified explosion scenario design load cases. Where practicable designs cannot be achieved, alternative means of explosion mitigation must be sought in order to reduce the magnitude or risk of exceedance of those design load scenarios The structure and other SCEs should be able to accommodate these design loads. The philosophy is applicable to all offshore design concepts whether fixed or floating, normally manned or unmanned. A philosophy for existing installations is also proposed where the design explosion scenarios require to be assessed in the light of improved understanding and modelling of explosion loads and structural, equipment or piping responses to explosion These factors may lead to the need to assess previously determined overpressures, structural response and consequent risk. It may then be necessary to consider further measures to mitigate risk and reduce this to ALARP. This clause defines the goals that should be achieved in designing for, and managing explosion hazards. In order that these goals can be achieved the philosophy lays out the requirements for a Safety Management System (SMS), which is the subject of the next clause. A Safety Management System establishes a safety environment whereby hazards in general, including explosion hazards, are identified, assessed and controlled to achieve a design where risk is reduced to ALARP. This guidance incorporates the findings of recent experiments particularly the full scale tests at the Advantica Spadeadam Test site [9, 10]] . These tests have produced a large amount of data which has enabled modelling techniques to be greatly refined to give more accurate definition of explosion characteristics. A number of explosion scenarios on various installations have now been assessed using these refined models and it is proposed that this data is used, where possible, in the definition of nominal overpressures or for use in the early quantification of explosion hazards on new offshore facilities. Where such comparisons are not possible, methodologies are proposed for the quantification of explosion hazards using the latest modelling techniques. Approaches for assessing existing installations are also provided. This clause sets out the process by which the engineer/manager decides what has to be done in the particular context. A method of installation screening is described which enables the general risk level of the installation to be determined, which then determines the appropriate level of analysis sophistication which should be used.
2.2
The explosion hazard
Gas explosions can be defined as the combustion of a premixed gas cloud containing fuel and an oxidiser that can result in a rapid rise in pressure. Gas explosions can occur in enclosed volumes such as industrial process equipment or pipes and in more open areas such as ventilated offshore modules or onshore process areas.
14
For an explosion to occur a gas cloud with a concentration between the upper flammability limit (UFL) and lower flammability limit (LFL) must be ignited. The overpressure caused by the explosion will depend, amongst other things, on: 1) The gas or gas mixture present 2) The cloud volume and concentration 3) Ignition source type and location 4) The confinement or venting surrounding the gas cloud 5) The congestion or obstacles within the cloud (size, shape, number, location) 6) Non-homogeneous Cloud density 7) Ignition timing Confinement is defined as a measure the proportion of the boundary of the explosion region which prevents the fuel/air mixture from venting which is the escape of gas through openings (vents) in the confining enclosure. Congestion is a measure of the restriction of flow within the explosion region caused by the obstacles within the region. Gas explosions in more open environments can also lead to significant overpressures depending on the rate of combustion and the mode of flame propagation in the cloud. All of the above points from 1 to 5 can affect the explosion overpressures in this type of environment. Two types of explosion can be identified depending on the flame propagation rate: A deflagration is propagated by the conduction and diffusion of heat. It develops by feedback with the expansion flow. The disturbance is subsonic relative to the un-burnt gas immediately ahead of the wave. Typical flame speeds range from 1-1000 m/s and overpressures may reach values of several bars. The overpressures are not limited to the 8 bar maximum typical of completely confined explosions. A detonation is propagated by a shock that compresses the flammable mixture to a state where it is beyond its auto-ignition temperature. The combustion wave travels at supersonic velocity relative to the un-burnt gas immediately ahead of the flame. The shock wave and combustion wave are coupled and in a gas-air cloud the detonation wave will typically propagate at 15002000m/s and result in overpressures of 15-20 bar. Most vapour cloud explosions offshore would fall into the category of deflagrations. A typical vapour cloud explosion on an offshore installation would start as a slow laminar flame ignited by a weak ignition source such as a spark. As the gas mixture burns, hot combustion products are created that expand to approximately the surrounding pressure. As the surrounding mixture flows past the obstacles within the gas cloud turbulence is created. This turbulence increases the flame surface area and the combustion rate. This further increases the velocity and turbulence in the flow field ahead of the flame leading to a strong positive feedback mechanism for flame acceleration and high explosion overpressures.
15
Large components of the structure such as solid decks or walls experience loads due to the pressure differences on opposite sides of the structure. Typically within an explosion there will be a strong variation of pressure in space and time. There will typically be localised high regions of overpressure with lower values of average pressure acting on large components. The overpressure at a location within a gas explosion will typically rise to a peak value and then fall to a sub atmospheric value before returning to zero overpressure. The duration of the positive phase in an explosion can vary greatly with shorter durations often associated with higher overpressure explosions. Typical durations range from 50 to 200 milliseconds with longer durations common in large open areas such as the decks of Floating Production, Storage and Offloading vessels (FPSOs). For smaller objects, such as piping, the overpressures applied to the front and reverse side of such items will be of approximately the same magnitude at any moment in time and in this case the overpressure difference will not be the only load component on the object. For this type of object the dynamic pressure associated with the gas flow in the explosion will dominate. Small objects may be picked up during the explosion, creating secondary projectiles. The peak energy for typical projectiles may be calculated from the dynamic pressure load time history and their mass. Secondary, external explosions may result as the unburnt fuel/air mixture comes into contact with the external (oxygen rich) atmosphere. These can affect the venting of the compartment and enhance the overpressure within. A blast wave will be generated which will propagate away from the explosion region and may impinge on adjacent structures. It is instructive to be aware of the nature of the hazard and focus effort on the most frequent sources of the hazard as given by the history of releases experienced to date. The HSE document OTO 2001 055 [23] states that for the UK sector of the North Sea: 61 % of all releases are from pipework systems 11 % of all releases are from small bore piping 15 % of all releases are from flanges 14 % of all releases are from seals and packing
Of the causes; 11 % are due to incorrect installation 26 % from degradation of materials (excluding corrosion and erosion) 11 % of all releases are due to vibration/fatigue 19 % of all releases were due to corrosion and erosion
It is considered that 40 % of equipment related releases are attributable to poor design and 38 % to inadequate inspection and condition monitoring. Avoidance of potential leak sources in design therefore needs to consider these above issues in particular. The importance of operational aspects is also shown in proportion of leaks attributable to poor inspection and monitoring.
16
Sources of release data include WOAD [24] , OREDA [25] release statistics published annually by the HSE [26,27] and the HSE/UKOOA publication on the subject [28] . The Minerals Management Service (MMS) of the US also publishes data on incidents on the Gulf of Mexico Further similar considerations are included in sub-clause 0 Hazard identification and scenario definition.
2.3
Goals, aims and Principles
Goals define what the philosophy requires of the end product. The top level goal defines what is required from the overall process. In this case it is: the achievement of a condition where the explosion risk for the installation is reduced to As Low As Reasonably Practicable (ALARP)
Explosion risk is defined as risk from the initiating event and subsequent escalation. The means of achieving this can be broken down into a number of high level goals whose attainment will achieve the top level goal. The following high level goals therefore define what is necessary to achieve an ALARP design with respect to explosion hazards: the identification of all areas of the installation where there is potential for explosion events to occur; the elimination of the potential for explosion events to occur, or if this is not achievable, the minimisation of the frequency of explosion events and, the minimisation of the consequence of explosion events the implementation of a safety management system which ensures that the above goals are consistently achievable; the implementation of operational management systems to minimise the potential for explosion events to occur through the life of the installation including decommissioning and abandonment. the minimisation of exposure of personnel to explosion and subsequent escalation events; the minimisation of the environmental impact from explosion events; the minimisation of asset loss from explosion events; the determination of key explosion hazard parameters; the performance of suitable and sufficient assessments of the consequences and risks associated with the defined explosion hazards; the design of structures and the specification of safety critical elements (SCEs) to prevent, detect, control, mitigate and withstand the consequences of design explosion events; the implementation of such mitigation measures that are necessary to reduce residual explosion risk to as low as reasonably practicable (ALARP);
A further set of more specific goals ensure that personnel will reach a safe location in the event of a major accident event: that one escape route to the Temporary Refuge (TR) remains functional at all times;
17
the TR and its supports will maintain their integrity in all design explosion events; that a means of evacuation to be available at all times; that all large off-site inventories are isolated in the event of a design explosion event. the ability of personnel to escape from, and to shelter safely from the effects of an explosion event and the ability to evacuate to a safe location where recovery can take place is not compromised
2.4
2.4.1
Legislation, standards and guidance

UK Legislation
This sub-clause details the major legislation covering explosion risk. It is not exhaustive as any legislation covering general safety or requiring a safety risk assessment to be performed, will be relevant where the potential for an explosion exists. Legislation may be added during the lifetime of this guidance. The primary legislation governing safety in the workplace is the Health and Safety at Work Etc. Act 1974 (HSWA). This imposes a responsibility on the employer to ensure the safety at work for all employees. Employers have to take reasonable steps to ensure the health, safety and welfare of their employees. Various regulations are enacted under the HSWA. These include the Management of Health and Safety at Work Regulations 1999, which place an obligation on the employer to actively carry out a risk assessment of the workplace and act accordingly. Risks assessed will include those from fire and explosion. More specifically related to fire and explosion risk are the Prevention of Fire and Explosion and Emergency Response on offshore installations (PFEER) [29] regulations which place on the Duty Holder the requirement to take appropriate measures to protect persons from major hazards including fires and explosions. These measures include identification of explosion hazards and the evaluation of their consequences and likelihood (reg. 5). Regulations 9 to 12 specify the types of measures which are required for prevention, detection, communication and control of emergencies. The regulations also require mitigating measures to be specified and put in place and for performance standards to be set for safety critical measures to prevent, control and mitigate explosion hazards. The Duty Holder must ensure that effective evacuation, escape recovery and rescue will occur in the case of an explosion event (Regulations 14 to 17). The Safety Case Regulations SCR [30] require that all installations in UK waters have an acceptable Safety Case. Information regarding the following issues is required to be addressed in the Safety Case: identification of major hazards; evaluation of risks associated with the identified hazards; details of appropriate measures taken to reduce these risks to as low a level as is reasonably practicable; details of the Duty Holders (Safety) Management Systems.
18
The Design and Construction Regulations DCR [31] amend the SCR by placing a responsibility on duty holders to prepare a suitable verification scheme for their installations to ensure independent and competent evaluation of those elements of the installation which are critical to safety (known as Safety Critical Elements - SCEs). Performance standards are used to define the functionality and integrity of these safety critical elements. They will define how these SCEs are expected to function during and after explosion events.
2.4.2
APOSC
The Assessment Principles for Offshore Safety Cases document (APOSC) [32] modifies SCR with respect to the development of PFEER[29] SI 1995/743, MAR-1995[33] and the DCR 1996[31] The APOSC document requires the following be demonstrated for Major Accident Hazard assessments: Acceptable safety cases will demonstrate that a structured approach has been taken which: identifies all major accident hazards (paragraphs 38-48); evaluates the risks from the identified major accident hazards (paragraphs 49-74); describes how any quantified risk assessment (QRA) has been used and how uncertainties have been taken into account (paragraphs 75-82); identifies and describes the implementation of the risk reduction measures (paragraphs 83-89); describes how major accident risks are managed (paragraphs 90-112); describes the evacuation, escape and rescue arrangements (paragraphs 113-144).
The structured approach listed above is generic, so that there are no specific requirements for how an assessment of explosion hazards should be carried out.
2.4.3
Codes, standards and guidance
Guidance documents are available from the Health and Safety Executive for the legislation mentioned above. However there is little guidance, apart from ISO 13702 [34] and PFEER, relating specifically to the design of installations against explosion events. The most relevant are the Interim Guidance Notes (IGNs) [1] which this Guidance will replace. Various codes, standards and guidance are available covering elements related to the explosion hazard, namely: For ignition prevention and Hazardous Area Classification; Institute of Petroleum, Area classification code for installations handling flammable fluids, August 2002, (IP15) [35]. The ATEX (Atmospheric Explosion) Directives 94/9/EC and 1999/92/EC cover electrical and mechanical equipment and protective systems, which may be used in potentially explosive atmospheres. BS EN 60079-10. Electrical apparatus for explosive gas atmospheres Part 10. Classification of hazardous areas, [36]. For equipment in hazardous areas BS EN 1127-1 : 1998 Explosive atmospheres. Explosion prevention and protection [37] is available. BS 5958: 1991 Code of practice for control of undesirable static electricity, [38].
19
These documents only cover operational leaks rather than accidental releases. They do not define the extent of hazardous areas from the point of view of explosion and fire risk. Recent experimental evidence is available relating to dispersion of explosive clouds [10, 39]. Alongside UK legislation, EN ISO 13702 [34] also addresses the need to develop a Fire and Explosion Strategy (FES) which describes the role, essential elements and performance standards for each of the systems required to manage possible hazardous events on the installation. Guidance on the demonstration of ALARP is available throughout this Guidance and from the following sources; Policy and Guidance on reducing http://www.hse.gov.uk/dst/alarp1.htm risks to ALARP in Design [40] .
Principles and Guidelines to Assist HSE in its Judgement that Duty Holders Have Reduced Risk as Low as Reasonably Practicable [41] . http://www.hse.gov.uk/hid/spc/perm12.htm
HSE Books have published a guide which sets out an overall framework for decision taking by the HSE (Reducing Risks, Protecting People, often referred to in shorthand as R2P2), which is available in hard copy form [42] and as a free download from http://www.hsr.gov.uk/dst/r2p2.pdf. HSE guidance relating to Gas Turbine enclosures is relevant as the principles mentioned are applicable to explosions in general. Control of Risks at Gas Turbines Used for Power Generation, Guidance Note PM84 HSE.[43].
2.5
2.5.1
Inherently safer design

Introduction
Having determined the installation concept it is necessary to manage fire and explosion risk within the constraints imposed by the subsequent offshore layout. The advantage of an inherently safer design or the Inherent Safety design approach is that it attempts to remove the potential for hazards to arise. It does not rely on control measures, systems or human intervention to protect personnel. All control systems have the potential for failure to operate as intended generally expressed as the Probability of Failure on Demand (PFD). Critical loops are designed according to their criticality in mitigating personal, environmental or commercial risk by setting a Safety Integrity Level (SIL). In setting a SIL it is acknowledged that there is failure potential although this is designed to be inversely proportional to the importance of the loop in risk mitigation. There is always the potential for the systems to be damaged in a hazardous event. Inherent safety avoids this potential by aiming for elimination rather than protection and the preference for passive protection over active systems.
2.5.2
Goals of inherently safer design
The key goals of Inherent Safety may be summarized as: Fewer and smaller Hazards Issue 1, October 2003
20
Fewer Causes Reduced Severity Fewer Consequences More effective management of residual risk
The following Table 2.1 summarizes the major Inherent Safety and control features necessary to achieve the goals stated above: There may be some conflict between the various features of inherent safety. For example, increased compartmentalisation will reduce the size of a potential explosive gas cloud however this will also decrease the potential for natural ventilation and increase confinement. The balance between such features will be discussed further in this Guidance. Table 2.1 Inherent Safety Features to Achieve Goals Goal to minimise explosion Inherent Safety features to achieve goal risk Minimisation of potential leak sources and release potential minimise number of pipe joints maximise welded pipe joints minimise intrusive instrumentation eliminate/minimise small bore pipework minimise offshore processing and process complexity minimise vibration minimise corrosion/erosion ensure effective inspection
Minimisation of ignition potential
no naked flames in live plant audit and review safety management system with respect to hot work procedures insulate hot surfaces* effective earth bonding hazardous area zoning (area classification) effective maintenance regime separation of quarters and non-operational personnel from process areas minimisation of maintenance load remote operation of processes simplification of the offshore process separate accommodation platforms fully rated blast barriers and primary structures simplification/minimisation of offshore processing use of small isolatable inventories effective isolation from large inventories upon gas/leak detection effective blowdown of inventories
Minimisation of Personnel On Board (POB) exposure to blast effects
Minimisation of hazardous inventory
21
Table 2.1 Inherent Safety Features to Achieve Goals Goal to minimise explosion Inherent Safety features to achieve goal risk Minimisation of potential explosive cloud size maximisation of ventilation potential minimisation of inventory pressure minimisation of potential leak rate minimisation of hazardous inventory minimisation of module size/compartmentalisation subsea completions
Minimisation of congestion
simplification/minimisation of offshore processing optimisation of module layout segregation of congestion and explosion leak sources grated decks open sided modules blow-out panels/louvres optimisation of module layout
Minimisation of confinement
Maximisation of ventilation
minimisation of confinement platform orientation to make maximum use of prevailing wind direction equipment layout to avoid dead spots platform aspect ratio to maximise ventilation limit module size minimise offshore processing add partitions to limit maximum dimensions review of aspect ratio of module dimensions effective inspection programme effective maintenance procedures resistance to overpressure effects protection from blast wind effects protection from severe vibration effects protection from structural displacement effects separation of process areas from critical nonhazardous areas
Limitation of potential flame front length
Monitoring and maintenance of SCE integrity and functionality
Maintain effective hazard management
safety leadership and focus effective safety management system prevention rather than protection preference for passive systems of control and mitigation over active systems Note *Corrosion under insulation is a major cause of line failure and high operational cost, hence insulation should be avoided where practicable.
22
Table 2.1 details inherent safety and control features that minimise the potential for explosion to occur, or if an explosion should occur, that minimise the consequences and risk to personnel. These features should be built into the early design of the installation, rather than by including mitigation measures at a later date. Further details regarding the inclusion of inherent safety and control features are given in other sub-clauses of this Guidance. Inherent safety carries on through the life of the installation continuing through the operational phase by adherence to effective inspection and maintenance regimes and by ensuring that management systems and related procedures are followed as intended.
2.5.3
Effective Management Of Residual Risk
The risk which cannot be eliminated by the application of inherent safety methods is referred to as residual risk. Inherent safety methods can also be applied to the management of the residual risk by consideration of the general principles indicated below: CONTROL is better than MITIGATION is better than EMERGENCY RESPONSE. As regards systems to reduce risk PASSIVE systems are more reliable than ACTIVE systems are more reliable than OPERATIONAL systems are more dependable than EXTERNAL systems This indicates: The use of passive rather than active control and mitigation systems No reliance on personnel to prevent, control or mitigate hazards
The Table below defines and expands upon some of the terms used above [44]
23
Table 2.2 Systems to minimise the consequences of accidental events Type Passive Description These are systems that act upon the hazard simply by their presence. They do not need to react to the hazard or need operator input at the time of occurrence in order to be effective. The only modes of failure are long-term deterioration, physical damage or removal. They are preferred because they are inherently the most reliable, requiring only inspection and maintenance, thereby reducing the need for people to be in hazardous locations. Typical examples are corrosion allowances, layout, welded connections, relief panels and natural ventilation. Separate accommodation platform fully rated barriers and primary structure subsea completions. These are systems that may require mechanical or electrical facility, or control signals in order to work. They are susceptible to failure and downtime of these systems. As such, they are less reliable, particularly where their failures may not be visible. They require inspection, testing and maintenance, and are thus susceptible to human error or omission. They also cause increased numbers and activity on the facility. Typical examples are, depressurization systems, fire and gas detection and active fire and blast suppression systems.
Active
Operational These are systems that depend primarily upon people, either to initiate the system, or to carry out the whole function. As such they can be the least reliable and require sufficient trained people to be on the facility in order to ensure their operation, with associated minimum competences and procedures. Their effectiveness is wholly dependent upon the future operator, who should agree to the dependence on these measures. Typical examples are; maintenance, inspection and condition monitoring. External These are systems that depend on the correct reaction of people beyond the company itself, and its direct workforce. There is clearly further room for error due to the longer communication lines and frequent changes of the people involved. Effectiveness is dependent upon effective contracts and audit. Examples are; the dependence on the competence of a supply boat master to avoid riser impact, and isolation of a third party feeder pipelines.
2.5.4
Processes for Achievement of Inherently Safer Design Goals
The Table below details some of the processes which should be used to achieve the goals of inherently safer design. The project phases at which these processes are most appropriate are also identified Table 2.3 Achievement of goals Goal Means of Achievement Fewer Hazards Minimise offshore Giving Rise to processing Explosions Simplify the process employed Phase Conceptual Key Processes Concept analysis, risk ranking. Selection of lowest risk option unless cost is grossly disproportional to risk gain. Concept selection Process review, HAZOP, HAZID Issue 1, October 2003
Conceptual FEED
24
Goal
Means of Achievement Less maintenance burden
Phase Conceptual FEED FEED FEED Conceptual FEED
Key Processes Concept selection Process review, HAZOP Piping philosophy to promote welded connections Piping philosophy, instrument philosophy Concept selection, minimisation of process HAZOP, corrosion policy (piping specification), maintenance philosophy (replacement v. maintenance) Instrumentation philosophy stating preference for nonintrusive instrumentation Corrosion philosophy, choice of materials/piping specification Process design, piping supports, resilient mountings for mechanical plant. Minimisation of process complexity Area classification (hazardous area) designation. Safety Philosophy - no naked flames Insulation specification (hot surfaces) Replacement of light fittings with flood lights [45] Operation/Maintenance philosophies. Elimination or minimisation of hot work at live plant. No welding/gas cutting at live plant Layout minimise piping and small diameter items. Layout of small bore items Layout grated decks, fewer walls/partitions Design Basis/Process Philosophy. Seek to minimise process operating pressures Layout (may conflict with confinement)
Fewer Causes Less piping joints of Explosions Less small bore piping Less maintenance
Less intrusive instrumentation Less corrosion Less vibration
FEED
FEED / Detailed Design Detailed Design
Fewer ignition sources
Conceptual FEED/Detailed Design
ALL Operation
Reduced Severity Explosions
Less congestion of Less confinement Lower process pressures Smaller potential explosion zones
FEED / Detailed Design FEED FEED
FEED
25
Goal
Means of Achievement Shorter flame path length More ventilation
Phase FEED FEED
Key Processes Layout avoid long narrow modules Orientation Study, Ventilation Study. Reduce confinement, installation orientation. Aim to achieve greater than adequate level (> 12 air changes per hour (ach)) Concept selection minimisation of offshore processing Concept selection minimisation of offshore processing, minimise Normally Unattended Installation (NUI) visit frequency, remote operation, minimise maintenance Concept selection - minimise manning levels, minimise maintenance, maximise separation of control and quarters areas from process areas Layout & fixing details - fix small items to robust equipment away from high blast wind areas. Housekeeping - removal of lose items from module, no storage of equipment Segregation of explosion risks and major fire escalation HAZID/HAZOP - identify hazards then use hazard management hierarchy elimination of hazard being first goal Aim for inherent safety rather than use control systems which have failure modes Control/Process/ESD Philosophies - use control systems to make decisions in structured manner according to ESD hierarchy.
Fewer Unmanned Consequences installation Resulting from Explosions Lower manning levels
Conceptual
Conceptual
Lower exposure of personnel to the explosion hazard and escalating events No missile generation
Conceptual / FEED
Detailed Design
Operation
Escalation More effective Prevention rather management of than protection residual explosion risk Passive systems rather than active No reliance on personnel to prevent, control or mitigate hazards
Conceptual/FEED All
All
FEED/Detailed Design
26
Goal
Means of Achievement Minimise number of safety critical systems
Phase All
Key Processes Minimise process complexity and manning levels so that quantity of safety critical elements are reduced in number Minimise the process, maximise separation of control and quarters areas from process areas
No exposure of safety critical systems to hazards
All
27
3
3.1
Explosion hazard management

General
Effective safety management requires a structured approach to the identification of hazards, the assessment of those hazards and their elimination or minimisation, their control and mitigation. The means of achieving this are encapsulated in the Safety Management System (SMS) of the Duty Holder and designer and more specifically the HS&E Plan for the project. The safety management system SMS should specify the need for an HS&E Plan for all projects where significant risk to personnel or the environment is possible. The HS&E Plan(s) will define how health, safety and environmental issues will be handled throughout the life of the project. More than one plan may be in place, covering different parts or phases of the project. If this is the case an overall, bridging plan should be available to cover the interfaces between the individual plans. The HS&E philosophy for the project should reflect the goals listed in sub-clause 2.3. Management of explosion hazards and Safety Managements Systems are dealt with in the next clause. When hazards are identified with potential to give rise to risk to personnel or the environment, in the first instance the aim should be to eliminate or minimise the hazard and the risks associated with it. Thereafter the aims shall be (in order): remove personnel from the consequences of the explosion or escalating events; inherently minimise the potential size/severity of the explosion event; use detection and control systems to warn personnel and to minimise the explosion event; install mitigation measures to reduce escalation and otherwise protect the workforce, environment and asset
If risks cannot be eliminated and where risk to individuals falls below that which is unacceptable but above the level of broad acceptability, then risks shall be reduced to As Low As Reasonably Practicable (ALARP). This clause provides the engineer with the means of managing the various factors which contribute towards; the probability of explosion occurring; the overpressure experienced once the explosion has occurred; the control and mitigation of consequences of explosion.
This clause deals with two main topics; sub-clauses 3.2 and 3.3 focus on the project management system and how getting that right forms the basis of managing the explosion hazard. These sub-clauses contain a description of the elements of a safety management system (SMS) that should be in place to ensure that a framework exists within which a successful design can be produced. Much of the discussion concerning the SMS is applicable to all aspects of design not specifically explosions.
28
The remaining sub-clauses focus on management of the explosion hazard itself and how an installation may be designed to reduce risk from explosions to as low as reasonably practicable (ALARP). Further guidance on health and safety management can be found in the Basis Document covering management systems [16].
3.2
Safety Management Systems
Safety Management Systems will have common features for dealing with the fire hazard, the explosion hazard or any other accidental loads which can be envisaged. The system described in this sub-clause is generic in this respect.
3.2.1
Purpose
A Safety Management System (SMS) provides a framework whereby an organization can be assured that So Far As Is Reasonably Practicable (SFAIRP) its operations can be undertaken in a demonstrably safe manner. The SMS will demonstrate the means by which the organizations safety policy is put into effect. The structure of the SMS should comply generally with accepted standards from the regulator and industry [46].
3.2.2
Content
Each management system will have the same basic elements, these will include systems relating to: The policy and objectives Organization resources and procedures Risk identification and evaluation Planning of work activities (including emergency response) Implementation and monitoring (including means of measuring performance) Audit to assess the operation of the SMS in practice Review of the system implementation of the audit process and review of the targets based on feedback from the monitoring system.
All of the above elements need to be underpinned by a commitment to safety from the organizations management at the highest level, with effective leadership to ensure that the above elements are diligently carried out. The management needs to be aware of the safety policy and aims and provide the necessary resources to ensure that these aims are fulfilled.
29
Policy & Objectives
Review
Organization Resources Procedure

Leadership and commitment
Implement Monitor Planning
Risk - Identification - Evaluation - Management
Audit
Figure 2 - Industry Standard SMS
3.2.3
Policy & Objectives
The organization must define and document its HSE policy and objectives. These should; be focused to the activities of the organization be consistent with other sectors of the organization be publicly stated and accessible be consistent with or improve upon current legislation have at least the same level of importance as other policies of the organization commit the organization to improving safety performance
3.2.4
3.2.4.1
Organization, Resources & Procedures

Project HSE Plans
It is general practice within the Offshore industry (for all but minor projects) to have specific HSE Plans drafted at the earliest practicable stage, usually at the Front End Engineering Design (FEED) stage. This HSE plan defines how safety and environmental aspects of the project will be managed. Typical contents will include: an introduction to, and outline of the project
30
a declaration of projects specific HSE policy statement and of the organizations HSE policies a summary of the safety criteria and targets set for HSE design the projects organization and reporting structure specific to HSE issues, from board level downwards details of the roles and responsibilities of those persons named in the safety organizational structure, including all levels within the project details of how the technical competency of the operational and design personnel is guaranteed details of the HSE activities on the project needed to ensure the appropriate level of safety and environmental integrity a schedule of HSE deliverables (i.e. documentation to be produced) the control of quality regarding bought-in items, services and sub-contracts relevant legislation and procedures available to undertake the above activities an audit plan.
The issues noted above are also important when dealing with bought-in items and services, the quality of work carried should match the standards expected from the company system. The high standard of design and product may be compromised by the input of others. Inputs from external organizations may include: CFD modelling of natural ventilation and gas dispersion simulation of the explosion to give overpressures and exceedance curves the design and manufacture of pre-assembled units (PAUs), e.g. process skids construction activities the installation of the facility hook-up and commissioning
Poor standards of workmanship, checking or other incorrect procedures are potential contributing factors in receiving a sub-standard product. All reasonable efforts therefore need to be made to confirm that the supplied goods and services are of an appropriate standard. To achieve this, as a minimum, prospective suppliers should be required to; supply a copy of their safety and environmental policies supply evidence that they have a functioning safety management system supply details of their safety and environmental performance, including accident history and details of any prosecutions or improvement notices served supply evidence that they have a quality management system complying with ISO 9001 or equivalent.
If the supplier cannot give satisfactory information on these topics, they should be excluded from the supply process or subjected to an audit to identify shortcomings and preferably be coached to improve.
31
The Plan should reinforce the premise that HSE is a line management responsibility, that each discipline and each individual is responsible for the safety and environmental impact aspects of his work. The role of the Safety Group to police the work of others beyond the usual interdisciplinary review of outputs cannot be relied upon. Where hazards or potential benefits are identified it is the individuals responsibility to identify the scenario and ensure that it is resolved. The Plan should be approved by the appropriate representative of management and circulated to all disciplines for them to cascade to individual worker level. All personnel should be aware of the standards required with respect to safety and environmental issues and what their role is in achieving this.
3.2.4.2
Resources
In order to carry out the work in a timely manner and with the necessary degree of competence sufficient resources must be made available. With respect to explosions the definition of the hazard must be identified at the correct time in the design process such that actions can be taken to accommodate it, So Far As Is Reasonably Practicable (SFAIRP). Resources in the context of competent personnel must be available during the following project stages; at concept selection stage to have safety and environmental input to ensure that the option chosen is the one with the lowest risk, as far as is reasonably practicable; at the FEED stage to ensure that layout issues are handled to minimize explosion hazard and risk; during the detailed design stage to ensure that control and mitigation systems are incorporated as necessary; throughout the design period to quantify as necessary the overpressure that may be encountered and the resultant risk.
Consideration of the explosion issues at different stages in the design of an installation is discussed in sub-clause 2.5.4 of the Commentary. Personnel undertaking the work should be suitably trained or experienced in the methods that need to be used. With respect to explosions suitable training is particularly important as new research is continually developing fundamental information on the mechanism as well as innovative means of control and mitigation.
3.2.4.3
Procedures
It is one function of the SMS, to ensure that activities are carried out in a correct and consistent manner and at the correct stage. It is a requirement that procedures and design guides will be available for engineers to follow and consult at all stages of the project. They should state the methods by which the activity should be carried out, by whom the work should be done and any performance standards or criteria that should be met. Procedures for dealing with bought-in services, should include the process by which prospective suppliers are assessed and the criteria that need to be met to qualify for the work.
32
Procedures should be available at key locations (for instance in the design office and with the QA engineer) for consultation at any time. They should be regularly reviewed and updated as necessary to include new systems or as a result of the findings from audits undertaken.
3.2.4.4
Leadership
Senior management should provide strong, visible leadership and commitment to HSE issues and ensure that this commitment is translated into the provision of the necessary resources to ensure that all the elements of the SMS as described above can be carried out effectively. There should also be a driving force from management to achieve a continual improvement in HSE performance. Project management should maintain a high profile for HSE issues throughout the life of the project, with HSE issues featuring prominently at regular project progress meetings and at meetings to all levels within the management hierarchy. Effective leadership should also encourage involvement and participation in the HSE management process at all levels. This should seek to promote each member of the design team to look at the work he/she is doing and understand the effect it has, or may have, on the overall HSE performance of the project and the end product. This should further encourage each member of the design team to air any concerns they might have with regards to HSE performance.
3.3
Risk reduction
The exploitation of offshore hydrocarbon reserves may be considered to consist of the following phases: Concept selection Concept definition Front end engineering design (FEED) Detailed design Fabrication/Construction Installation/Start-up Operation Decommissioning
The concept selection and definition phases are traditionally the time in which the most significant project decisions are taken. The majority of these decisions have a significant influence on the hazards which must ultimately be addressed by the engineering work and subsequently during the operational phase of the project. Figure 3 below shows that: Maximum safety leverage is available during the selection and definition phases. The cost effectiveness of safety effort expended during the selection and definition phases is significantly better than during the later phases. The impact on project schedule of safety effort expended during the selection definition phases is significantly less than during the later phases.
33
Unsuccessful safety performance during the selection and definition phases may result in failure to attain the maximum safety potential, or if it were to be attained it would be at the expense of significant cost and schedule penalties.
Attainable Safety Performance

Maximum Attainable Safety Performance Level
Executed Successful Safety Input During Early Phases
Define
Select Define Select Concept
Execute
Unsuccessful Safety Input During Early Phases
Cost (CAPEX & OPEX)
Figure 3 - The cost of Safety performance by design phase
By not robustly addressing the explosion hazard early in the phase of a project, the incremental costs of dealing with the hazard later in the project life increase significantly. In many cases a late design/construction change can be a magnitude greater in cost than had the feature been incorporated in the design basis of the project. This can result in a measure that becomes grossly disproportionate to the risk reduction achievable, whereas had the measure been introduced earlier in the project life this would not have been the case. As described above, the demonstration of ALARP is issue specific; it is recommended that the following general philosophy be applied for addressing explosion hazards on risk offshore facility: Establish and apply nominal overpressures if available. Use this Guidance (Clause 3) to manage the explosion hazard during the FEED and detailed engineering phases For high and medium risk installations, develop an explosion simulation model (as described in Clause 5) and continually update this model in line with design development.
It should be noted that small bore pipework added late in the project may increase the severity of the explosion overpressure. This may not be apparent until late in the project.
34
The Table below summarizes the factors affecting explosion risk by project phase Table 3.1 Summary of Life-cycle Factors Design Stage Concept selection and definition Design Factors Affecting Explosion Hazard/Risk Offshore processing content (amount of equipment and potential leak and ignition sources) Offshore structure type Location of living quarters (may be carried over to FEED) Equipment layout Decks plated or grated Operation and manning philosophy (exposure of personnel to explosion risk) Philosophy for engineering, piping, etc. Deck sizing Nominal explosion loading Fire area sizing, firewall blast wall location Determination of constructability Element specific or low level performance standards set Safety Critical Element (SCE) categorisation identification of high criticality items Design for overpressures, dynamic pressures Finer points of layout Firewater and vent piping, location and schedule Supports for safety critical elements determined Control systems designed Verification of constructability Assembly/writing of maintenance and inspection procedures
FEED
Detailed design
Construction
Small bore piping runs located Changes to ensure constructability Competence of construction Assembly of Decommissioning procedures and assurance of integrity during decommissioning. Maintenance Inspection Change control Hot work procedures
Operation
Decommissioning
Implementation of decommissioning procedures Implementation of disposal procedures
35
3.4
3.4.1
Risk screening
General
The higher the life safety risk (or risk to life) on an installation or within a compartment/module the greater should be the rigor that is employed to understand and reduce that risk. Where the risk associated with an outcome is low, any inaccuracies in determining that risk will also be low in absolute terms. The effort expended should be proportional to the risk. It is important therefore to have a means of early estimation of the risk level of an installation to determine the appropriate approach to be used in installation explosion assessment. The approach to explosion assessment needs to be decided early in the design process when absolute values for explosion frequency and detailed consequence analysis are not available. Risk is the product of consequence and frequency of occurrence. This risk can be calculated as a numerical value expressed as Individual Risk (IR) or in terms of a value for the installation such as Potential Loss of Life (PLL). Where quantitative values are not available a qualitative measure of risk can be estimated to a degree of accuracy sufficient to make a decision on the assessment approach to be adopted. Likelihood is a more appropriate term in this context where a qualitative assessment is being performed, the terms probability and frequency imply that numerical values are available. A simple approach which is frequently adopted for qualitative risk analysis uses a 3 x 3 matrix of potential consequence and likelihood of an explosion event [47] is described in this subclause.
3.4.2
Consequence severity
The consequence side of the matrix comprises an assessment of the effects of credible explosion scenarios including escalation. In human terms the direct consequences of an explosion are potentially considerably less than those which may occur as an indirect result of the explosion. The human physiology can withstand relatively high overpressures. The major risk lies in effects such as being blown over by the blast wind, being struck by missiles picked up by the blast, oxygen depletion and burns from flames and hot gases. It is more likely that the major consequences will involve escalation, such as: fires resulting from loss of inventory from damaged equipment, pipework and vessels; loss of TR integrity by failure of the boundary partitions; structural failure; inaccessibility of means of escape and/or evacuation.
For the installation under consideration the direct and indirect effects of explosion overpressure should be identified. This should be achieved by assessing parameters such as; the vulnerability of Safety Critical Elements to dynamic pressure, overpressure, missiles, and strong shock response occupancy of area immediately affected vulnerability of people in adjacent areas the relative location of the TR Issue 1, October 2003
36
levels of congestion and confinement the suitability of the layout the dimensions of potential explosive gas clouds hazardous inventories, both isolatable and non-isolatable the operating and control philosophy, influencing manning levels and occupation frequency the operating and control philosophy influencing extent of operator intervention and the potential for human error and inventory loss.
The following gives some guidance on the assessment of consequences: Low consequence outcomes would be predicted where the overpressure level is predicted to be relatively low and immediate and delayed consequences are also low. The equipment count would probably be low, being limited to wellheads and manifold with no vessels (i.e. no associated process pipework) resulting in low congestion and inventory. Confinement should also be low, with no more than 2 solid boundaries including solid decks. Manning would be consistent with a normally unattended installation with a low attendance frequency, less frequent than 6-weekly. A 6-weekly visit by a maintenance/intervention crew results in occupancy of a little over 1 %. A medium consequence installation would be typically a platform or compartment where the congestion and confinement exceeds that defined for the low consequence case but with still a low manning level consistent with a normally unattended installation. Congestion, typified by the amount of equipment installed, will be greater than for the low case. Manning would be consistent with a normally unattended installation with a moderate attendance frequency, more frequent than 6-weekly. Alternatively, a medium consequence installation may be a processing platform necessitating permanent manning but with low escalation potential to quarters, utilities and control areas which are located on a separate structure. A high consequence installation would encompass remaining installations and compartments where there is significant processing on board leading to significant congestion and potential confinement with populated areas within the consequence range of escalation scenarios. This may typically be characterised by a PDUQ/PUQ installation (jacket, semi-sub, jack-up or FPSO) with quarters on the same structure as the process. Where there is doubt regarding the category into which an installation should fall, it is recommended that the category with next higher consequence is used.
3.4.3
Likelihood
The likelihood of an explosion will depend upon the likelihood of occurrence of a gas cloud and delayed ignition. The following parameters will influence the potential likelihood of an explosion: hazardous inventory complexity, i.e. the number of flanges, valves, compressors and other potential gas leak sources; the type of flanges, valves or pipework. Some generic types of flange tend to have lower leak frequencies associated with them, e.g. hub type flanges; the number of ignition sources within the potential gas cloud; the ventilation regime;
37
the equipment reliability and the maintenance philosophy.
The likelihood considerations tend to align closely with the consequence factors in that the low consequence installations will tend to be small and therefore less complex. Large installations will have more potential leak and ignition sources and therefore a greater requirement for intervention and maintenance. Low event likelihood installations and compartments will have a low equipment count. The frequency intervention of 6 weeks or more is also recommended as a criterion as this will be a surrogate for equipment count and reliability as well as a measure of maintenance risk with respect to explosion. Medium event likelihood is suggested by an NUI with equipment count greater than for the low case. Similarly, where the planned frequency of maintenance/intervention is greater than a 6weekly basis then this suggests a higher or less reliable class of equipment with medium level of potential for explosion. Where the complexity of the process in a compartment requires a permanently manned installation this suggests a high equipment level and therefore potentially a high likelihood of an explosion event, a large number of potential leak sources and high ignition potential. Where there is doubt regarding the category into which an installation should fall, it is recommended the category with next higher likelihood is used.
3.4.4
The Risk Matrix
The risk category for the installation is assigned using the risk matrix below: Consequence Low Frequency/ Likelihood High Medium Low Medium risk Low risk Low risk Medium High risk Medium risk Low risk High High risk High risk Medium risk
3.5
3.5.1
Hazard identification and scenarios

General
In order to manage the explosion hazard, it is necessary to identify the initiating events which may lead to an explosion. These initiating events should be eliminated if possible otherwise prevention, control and mitigation will become necessary. An example methodology for the definition of scenarios is shown in the flow diagram of Figure 4. Fire and explosion interaction is discussed in Clause 4. Explosion scenarios must also be considered from the point of view of the fire hazard.
38
3.5.2
Identification
It is not possible to manage hazards without understanding them, it is necessary therefore to undertake the necessary exercises to ensure they can be identified. It should be the aim of all projects to identify the major safety and environmental hazards as early as possible in the project so that they can be assessed and acted upon as necessary in a timely manner. The means by which hazards are identified may be by formal processes such as: hazard identification studies (HAZIDs) and environmental hazard identification studies (ENVID) hazard and operability reviews (HAZOPs) layout review hazardous area review safety studies
Formal reviews should be attended by all relevant disciplines, including operational personnel, in order to obtain as broad an understanding as possible of potential hazards. Hazards may also be identified by the individual in the course of his work. A key element in the management of hazards is the establishment of an action tracking system. A log should be kept of all actions arising from hazard identification studies, reports and project concerns so that they can be formally held in a single data-base, tracked and eventually closed out, thus ensuring that none is forgotten or ignored. This is called the Safety & Environmental Action Monitoring System, or similar title, and is generally managed by the Safety Group within the project. Additionally, it may aid the management of hazards to compile a hazard register listing all significant hazards, their cause, and how each is handled.
3.5.3
Causes
Causes of a release may be dropped objects, ship impact, intervention, fatigue, vibration, extreme environmental conditions, imperfections, escalation from a fire, exceedance of design conditions and human error. These causes are often referred to as initiating events. Sub-clause 2.2 gives an historical overview of the sources of releases for the UK sector of the North Sea from Reference [23]. Generic release scenarios based on historical evidence in the Gulf of Mexico sector of the North Sea [23] are listed below starting with the most credible:[48]
and the UK
1. Pump Seal or Gasket Leak: Often represented as a 5 mm orifice or the annular space between the flanges without a gasket or between the pump shaft and the caseless seal. 2. Small Fitting or Line: Often represented as a 20 mm orifice or the typically installed diameter for an instrument connection, or sample/drain line. 3. Medium Line or Partial Large Line: Often represented by a 50 mm orifice and evaluated as a possible credible release scenarios especially when considering dropped objects.
39
4. Large Transfer Line & Vessel Nozzle Failure: Full pipe diameter. Rarely considered as credible for design although frequently appears in loss databases. Evaluated usually for off-facility or facility separation distance determination and emergency response planning purposes. 5. Vessel Failure: Some suggestions by failure mode propagation or vessel de-inventory within 10 minutes. Rarely considered as credible for design although occasionally appears in loss databases usually as a result of inappropriate vessel materials selection (e.g., hydrogen embrittlement, chloride/caustic stress corrosion cracking), improper relief sizing or relief plugging, mechanical impact as well as incomplete inspection.
3.5.4
Evaluation
For each hazard, including explosion, that is identified an evaluation should be made of the potential consequences and the risk to personnel, the environment and the asset. Quantification of the event frequency should be undertaken as detailed elsewhere in this Guidance using recognized QRA techniques. With respect to consequences, a number of rule sets can be compiled, for example; if the overpressure, or other explosion effect such as severe vibration, exceeds the quoted survivability criterion in the element specific performance standard for the SCE, then its functionality is assumed to be impaired; As far as explosion impact on humans is concerned there are seven primary hazards. These are direct overpressure effects, burns from the flame front, oxygen depletion, removal of protective clothing, the impact of blast wind on personnel, the impact of objects on to personnel and the inhalation of hot products of combustion It is probable that personnel around the periphery of the module, where gases vent, will be more susceptible to blast wind than static overpressure. It is suggested [1] that at 20m/s most people would be knocked over. Injury may then result from contact with hard objects or exceptionally by being thrown overboard; It is difficult to quantify the risk from blast wind and inhalation of hot gases. In QRA it is often conservatively assumed that anyone within the same module as the blast becomes a fatality.
3.5.5
Hazard & Risk Management
Where significant risk is identified, systems shall be put in place where practicable for its reduction. A hierarchy should be used when considering suitable means of risk reduction. In the first instance, the aim should be to eliminate the hazard entirely. If explosion events cannot be eliminated the aim should be to: remove personnel from the consequences of the explosion or escalating events; minimise the intensity of the explosion event; use control systems to warn personnel and to minimise the explosion event; install mitigation measures to protect the workforce;
40
Table 3.2 Management Hierarchy Level of Hierarchy Eliminate risk Typical Management Options No leak sources No ignition source No congestion No confinement Ensure inherent strength to withstand the event Remote operation No offshore processing Split facilities (separate quarters structure) Provide and maintain emergency escape and rescue (EER) facilities Reduce congestion Reduce confinement Increase ventilation Reduce hazardous inventory Reduce inventory pressure Gas/leak detection Alarm to warn personnel Deluge initiation ESD and blowdown Electrical isolation Forced ventilation control
Remove personnel from the consequences Minimise inherent strength of explosion event Use of control systems
Mitigation for the workforce Blast Walls, TR, means of escape and evacuation and individual
3.6
3.6.1
Detection, control and mitigation

Introduction
Aspects of inherent safety have been discussed in Clause 2. The employment of inherently safe features is an important part of any new design or assessment of existing installations, however there will usually be residual hazards and some risk that needs to be managed. Using the safety management hierarchy these residual risks should be approached firstly by controlling the risk and then by mitigation. Control implies the detection of the initiating events and actions initiated after the detection to reduce the hazard or exposure to it. For the explosion hazard, systems will have a role in: detection and initiation of control measures avoidance of the explosion event reduction of people on board (POB) exposure reduction of the severity of the explosion hazard
41
minimization of the escalation potential protection of the SCEs
Where choices exist, preference should be given to passive rather than active systems of control and mitigation as stated in sub-clause 2.5.3. Measures that can be used to fulfil the control and mitigation roles are given in Table 3.3 below. Table 3.3 Summary of Control and Mitigation Options Role Control/Mitigation Measure Gas detection Acoustic leak detection Operator/Manual alarm call-point/Phone Emergency Shutdown (ESD)
Detection and initiation of control measures Avoidance of the explosion event
Isolation of electrical equipment Increase ventilation start stand-by fans (in explosion zone) Shutdown ventilation intakes (on detection in adjacent areas) General alarm Blast walls, TR, means of escape and evacuation Initiation of area deluge upon gas detection Increase ventilation start stand-by fans
Reduction of POB exposure
Reduction of the severity of the explosion hazard Minimization of the escalation potential Protection of SCEs
Isolation of hazardous inventories Blowdown/depressurisation Blast walls Blast walls/enclosures Resilient mountings Inherent robustness
3.6.2
Detection
The aim should be to detect hazardous gas, vapour or oil spray accumulations and to initiate control measures at the earliest opportunity. Gas detection devices should be located where accumulations are likely to occur. In locating the detection devices some knowledge of the dispersion of the accumulation is desirable. This will include any area where hazardous fluid is handled, i.e. a fluid handled above its flash-point or within 20C of it. Detection should result in an immediate alarm, so that personnel can escape from the local area and the potential direct consequences of the explosion. Upon detection deluge should normally be initiated where congestion dominated explosions may occur when the danger from the creation of additional ignition sources is considered unimportant. (Deluge should not be initiated on gas detection in confined areas as the result may be to increase overpressure due to the added turbulence induced by the spray.)
42
Confirmed detection should give rise to executive actions to help limit the potential for an explosion to occur or limit the consequences. This will involve Emergency Shutdown ESD at an appropriate level, initiation of blowdown and isolation of non-essential electrical supplies. All electrical equipment remaining in operation within the explosion zone should be rated for operation in a Zone 1 hazardous area [35]]. A critical feature to be taken into account during design is the choice of detection devices to provide rapid response and avoid spurious action. If the operator loses faith in the system installed there is a risk that either the outputs will be disabled or that it will not be correctly acted upon when a hazardous event actually occurs. The latest infra-red hazardous gas detection devices are reliable and if correctly installed should not give rise to spurious trips. They also provide a rapid response which is important where deluge is used as a means of overpressure reduction. In hazardous gas detection, two levels of action are usually specified, low level gas and high level gas. The Low Level Gas action point, generally the alarm level, should be established at the lowest level that detector can reliably be set without spurious tripping. This will ensure the earliest possible detection of the leak by this means. The High Level Gas action point, generally the executive action level, should be set at the lowest level whereby it is considered reasonable to instigate executive actions. High and Low Levels may be combined to a single action level. It is then recommended that this level is set as low as practicable consistent with the avoidance of spurious trips. Ultrasonic leak detection is another means of detecting a loss of containment, this does not rely on the device being within the gas cloud to be tripped. This can be of significant benefit in the early detection of leaks. This type of detector picks up the high frequency noise emitted by a sonic leak. It is often used for alarm only, but this depends upon the potential for spurious initiation, e.g. leaking pneumatic systems. If the potential for spurious/faulty action is low then it should be considered for executive action especially in the initiation of deluge when acoustic detection may be expected to give a more rapid response to a leak that conventional gas detectors. Infra-red devices may also be beneficial as they too do not need to be in the cloud to detect a gas release. Increased confidence in these types of detection is likely to lead further to their use in automatic initiation of executive actions, such as including process shutdown.
3.6.3
Control Systems
Control includes actions initiated after the detection to reduce the hazard or exposure to it. For the explosion hazard, control measures will include; alarm to personnel Emergency Shut Down (ESD) blowdown/depressurisation electrical isolation shutdown of fans for detection in external areas start of standby fans for detection in enclosed areas deluge initiation
43
other systems such as inert gas flooding
Control systems will aim to minimise the magnitude of the explosion event and prevent or minimise the potential for escalation once it has occurred. The control loops from initiation to output should be subject to assessment of the Safety Integrity Level (SIL) of the system [34] . The Probability of Failure on Demand (PFD) of the system must be compatible with the SIL to ensure the appropriate level of reliability of operation. The following figure indicates the actions that may be taken upon gas detection.
Low level Gas Detection
High level Gas Detection
Initiate general alarm Start firewater pumps Open deluge valve
Re-Alarm Initiate ESDV at appropriate level
Ventilated Area (hazardous) Start all available HVAC ventilation fans
Ventilated Area (non hazardous) Stop ventilation fans Close HVAC dampers
ESD
Isolate non-essential electrical equipment Close ESDVs Open EDPDs Trip mechanical plant
Figure 4 - Actions that may be taken upon gas detection
3.6.4
Shutdown Philosophy
Upon confirmed gas or leak detection, the executive action level should initiate a level of emergency shutdown appropriate to the risk of explosion and fire. It is expected that the installation will have a hierarchy of shutdown levels depending on the degree of risk posed by the hazard identified. Detection of hazardous gas at the executive action level would be likely to initiate a high level of shutdown. In order to minimise the size of an explosive gas cloud that may accumulate and to minimise potential escalation, process shutdown and isolation of hazardous inventories should occur. Further actions at the appropriate level of shutdown may also be initiated.
44
3.6.5
ESD and Blowdown
At the executive (High Level) action point ESD should be initiated to minimise the potential inventory that can be lost to the environment. The level at which this executive action is initiated should be chosen based on the specification of the detection device and the avoidance of spurious shutdowns. Blowdown of relevant inventories should commence at once or as soon as it is safe to do so. Unless blowdown is rapid it will tend to have a small impact on the flammable cloud size generated since, for a typical methane rich hydrocarbon release with a Lower Explosive Limit (LEL) of 5 % volume concentration with 9 % as the stoichiometric volume concentration level; only a relatively small amount of gas is required to develop a large explosive cloud. The use of standard API blowdown rates [49] is intended for the mitigation of fire escalation only, these rates are under review even for this use. API 521[49] is now known to recommend blowdown rates which are too low for offshore use. The aim for explosion mitigation should be to depressurize the process as rapidly as reasonably practicable, balancing the gains from the reduced period of flammable gas cloud duration and reduced escalation consequences against size and cost of the vent system and the impact of thermal radiation from the flare or ignited vent. In general the API standard requirements [49] should be regarded as a minimal rather than an optimal and are not related to the explosion hazard. In order to remove the inventory from the explosion zone more quickly, it may be feasible to close the upstream isolation valve and leave the downstream valves open if there is a significant pressure drop in the process. The inventory will then tend to drop to the lower pressure through the downstream control valve. Full isolation from downstream inventories should however be completed as the pressure equalises. Downstream isolation valves and actuators should be outside the explosion zone or protected from the potential effects of blast so that closure after an explosion event is still possible. Closure of the downstream valve should occur after a delay built into the shutdown software or initiated by a pressure sensing device as long as this will remain functional after the explosion and any foreseeable escalation.
3.6.6
Artificial Ventilation
Artificial ventilation is defined as that ventilation which is not supplied from the action of the environmental wind alone. Artificial ventilation may be either induced or forced. Induced ventilation means that the air is drawn into the space by fans located on the extract side of the room, the room is then under negative pressure compared with areas around it. Forced ventilation means that air is forced into the room by fans in the intake ducting resulting in the ventilated space being at positive pressure relative to adjacent areas. Rooms containing hazardous gas inventories are generally operated at negative pressure compared with adjacent non-hazardous areas to prevent leakage of potentially explosive gas clouds to those adjacent areas. Upon detection of flammable gas, the standby fan(s) should be started to give maximum possible ventilation in order to aid dilution of the leak to prevent or limit the generation of an explosive cloud. Non-hazardous rooms adjacent or close to hazardous areas are normally operated at a positive pressure to prevent ingress of explosive gas clouds. Upon gas detection, which would normally occur at the fresh air intake, all fans should be stopped and the intake and discharge isolated by (nominally) gas tight dampers.
45
3.6.7
Deluge
The Phase 3a Advantica Spadeadam tests [50] confirmed that deluge can significantly reduce high explosion overpressures. The benefits of deluge have now been incorporated into the major CFD and some phenomenological simulation software. Fears that the deluge would provide an ignition source through electrostatic effects have proved unfounded [51] although there is a residual doubt about the ignition potential due to charge accumulation on isolated conductors e.g. scaffolding. The initiation of deluge and water curtains on a quiescent gas cloud may induce turbulence in the cloud, limit ventilation and mix an inhomogeneous cloud. These effects could give rise to higher overpressures. The mechanism by which this mitigation occurs is by inhibition of the combustion process and by cooling of the products of combustion as the deluge water is converted to vapour. Deluge from standard MV or HV nozzles has been found to be suitable for reducing overpressure in congestion generated explosions. Congestion generated explosions are characterised by a fast moving flame front. This acts on the droplet to break it up and give a greater overall surface area so that it more efficiently achieves the quenching effect on the combustion mechanism. The usual general area coverage rate of 10 l/min/m2 [34], even with 15 % added for hydraulic imbalance, falls outside the rate investigated in the JIP tests [50]. If explosion mitigation is considered critical a deluge flow-rate of at least 13-15 l/min/m2 is recommended for general area coverage. This will have a significant effect on lowering peak overpressures. Greater flows up to about 20 l/min/m2 will have a marginally increased benefit. Where the overpressure is generated by confinement, for example in completely enclosed modules, there is not sufficient kinetic energy in the flame to break up the deluge droplets in order for them to be effective. In enclosed modules deluge will be ineffective in lowering overpressures and may even result in an increase due to the turbulence caused by the water spray. It is important that the deluge is employed as area coverage rather than equipment specific protection. Equipment specific protection only applies deluge to small discrete areas and this is not sufficient to give any meaningful control of overpressure. For large open deck areas, such as FPSOs, the process area is generally divided into fire zones in order to limit the size of the firewater pumps. On large open decks firewalls are not generally practicable so the deck is divided into fire zones where fire events may be expected to be confined, these may be discrete process blocks or pre-assembled units. Firewater pumps are sized to deluge the zone in which fire detection takes place, and immediately adjacent zones. Large gas clouds can, however, cover a number of such fire zones. This means that there is insufficient water supply to cover the whole flammable cloud. For these applications and where equipment specific deluge only is installed, water curtains may be used to arrest the flame velocity and prevent runaway flame acceleration. A double curtain of MV nozzles supplying water at a rate of about 15 l/min/m2 for the area covered by the curtain and spaced at 10m intervals should be effective in arresting runaway flame acceleration and prevent excessive overpressures. Other devices such as fan sprays have also been tested and may give coverage more suited for curtain use. Deluge would then be applied to the fire zone where initial gas detection takes place with water curtains supplied simultaneously from a separate deluge valve.
46
Some CFD overpressure modelling programs can accommodate the effect of water curtains so an optimisation of frequency and coverage of curtains within the practicalities of firewater demand can be undertaken. A major problem in determining risk levels for an installation with explosion mitigation by deluge is determining the level of risk reduction that can be assumed. This is due to at least two factors; the delay between leak initiation and deluge being applied to the module; the reliability of the deluge system, from detector device through to deluge nozzle. for the majority of low pressure events there is no benefit particularly if the coverage is incomplete
These factors can be however estimated from a knowledge of the equipment and systems within the module. The benefits of explosion mitigation by general area may deluge may only be considered only if a time dependent ignition probability is used and the deluge can be applied within the reliability constraints of the system. The use and effectiveness of deluge as a fire and explosion mitigation measure is discussed in sub-clause 4.7.
3.7
3.7.1
Control systems and Safety Critical Equipment

Safety Integrity Levels
Instrumented control systems rely the following generic loop to effect the control mechanism; a means of detecting an upset condition, e.g. a gas accumulation an electronic data processing system to process outputs from the detection system output signals to activate the controlling mechanisms.
For any control system there will be a potential for failure to operate on demand due to the inherent unreliability of the elements involved. It is essential however that control systems have a reliability that gives sufficient confidence that they will be effective. The level of reliability to function on demand should be commensurate with the level of risk being averted. This can be assured by determining the loops Safety Integrity Level and designing the elements of the loop to meet this level of reliability. Guidance on the setting of SIL can be found in Reference [52]. The procedure should be applied to each instrumented control loop used in the management of explosion hazards.
3.7.2
Safety Critical Elements
Safety Critical Elements (SCEs) are those items or systems that prevent or reduce the impact of major accident events. They are identified as part of the detailed design of an installation as required by the Safety Case Regulations [30].
47
In order to demonstrate that these systems remain functional and fulfil their duties, element specific performance standards defining how the SCEs will operate under normal and extreme conditions. SCEs that mitigate the effects of a major accident will have to remain functional after initiation of design accidental events, e.g. explosions. A design accidental event is one for which SCEs on the installation should perform their function as designed. Extreme events against which design is not reasonably practicable may result in loss of these systems. A typical listing of SCEs would include the items given in Table 3.4: Table 3.4 Typical Safety Critical Elements Ref. No. SCE 001 SCE 002 SCE 003 SCE 004 SCE 005a SCE 005b SCE 005c SCE 006 SCE 007 SCE 008 SCE 009 SCE 010 SCE 011 SCE 012 SCE 013 SCE 014 SCE 015 SCE 016 SCE 017 SCE 018 SCE 019 Safety Critical Element Hydrocarbon Containment -Pipelines, Risers, Vent lines, firewater pipework Hydrocarbon Containment -Topsides Process Facilities Hydrocarbon Containment -Wells Fire & Gas Detection System Riser Shutdown System Topsides Shutdown System Wellhead Shutdown System Ignition Prevention Platform Sub-Structure Topsides Structure Uninterrupted Power Supply Emergency Lighting Evacuation & Escape Systems Rescue & Recovery Telecommunications Navigational Aids Personal Protective Equipment Helideck Escape Routes Temporary Refuge Platform Crane / Lifting Appliances
Of the above SCEs all, apart from the crane/lifting appliances, should remain functional during and after an explosion event, and the remaining items should not fail so as to give rise to a hazard, e.g. catastrophically collapse. The performance of each SCE is defined in element specific performance standards which remain with the SCE throughout its life and against which its performance is assessed. The element specific performance standard defines the items Functionality, Reliability or Availability, Survivability and some measure of interaction with other safety systems. Survivability includes its endurance under explosion loads. The design of the system must therefore match its stated survivability so that its functionality is maintained in an explosion event. The specific explosion effects which it may need to withstand are; overpressure Issue 1, October 2003
48
dynamic pressure displacement effects strong vibration exposure to missiles
3.7.3
Equipment specific performance standards
The term Performance Standard has become interpreted as having a very specific meaning when related to the DCR which amends the SCR. One of the aspects of DCR is the identification of Safety-Critical Elements and the preparation of a Written Scheme of Verification for assurance of continued integrity. A Performance Standard can be described as a series of statements which can be expressed in qualitative or quantitative terms the performance required of an SCE can be compliant with DCR. The equipment specific performance standards or low level performance standards define the requirements in terms of functionality, availability and survivability. The Performance Standard is a means of condensing the Design Specification and Operating Procedures into a requirement related to a particular system in a particular mode of operation in the face of an identified hazard. The justification for the requirement and the degree to which it is achieved is contained within the Written Scheme of Verification or Examination.
3.7.4
Levels of criticality of equipment items
The DCR states: Any structure, plant, equipment, system (including computer software) or component part whose failure could cause or contribute substantially to a major accident is safety-critical, as is any which is intended to prevent or limit the effect of a major accident. So for our purposes, the following equipment and systems at least need to be addressed when considering the response to explosions: Those necessary for the safe shut down of the installation. Those necessary for personnel protection and escape. Those necessary for fire detection, suppression and control. Those necessary for communications. Those necessary for hydrocarbon processing, transport and storage.
Safety-Critical Equipment may require a blast protection structure to enable satisfactory operation within the full range of design explosion events. Protection against fire is a further consideration, both before and after the effects of an explosion; such considerations are covered in Clause 7. A practicable limiting explosion needs to be identified in the specification of these equipment specific performance standards, such that the risks to personnel, the environment and the commercial viability of the asset are as low as reasonably practicable (ALARP). This Ductility Level Blast (DLB) is an achievable design event with a realistic frequency of occurrence. It will be paramount in this Guidance Document to achieve consistent terminology to identify those events with: The maximum credible peak overpressure, but very low frequency of occurrence; The practicable limiting overpressure for design purposes, giving ALARP risk levels;
49
Overpressures giving elastic response levels in components, for early design and robustness checks.
With systems such as gas detection, the ability to withstand a major explosion may not be warranted, so long as the presence of the gas build up is identified. The element specific performance standards thus need to be realistic and fit-for-purpose, taken on a element by element basis. The performance standards need to take into account initial design and manufacturing cost, practicability of construction, maintenance, accessibility for inspection, reliability, robustness and redundancy. To this end OTO 1999 046 and 1999 047 similar to the one given below: Criticality 1 Criticality 2 Criticality 3
[53, 54]
, detailed the use of a criticality rating system
Equipment and pipes designed to withstand the same explosion severity as the main structure. Equipment and pipes designed for a less severe but non-the-less substantial explosion event. Equipment not designed or assessed for explosion.
The difference between Criticality 1 and 2 items would be associated with the consequence of fire escalation and escape from the facility. It was recognised in the paper that the assessment of Criticality 1 items would be very much constrained by project schedules and costs under current design project philosophies. The key question though must be whether current design practice delivers equipment and their supports which, if designed primarily for in-service loading, provide safe and fit-for-purpose details when subjected to extreme explosion events. Based on the limited amount of strengthening or modification to existing equipment required for operators to delivery satisfactory Safety Cases upon their most recent submission, it must be presumed that past designs are reasonably robust and a significant increase in design effort would not therefore be warranted or necessary. Criticality 1 Items whose failure would lead direct impairment of the TR or emergency escape and rescue (EER) systems including the associated supporting structure. Performance standard These items must not fail during the DLB or SLB, ductile response of the support structure is allowed during the DLB. Criticality 2 Items whose failure could lead to major hydrocarbon release and escalation affecting more than one module or compartment. Performance standard These items must have no functional significance in an explosion event and these items and their supports must respond elastically under the strength level blast (SLB)
Criticality 3
Items whose failure in an explosion may result in module wide escalation, with potential for inventories outside the module contributing to a fire due to blowdown and or pipework damage. Performance standard These items have no functional significance in an explosion event and must not become or generate projectiles.
50
The Strength Level Blast (SLB) and the Ductility Level Blast (DLB) are defined in the glossary, Appendix B and sub-clause 3.6.
3.8
3.8.1
Mitigation and consequence minimization

General
The severity of explosion consequences may be mitigated by the introduction of: Lower inventory pressures More ventilation Judicious ignition source location Smaller potential explosion zones Optimised layout resulting in less congestion and less confinement The use of blast relief panels Robust design of SCEs and minimisation of escalation potential Segregation of explosion release sources from congestion and major escalation targets.
3.8.2
Inventory Pressure
Flammable cloud size is determined by the leak dimension and the pressure of the inventory. The mass rate at which gas is released from a hole is directly proportional to pressure. Reduced inventory pressure will reduce explosive cloud dimensions and the severity of the explosion event. A reduction in pressure will also result in a lower inventory mass within the system which will give the potential for more rapid blowdown and reduced escalation consequence
3.8.3
Ventilation
Assuming that some loss of inventory from a hazardous process will occur at some time, ventilation is critical in ensuring that a significant flammable gas cloud does not form or that the cloud is reduced in size, particularly for small leaks which are the most frequent. Industry guidance [35] defines adequate ventilation as ventilation achieving at least 12 air changes per hour for at least 95 % of the time, with no dead spots. The term adequate ventilation is not meant to imply an optimum level of leak dilution; it should be regarded as minimum target. Increased ventilation rates will ensure dilution of larger hazardous leaks and reduce the potential for explosions to occur or reduce its severity. In the case of natural ventilation adequate ventilation needs to be confirmed. For small wellhead platforms and NUIs this can generally be demonstrated qualitatively since confinement is low. For more complex installations the only way of demonstrating adequate ventilation will be either by CFD modelling of the ventilation regime, or wind tunnel testing. Where there is inadequate ventilation the options are to re-orientate the installation to make more use of prevailing winds, to remove confinement, to relocate equipment to provide a freer air flow through the module and to add some fan assistance at dead spots.
51
A special case, but one which typifies that various considerations that arise in the ventilation of a hazardous area, is that of turbine enclosure ventilation. The means of managing this risk is detailed in the HSE guidance[55]. This relies on fast dilution of the leak at source to prevent significant flammable clouds forming.
3.8.4
Installation Orientation
If a module is open on all four sides, orientation of the installation is relatively unimportant. If, as is often the case, one side forms a solid partition then orientation will affect the ventilation air change rate within the module. The installation is often aligned such that the TR is directly upwind of the process areas. This minimises potential for smoke logging or toxic gas ingress into the TR. Apart from smoke logging and natural ventilation, operational factors also enter into the orientation assessment as supply vessels and helicopter approaches tend to be towards the flow of current or wind respectively. The preliminary QRA is likely to give an indication as to the relative risks of fire, toxic gas or explosion. It is probable that explosion risk (including escalation from an explosion event) will be well below that from process fires and that operational constraints of supply vessels, at least on the larger installations, will tend to set the orientation, with natural ventilation being a secondary consideration. FPSOs are unique in that they orientate themselves according to the relative forces of the current, wave and wind, called weather-vaning. Frequently the vessel will be positioned with the wind blowing lengthways from bow to stern. This is not the preferred arrangement from an explosion point of view as a gas cloud will extend along the deck within congested areas rather than being blow out to the sides. With fan assisted ventilation, for instance in a closed module, it is relatively easy to show that adequate ventilation has been provided. The provision of 12 air changes per hour as an absolute minimum [35] with a qualitative demonstration that there are no dead spots by the suitable location of supply grilles should suffice.
3.8.5
Ignition Source Location
Highest overpressures in congested modules tend to arise when the ignition point is at the furthest point from a main vent. There is potential for ignition to occur at practically any point within the module (e.g. from hot work activities), however removing other ignition sources away from such extremities will, to some extent, lower the potential for high explosion overpressures to occur.
3.8.6
Layout optimisation
The layout of a module should be optimised in order to; Minimise confinement Minimise congestion Minimise flame front path length Reduce potential gas cloud size Reduce unfavourable ignition source locations
52
Generally, layouts that result in maximum potential for venting and minimise the potential for turbulent flow generation, particularly in the early stages of flame travel, will reduce the final overpressure.
3.8.7
Reduction in Explosion Zone Size
For a congestion dominated explosion event the strength of explosion is dependent on the flame path length from a main vent or from a target. For this explosion type, the largest overpressures for a given configuration tend to arise when the ignition point is furthest from a main vent. Keeping the dimensions of an explosion zone small will limit the potential for overpressure generation. This also means that for a given deck area the minimum potential overpressure occurs for a square plan area, as opposed to a long narrow plan. To achieve this for a large complex process suggests that there will need to be a number of partitions to limit the size of each zone. This will however tend to increase confinement and reduce the effect of natural ventilation. A balance needs to be sought in reaching an optimum solution.
3.8.8
Congestion minimisation and layout
Congestion is not necessarily related to blockage ratio, more the type of blockage. The volume blockage ratio is defined as the ratio of the volume occupied by the obstacles to the total volume. A large, correctly aligned, vessel may have little effect on overpressure but a number of small bore pipes of similar volume will have a significant effect since the turbulence generated will be greater. Since smaller items tend to give rise to the greater level of turbulence critical for overpressure generation a suitable measure of overpressure generation potential may be the mean diameter of equipment. This does not however take into account the amount of equipment present. The Volume blockage ratio is a suitable measure of this. To judge the degree of congestion in a given arrangement the volume blockage divided by mean diameter may give a measure of congestion. These measures are in need of further investigation. This issue will be pursued further in Part 3 of the Guidance The effect on overpressure of the above recommendations can be variable and in some cases conflicting. It is necessary to optimise the overpressure management techniques by reference to a calculation model to confirm the downward trend. Phenomenological models may suffice for this purpose. The intention is to identify trends in overpressure, not absolute values, it is not then the accuracy of the model in predicting overpressure values that is required, rather its ability to identify trends; its speed and ease of use. The area around vents should be kept as clear as possible. Any blockage of these will result, not only in increase in overpressure, but also in the velocity of the gases being vented. Installations tend to have escape routes around the periphery of modules so that minimisation of explosion consequences at vents will have less impact on escaping personnel and prevent damage that may affect escape routes. Additionally, pipework located near vent areas will be subjected to drag forces proportional to the square of the exit velocity. It is therefore preferable to locate pipework away from vent areas so that they do not block the vent path but also because the forces exerted on them may be difficult to accommodate. Careful layout at an early stage in a design project by orientating major vessels parallel to the expected gas flow during an explosion and avoiding the blockage of vents, can reduce the peak overpressures by a considerable amount.
53
Figure 5 shows comparisons of good and bad layout options from the point of view of explosion overpressure.
Poor
Effect
Better
Reduce volume
Safe area
Reduce Blockage ratio And number Of obstructions
Move obstacles to Inner part of module
Sideways venting
Reduce Blockage ratio, Increase Transverse spacing
Figure 5 - Relative merits of layouts
The following observations may also be noted for the mitigation of the effects of explosions. Effective venting reduces the magnitude of the peak overpressure When gas is allowed to expand freely the resulting overpressure is much lower than when the gas is confined For the same blockage ratio several small obstacles create a higher overpressure than a smaller number of big obstacles.
54
Blow-out panels take a finite time to move out of the way of the expanding gas and may not prevent further overpressure increases. Normal louvres create sufficient obstruction to cause increased overpressures. Sharp cornered objects generate higher peak pressures than rounded obstacles.
3.8.9
Blast Relief Panels
Blast relief panels, which open quickly during an explosion in order to reduce peak overpressures, must be carefully designed. It is unlikely that loosening of cladding panels will have the desired effect. A typical blast relief panel will have the following properties: It will be light probably of aluminium construction It will start to open at about 50 millibar or 0.05 bar (wind loads are usually a factor of ten lower) It must open quickly (within about 50 milliseconds) and stay open It must be located to open a clear vent path to prevent further flame acceleration occurring due to venting through a congested area.
These requirements will probably result in panels of mass/unit area less than 0.5 kg/m2 depending on the method of attachment. These issues are discussed further [16], [56] and [3]. Panels may be retained (e.g. hinged) if there is significant risk posed by them becoming missiles, otherwise they can be free of restraint.
3.8.10
Damage to Safety Critical Elements and Escalation Potential
Most SCEs should be designed to operate after the explosion event (e.g. escape routes, the TR and evacuation systems). The intention should be that these items survive an explosion event and maintain their functionality to prevent escalation. The specific explosion effects which an item may need to withstand are; static overpressure dynamic overpressure displacement effects strong shock (strong vibration) effects
Heat effects tend to be transitory and the thermal inertia of most items should ensure that thermal effects of the explosion event are negligible. Equipment on anti-vibration mounts may be displaced if the mount topples. If this is considered possible restrained mountings should be specified or sea fixings retained during operation. The smaller safety critical elements can either have enhanced support to withstand blast wind effects or be located near a bulkhead or structure where the wind effect will be low. This may be appropriate for fire and gas detection devices.
55
Flare/vent and firewater piping can be especially susceptible to blast forces since they are generally of low pressure design and therefore light-weight. Damage to flare/vent lines can result in large quantities of gas entering the module, especially as the installation will probably be being blown down at the time. This would lead to jet fires and possibly secondary explosions. Damage to firewater lines would result in the loss of fire control measures within the explosion zone. Means of protecting these lines will include and or all of the following: not running these lines near vent areas where blast wind forces will be high increasing the schedule of the lines to increase inherent robustness increasing pipework supports running these lines in the shelter of structural elements
Detailed guidance on the methods of designing for static and dynamic overpressure is given in Clauses 6 and 7.
3.8.11
Strong shock response
In an explosion event the forces acting on the structure will result in movement of decks and members. This displacement absorbs energy plastic by deformation and if it did not occur the structure could not survive [57, 58]. The result of this displacement is that initially; roofs/ceilings will move upwards decks will move downwards walls will move outwards
Subsequent to this will be the rebound effects as the structure then oscillates. These phenomena may occur in a wave as the overpressure moves through the module in a congestion dominated explosion. These displacements will have significant impacts on any items fixed to structural elements that are moving differentially to each other, for example, pipes that run from floor to ceiling, or run from a floor mounted vessel to the ceiling. Relative displacements can be considerable, 10s of centimetres, so that forces potentially acting upon items spanning structural elements can be large. As with all potential hazards the aim should be to avoid the situation occurring, that is, by avoiding arrangements where items are attached to floor and ceiling. This may not however be reasonably practicable. If this is so, sufficient resilience should be included in the design to accommodate the differential movement. This may be achieved using resilient mounts or by the building in of flexibility to the piping runs. Good design practice however should be employed to mitigate the consequences of this severe vibration, this involves; the location of vibration sensitive safety critical elements distant from potential explosion zones, especially not attaching them to common boundaries; the use of shock or resilient mountings to absorb vibration effects; additional restraints to items that may topple and cause damage or lose function, e.g. cabinets, bookcases; slack in cables where displacement of control or electrical equipment is possible.
56
Specialist products, shock mounts, are available from companies marketing anti-vibration equipment. Their advice should be sought before any mountings are fitted since, if the wrong product is installed, enhancement of the vibration effect can occur. The natural frequency of the mount must not coincide (within a factor of 2) with the natural oscillation frequency of the loaded floor. The structural design group should be able to estimate the approximate natural frequency of the structure at the mounting point so that the correct mount can be specified.
3.8.12
Missile Prevention
Secondary missiles are those picked up by the blast wind produced during an explosion. The blast winds can reach sonic speeds, therefore there is potential to move objects of a significant size. Maximum blast wind speeds are found around the edges of the module where explosion gases are venting. In most modules this is where escape routes are located so these are the areas where personnel are in most danger from impact from missiles, and being knocked over. The philosophy for minimising the potential for missile generation is to ensure general tidiness, especially in the hydrocarbon processing areas and areas adjacent to the TR. Small items such as fire extinguishers and items of safety equipment should be kept in cabinets firmly fixed to the structure preferably against a partition or structural member where blast wind will have little effect. There should be no loose items in the module, i.e. items that are not fixed to the structure or substantial equipment items. Maintenance equipment such as scaffold poles and tools should not be stored in process areas and should be removed when no longer required.
3.8.13
3.8.13.1
Explosion Mitigation Systems

General
Other mitigation systems that have been proposed include; inert gas barriers soft barriers micromist
3.8.13.2
Inert Gas
Inert gas can be used to dilute the flammable mixture by flooding the volume within which the gas has been detected, with for example CO2, N2. The explosive gas can then be taken below its lower explosive limit. This is most appropriate for enclosed volumes where the environment can be controlled. Care should be taken in providing such systems as they can pose a significant asphyxiation risk to personnel and they should be discounted if the overall risk of using them is greater than the explosion/fire risk saved. This might particularly be the case for generally manned areas. Inergen (CO2 + N2 + Ar) is an alternative inerting material but it has a volume 30 times that of Halon systems (now banned) which it may replace.
3.8.13.3
Barriers
Barriers can be used for five purposes; protecting areas behind the barrier from the overpressure effects generated in the explosion zone;
57
limiting the size of the explosion zone and thus the largest dimension over which the flame can propagate. limiting cloud spread to ignition sources limiting the number of people directly exposed
Blast walls have long been used to protect adjacent areas from the effects of overpressure. These walls are designed to absorb blast energy by displacement. There may be a partition wall (e.g. B15 partition) on the non-hazardous side which will move sympathetically with the blast wall, the air gap between the two acting as a spring. If the wall forms the boundary to a control area housing safety critical equipment the effects of this movement needs to be taken into account. That is, shock sensitive equipment should not be located along this wall unless it can be demonstrated that the effects will be negligible. By limiting the size of an explosive gas cloud the overpressure can be reduced. As long as confinement is controlled decreasing the size of a module by inserting barriers can result in a reduction in maximum flame path length and therefore a reduction in the overpressure generated. It is important that these barriers maintain their integrity and do not give rise to their own hazards by displacement and impacting on safety critical plant or by becoming missiles. Mitigation measures aim to protect personnel or equipment from the explosion event. Protection from the direct effects of blast can be achieved by the barrier method, that is, the intervention of a blast wall between the explosion zone and the area to be protected.
3.8.13.4
Soft Barriers
Progress is being made in the manufacture of the Micro-mist device[59] which has been tested as part of a recent joint industry project and consists of a cylinder of superheated water which is released quickly as a fine mist in response to pressure, flame sensors during an explosion. This device suppresses the explosion and has been shown to be successful in significantly reducing overpressures. Accidental activation of these devices is not a hazard to people.
3.9
Acceptance criteria
The objective of a fire and blast hazard management process is to reduce risks associated with potential hazards to a level that is ALARP. Tolerable can be defined in many ways. It can be related to specific quantitative targets as is the case in some legislative regimes, it can be related in part to cost (risks being reduced to a level that do not incur disproportionate costs) and an array of other criteria defined by legislation and/or corporate goals as part of internal safety management systems. One simple approach to defining risk [48] and hence identifying whether risk is tolerable is the use of risk matrices. These come in a wide variety of forms but provide a simple and effective means for design teams to assess the likelihood (probability of and event) and the severity (consequence). Generic definitions for likelihood and consequence can be easily established. This enables the risks to be semi-quantitatively defined (positioned) and offers a mechanism for mitigating measures to be evaluated (i.e. is likelihood or outcome reduced, by how much and what is the residual risk level). The method reviewed here uses logarithmic frequency and severity ratings which are added together to give a risk rating. These are added rather than multiplied because they are logarithmic representations of the actual frequency and severity.
58
Risk rating = Frequency rating + severity rating A simple example of the use of risk acceptance matrices is presented here. Risk is set at three levels by the matrix: A - risk is not normally tolerable additional controls/design changes required B - risk is tolerable with controls evaluate additional controls/design changes C - risk is tolerable. Table 3.5 Risk Acceptance Matrix Frequency against Severity Frequency Frequent Severe Severity Critical Substantial Marginal Negligible A A A B B Occasional A A B B C Infrequent A B B C C Unlikely B B C C C Rare B C C C C
FREQUENCY RATING (FR) or Likelihood: Each generalised hazard scenario, taking into account existing controls and including releases in all directions under all environmental conditions, ignition times and ignition location, may be ranked using a coarse system based on the frequency of the cause. It is necessary to consider a generalised frequency in this calculation as the frequency associated with a particular release direction under particular ventilation (wind) conditions is likely to be very small. This scenario specific frequency will not be representative of the general frequency of a late ignited release giving rise to a significant overpressure and will grossly underestimate the frequency rating and hence the risk. The frequency rating may be categorised using the following as a guide: Table 3.6 Frequency Rating (FR) Criteria Category Frequent Occasional Infrequent Unlikely Rare Annual Probability of Occurrence (/yr) > 10
-1
Frequency Score 0 -1 -2 -3 -4 Rating 5 4 3 2 1
More than once every 10 yrs Once every 10 to 100 yrs Once every 100 to 1,000 yrs Once every 1,000 to 10,000 yrs Less than once every 10,000 yrs
10-1 10-2 10-2 10-3 10 10 < 10

-4 -3 -4
The frequency score is effectively the logarithm of the annual probability of occurrence. The frequency rating is a normalized representation of the frequency score for use in the semiquantitative hazard assessment.
59
SEVERITY RATING (SR) or Consequence: Each release scenario, taking into account existing controls, the variability from ignition time and position under a range of environmental conditions may be ranked using a coarse system based on severity of the cause. Severity is assessed using the following guide. Table 3.7 Severity Rating (SR) Criteria Category Severity (safety, environment, asset) Large scale loss of life Large scale environmental impact Large scale loss of asset Loss of life of several persons Extensive environmental impact Major loss of asset Loss of single life or serious injury to several persons Significant environmental impact Significant loss of asset Severity 'Score' Rating +2 5
Severe
Critical
+1
Substantial
Marginal
Single serious injury or minor injuries to several persons -1 Minor environmental impact Minor loss of asset Single minor injury Little environmental impact Little loss of asset -2
Negligible
The severity rating is a normalized representation of the severity score for use in the semiquantitative hazard assessment. The assessment must consider the risk profile from all causes to satisfy the legislative requirements in particular relating to TR impairment.
3.10
Implementation and monitoring
Guidance on design activities is given in the procedures and design guides which should be readily available for consultation by the design team. Activities should be undertaken in line with these procedures. If practices are not in line with the written procedures then a review should be undertaken to establish which indeed is the correct practice and either the method of working, or the procedure, revised to suit this. In many cases it will be the efforts of a single person that will result in the quantification of the explosion hazard and resulting risk. It is essential that a checking procedure is instigated so that the work can be verified by a competent person. This should occur for all work produced.
60
Other means of monitoring and verifying the design include peer review. This may be achieved in a number of ways. It can involve additional review by an independent engineer or by presentation of the overall design (including explosion) to a group of independent engineers. Alternatively, it may involve the scrutiny of a proportion of the design output by persons independent of the project audit. This involves the checking of work by independent personnel against the procedures for that activity. Discrepancies may involve amendment of the design or the procedure to bring about compatibility. It will also aim to check that activities are carried out according to the project plan, that sufficient and competent resources have been allocated and all risks are being managed correctly.
3.11
3.11.1
Analysis methods
General
The risk category of the installation does not preclude the use of more sophisticated methods of assessment which may result in reductions in conservatism and hence cost, if they are considered more appropriate.
3.11.2
Low Explosion Risk Installations
Where the explosion risk category for the installation is low, the low risk methodology may be used. This applies not only to the definition of the explosion hazard but also to methodologies in handling the response of structures, piping, and other SCEs. A suitable low sophistication means of defining the explosion hazard is the use of valid nominal overpressures derived from previous assessments of similar structures. They may be used as the ductility level blast overpressures (DLB). Another acceptable means of overpressure derivation for low risk installations is comparison with a specific past cases. Such comparisons should be supported by evidence that a structured assessment has been undertaken to identify areas of difference and that the original means of calculation were sound. Extrapolation of data for the relevant parameters is not generally recommended but may be valid if a sound basis exists. The comparison process would incorporate consideration of the following factors: the validity of the model used in the initial assessment; the version of the explosion modelling software used; the resolution and precision of the grids used in the calculation; substantial physical differences between this and previous cases.
A comparative assessment method may be used drawing on experience from a demonstrably similar structure geometry and scenarios. The nomination of a typical installation to represent a family of platforms is acceptable.
3.11.3
Medium Explosion Risk Installations
Where valid nominal overpressures are available or past cases exist that are relevant, these values may be employed. However the premise is that the variables listed would be more closely analysed than might be the case for a low explosion risk installations or compartments, and no extrapolation of data allowed unless published data exists.
61
Where no nominal overpressure has been defined for the installation and there are no suitable past cases for comparison, then the level of analysis appropriate for high risk installations should be used for explosion hazard assessment. Medium risk methods are described in this Guidance which substitute for some of the tasks defined in the Higher risk methodology. The philosophy recommended in this Guidance is that for medium risk installations the choice of methodology for any particular task must be justified where it deviates from the higher risk methodology.
3.11.4
High Explosion Risk Installations
Where the potential risk level on an installation or within a compartment is high, this will warrant a commensurately high level of analysis. The ability of the installation and the safety critical systems on it to withstand explosion need to be accurately determined as any error could have a significant risk impact. This level of analysis would involve; A complete set of explosion scenario investigations CFD simulations of gas dispersion, zonal models, the Shell DICE model or the workbook approach [39] if it can be justified. Determination of equivalent stoichiometric cloud size [12] . A combination of CFD and phenomenological explosion simulation with generation of exceedance curves representing frequency of overpressure exceedance. Determination and assessment of the structure and SCEs against the SLB and DLB design explosion loads including blast wind dynamic pressures. Dynamic possibly non-linear modelling of the installation and systems response. Explicit consideration of escalation and interaction between fire and explosion scenarios including the collapse of tall structures and the external explosion. Consideration of strong shock and missile generation by the explosion.
The treatment of uncertainties is discussed briefly in Subclause 2.3 of the Main Guidance and Subclause 5.6.7 of this document. Appendix C gives by way of checklists the issues which should be considered for low medium and high risk installations. These checklists are taken from Reference [22] the Genesis Explosion assessment guidelines. Table 3.8 indicates appropriate methods of analysis by risk category for the installation.
62
Table 3.8 - Appropriate assessment methods Task 1. Installation screening 2. Scenario definition Low risk High risk - additional activities2 This task determines the risk level of the installation Medium Risk1
3. Preventcontrol-mitigate 4. Explosion load determination
4. Explosion load determination (continued)
Consider worst case Consider a number of Consider ingress of gas from scenarios apply release scenarios neighbouring modules and practical limiting with their associated dispersion/ventilation factors to arrive at frequencies. characteristics design credible event Consider a number of Consider external explosions Consider and justify ignition source use of previous or similar assessments positions by use of design basis checks.assessment complete if satisfactory. Calculate release rates and durations All risk levels should consider the options of hazard elimination, control and mitigation primarily by reduction of the frequency of an ignited release then by limitation of immediate and escalation consequences Categorise SCEs determine criticality 1 and 2 SCEs Consider representative leak Consider design Consider design directions. credible event. Use credible event. Use appropriate nominal appropriate nominal overpressures and overpressures and durations durations. Calculate cloud evolution Calculate equivalent Calculate equivalent using CFD dispersion stoichiometric cloud cloud sizes from simulation for representative size. dispersion handbook wind speeds and directions. approach. Determine Calculate ignition probability Determine overpressure peaks time history. overpressure peak and durations. and duration DLB only Consider intermittent ignition Calculate dynamic Calculate dynamic sources and time history of overpressures on overpressures on cloud geometry giving worst Criticality 1 & 2 Criticality 1 SCEs. ignition time at maximum SCEs. Use 1/3 of Use 1/3 local peak equivalent stoichiometric local peak overpressure if cloud size. values not available. overpressures for DLB Criticality 1 and SLB if values not available.
63
Task
Low risk
Medium Risk1 Calculate exceedance diagrams for overpressure and dynamic pressures. (Simplified 1 point method acceptable). Determine SLB and DLB overpressures and dynamic pressures. Determine far field, blast wave effects Identify and assess escalation targets. Idealise load time histories nontriangular idealisations possible. Check primary and secondary structure response to DLB and SLB loads using modified code checks. Check deflection and rotation limits for DLB. Equivalent static loads allowed if justified. If required check primary and secondary structure to DLB using nonlinear dynamic analysis. Non-load bearing barriers, cladding and their connections may be checked for DLB using simplified methods (Biggs) if ductilities less than 5 are expected. Check integrity of penetrations.
High risk - additional activities2 Calculate exceedance diagrams for overpressure and dynamic pressures.
Determine SLB and DLB overpressures and dynamic pressures from exceedance curves.
5. Assess integrity of structure and other SCEs
Identify and assess escalation targets. Idealise load time histories nontriangular idealisations possible. Check primary and secondary structure response to DLB using modified code checks. Check deflection and rotation limits for DLB. Equivalent static loads allowed if justified. Check SCEs barriers and connections to DLB.
Use full load-time histories.
Check primary and secondary structure response to DLB and SLB loads using modified code checks. Check deflection and rotation limits for DLB. Dynamic analysis required.
If required check primary and secondary structure to DLB using non-linear dynamic analysis.
5. Assess integrity of structure and other SCEs (continued)
Non-load bearing barriers and cladding may be checked for DLB using simplified methods (Biggs).
Non-load bearing barriers, cladding and their connections and supporting structure may be checked for DLB using simplified methods (Biggs) if ductilities less than 5 are expected. Otherwise use NLFEA.
64
Task
Low risk
Medium Risk1 Check SCEs criticality 1 to DLB and SLB using dynamic pressure loads. Check SCEs criticality 2 to SLB using dynamic pressure loads. Verify that life safety risk is acceptable. Verify that the installation satisfies high level performance standards. Determine if the SCEs satisfy element specific performance standards. Determine if ALARP has been satisfied.
High risk activities2
additional
6. Evaluation
Verify that life safety risk is acceptable. Verify that the installation satisfies high level performance standards. Determine if the SCEs satisfy element specific performance standards. Determine if ALARP has been satisfied.
Verify that life safety risk is acceptable. Verify that the installation satisfies high level performance standards.
Determine if the SCEs satisfy element specific performance standards.
Determine if ALARP has been satisfied.
Notes 1. Medium risk methods which substitute for some of the tasks defined in the Higher risk methodology. The philosophy recommended in this Guidance is that for medium risk installations the choice of methodology for any particular task must be justified where it deviates from the higher risk methodology. 2. For high risk installations, all the tasks from low and medium risk methodologies should in principle be considered in addition to those listed.
3.12
3.12.1
Existing installations
General
In the UK sector of the North Sea, it is a requirement (SCR) [30] that significant changes in an installation or its operation will require the Safety Case to be resubmitted which should address a review of hazards including a re-will require an assessment including those due to explosion hazards. Even if an installation has not been modified or its use has not been changed an assessment may be required to take account of advances in methodology, every three years when the Safety case is required to be updated (triennial submission). Existing mobile installations entering UK waters will also require assessment. The assessment of existing structures differs from the assessment of a structure during design in three important respects.
65
1. 2. 3. There is relatively little scope for the reduction of the frequency of a release and scope for mitigation of the severity of an explosion may be limited. Intervention may give rise to an additional hazard which must be assessed. Information may be available relating to expected explosion loads, structural and equipment response from the detailed design stage of the design and construction project.
Information should be available from the Safety Case, the original CAD and structural computer models of the facility. The Individual Risk (IR) per annum TRIF and PLL will have been used in the demonstration of ALARP in the existing Safety Case for the installation. Use may be made of experience gained from the operation of the un-modified installation and from similar installations. The computer data files and design reports should be checked to confirm that they are a faithful representation of the present state of the facility. Should modifications be necessary to improve the safety performance of the facility, then the work to be undertaken should not in itself pose such hazards and risk to personnel that this compromises the gains to be achieved by such modifications. All modification work should be accompanied by hazard identification, assessment and other controls as determined by the Safety Management system as well as method statements for their implementation. All temporary structures and equipment used during the modification work should be removed as soon as the work is complete. The HSE reference [40] states It should be borne in mind that reducing the risks from an existing plant ALARP may still result in a level of residual risk which is higher than that which would be achieved by reducing risks to ALARP in a similar, new plant. Factors which could lead to this difference include the practicality of retrofitting a measure on an existing plant, the extra cost of retrofitting measures compared to designing them on the new plant, the risks involved in installation of the retrofitted measure (which must be weighed against the benefits it provides after installation) and the projected lifetime of the existing plant. All this may mean, for example, that it is not reasonably practicable to apply retrospectively to existing plant, what may be demanded by reducing risks (to) ALARP for a new plant (and what may have become good practice for every new plant). The overall individual risk and the TR impairment frequency (TRIF) from all hazards must still be less than 10-3 per year. If risks are in this intolerable region then risk reduction measures must be implemented, irrespective of cost. The tasks to be performed are listed below with references to the sub-clauses where a detailed treatment is given. For existing installations the Explosion Hazard Review is and additional activity. The checklists described previously and located in Appendix C, are applicable to the assessment of existing structures. An explosion hazard review may be necessary in the case of an existing installation.
66
3.12.2
Explosion hazard review
Review of explosion risk for existing installations, poses a number of difficulties. These problems generally relate to the difficulty in retrofitting structure and equipment in modules that are operational and congested, with the usual constraints in working in a cramped offshore environment. There may also be a problem accessing design data which should include modifications that have taken place since the facility was installed. The implementation of effective change procedures is essential in these circumstances. Before investigating the ability of the systems on the installation to withstand the blast effects, the facility should be reviewed with regard to the level of inherent safety that exists and what additional control mechanisms there may be for overpressure reduction. The existing wells may be operating at a lower reservoir pressure than originally designed for, however subsequent tie-ins may have offset this possible benefit. For an existing installation there may be potential for: increased venting additional and/or improved gas detection (acoustic gas detection) introduction of flame detection lowering the level at which gas detection initiates executive actions voting for executive action on a single detector initiation of deluge on gas detection the removal of redundant equipment the relocation of equipment blocking vent paths vibration reduction enhanced robustness of small bore connections use of past operational experience improved inspection/maintenance regimes
Some of these actions may not necessarily result in a reduction of calculated Individual Risk or loss of life (as shown in the QRA) but this should not be a reason for failing to undertake modifications if actual reduction in explosion risk can be foreseen. Ideally, there should be no disproportionate contribution from any one hazard to the risk associated with the installation. For example fire and explosion hazards should contribute to the total risk at levels comparable with those for a similar installation. This is referred to as the balanced risk contribution principle. The general philosophy should be to bring all critical SCEs up to a similar level of integrity for all accidental events. These critical systems include but may not be limited to: the TR escape routes to the TR evacuation systems systems that could threaten the integrity of the above systems, e.g. ESDVs isolating offsite inventories.
67
In effect the list may include all the identified safety critical elements but, with respect to the ability to muster, assess and evacuate, some safety critical elements may be in criticality levels 1, 2 or 3.
3.12.3
Use of previous analyses
A review will need to be undertaken of the ability of safety critical systems to withstand overpressure/drag effects. Whilst increased knowledge of the explosion phenomenon has resulted in a general increase in the overpressure loadings that are calculated for a given configuration, it is frequently the case that the integrity of systems is greater than originally assumed. The experience of the JIP full scale tests [9,10, 50] tended to confirm this in that damage incurred was significantly less than might have been expected for the high overpressures experienced. Where it is clear from preliminary inspection that it will be impracticable to meet maximum overpressures that may arise, there would seem to be little to be gained in determining to the last degree of accuracy what the actual overpressure characteristics will be. Simpler phenomenological models or comparison with similar installations would be adequate for the purposes of quantifying the residual risk. (Note: Schedules 1-3 of the SCR [30] imply that some form of overpressure calculation will be necessary in order to quantify the risks involved in mustering within the TR. The need to determine potential for TR damage would then seem to be necessary.) The aim should be to bring the design up to the same level of integrity for all major SCEs with the presumption that more effort should be made where the level of risk from explosions is high. Existing installations will have QRA data from which explosion risk can be determined. Where this is high for explosion events the premise should be that greater cost is justified in providing mitigation and protection than where the risk posed is relatively low. A means of determining the cut off point for additional mitigation would be to determine the costs involved with design enhancement to achieve integrity for successively increased overpressure values. Where a significant cliff edge occurs this may indicate that design beyond the base of the cliff edge is not reasonably practicable and that design to this level is ALARP. The accepted level above which the overall risk is considered intolerable relates to an individual risk of greater than 10-3 per year or a TR impairment frequency of greater than 10-3 per year. The overall individual risk from all hazards must be less than this value. If risks are in the intolerable region then risk reduction measures must be implemented, irrespective of cost. Hence the risk from other hazards may indirectly affect the acceptability of risk from explosions and these may need to be considered in setting the target risk levels for the explosion hazard. Where the original design took account of explosion overpressure, but latest knowledge indicates that this needs to be reviewed, then recalculation and assessment will be appropriate. The calculation of overpressure should however be reasonably straightforward if the original CAD model is available and has been updated to include changes made since the design stage.
68
4
4.1
4.1.1
INTERACTION WITH FIRE HAZARD MANAGEMENT

Overview fire and explosion hazard management
General
This clause reviews the explosion management tools highlighted in other clauses, and highlights areas where interaction and conflict exists between these and aspects of fire management. Further information may be found in the basis document for this Clause [17]. This clause is a link between Part 1 of the Guidance and Part 2 which deals with the avoidance and mitigation of fires. The late ignition of a hydrocarbon release will allow a flammable gas or vapour cloud to develop and could give rise to an explosion. The early ignition of a release will normally result in a fire. In fact 80% of ignited releases have been observed to result in fires[26]. The approach is to assess the fire risk, assess the explosion risk and manage accordingly. Where any conflict exists between explosion and fire management it is the latter which will tend to take priority, however the optimum solution will generally be a balance between the two. The object of this clause is to aid assessment of this balance.
4.1.2
Generic scenarios combined fires and explosions
A fire that becomes ventilation controlled may give rise to a cloud of unburnt fuel, which on contact with the oxygen rich atmosphere outside a compartment may lead to a secondary explosion. Fires may also cause escalation when in contact with vessels and piping through further release of inventory that is subsequently ignited. The release of inventory may be sudden as in vessel rupture giving rise to a BLEVE (Boiling Liquid Expanding Vapour Explosion) or a secondary vapour cloud explosion. Some jet fires may become unstable either by flowing too fast for the flame to remain within the envelope of the release or through ventilation limitation leading to self-extinguishing of the flame. This could give rise to the accumulation of a vapour or gas cloud leading to an explosion on ignition or a secondary fire near a source of oxygen, near the vent. The most common scenario is when an explosion gives rise to secondary fires due to vessel or piping rupture, subsequent release of inventory and ignition. The severity of many of these events may be limited by immediate and rapid, active reduction of inventory (blow-down) or by segmentation of the inventory into isolated sections following gas, heat or fire detection. The consequences of combined fire and explosion scenarios with either component occurring first should be considered in the structural design or assessment. A blast wall may deform or bow in direct contact with flame but this should not be a problem for a wall designed to deform in a ductile way. Columns of the primary structure may be significantly weakened by this effect. Combined blast and firewalls are available. Blast walls will generally have good fire performance in isolating heat sources from their targets. Their performance as fire walls is not usually adequate from the point of view of limiting the temperature of the cold face, the design can usually be adjusted to accommodate this requirement.
69
4.1.3
Temporary and soft barriers
It may be possible for a fire or explosion barrier to be present only when required. Water curtains and drop down blast walls have been used. Water curtains will reduce the radiation from a fire and can be used to protect escape-ways. Progress is being made in the manufacture of the Micro-mist device[59] which has been tested as part of a recent joint industry project and consists of a cylinder of superheated water which is released quickly as a fine mist in response to pressure, flame sensors during an explosion. This device suppresses the explosion and has been shown to be successful in significantly reducing overpressures. Accidental activation of these devices is not a hazard to people.
4.2
4.2.1
Common areas
Leaks and ignition
Explosions, jet and pool fires are various forms of the same fire phenomenon. To initiate a fire of any sort, fuel, air and ignition are needed (the fire triangle). These are thus common requirements. Being common factors all management methods employed to eliminate any or all of these features will be effective with respect to fire and explosion. All management techniques and inherent safety features proposed for eliminating or minimising leaks or ignition potential are therefore valid for both fire and explosion management.
4.2.2
Removal of personnel from consequences
Removal of personnel from proximity to process areas will similarly benefit risk reduction for both fire and explosion events. Far field effects can be experienced by propagation of the sonic blast wave away from the explosion zone which may exceed the far field impacts from fire, depending on pressure and leak size. However the general goal to remove personnel from processing facilities will benefit risk from both fire and explosion.
4.3
Considerations by design phase
Management of fire and explosion continues through the lifetime of the installation from Concept Selection until Decommissioning. This sub-clause gives an overview of the considerations of inter-dependencies in the management of the two phenomena at various stages in this process. Corresponding to the fire triangle is the explosion hexagon. The latter includes fuel, oxygen and ignition but also includes pre-mixing, congestion and confinement. Conflict with fire management is likely to occur in these latter areas.
4.3.1
Concept Selection
The aim at this stage is to select a concept where risk to personnel and the environment is inherently low, this tends to give preference to concepts where; the number of potential leak sources and ignition points is low number of persons exposed to major hazards is low.
Management of both fire and explosion risk at this stage is similar. It is necessary to ensure that escalation potential is low.
70
4.3.2
4.3.2.1
Front End Engineering Design (FEED)

General
Parameters defined at this stage of design include; key philosophies installation orientation deck sizing general layout fire area definition and deluge/firewater pump sizing
4.3.2.2
Key Philosophies
Key philosophies will include HS&E, piping and instrument philosophies. These should include the setting of safety goals and the methods of identifying hazards and controlling risk. They should aim to promote inherent safety features and the minimization of leak potential by minimization of connections and intrusive instrumentation. All these features are consistent with the management of fire and explosion.
4.3.2.3
Installation Orientation and Natural Ventilation
One significant fire consideration with respect to ventilation control, is that relating to smoke. Is it better to allow smoke to vent from the immediate fire area to allow escape, or should it be contained to prevent migration to the TR or evacuation facilities. Since smoke is generally the major cause of fatality in fire events it is preferable to make its passage towards the TR as difficult as possible but otherwise allowing it to disperse. Orientation of the installation to minimise smoke logging (and gas ingress) potential to the TR will tend to result in the TR being upwind of the process areas with respect to prevailing conditions. This is not generally the optimum orientation for natural ventilation. As stated elsewhere in the guidance natural ventilation considerations generally are subservient to the smoke and gas ingress hazard concerns and operational factors when determining the orientation of installations with a TR.
4.3.2.4
Deck Layout
Deck sizing is determined largely by the amount of equipment to be installed. Due to cost constraints, especially in deeper water areas, the tendency is to minimize topsides area and therefore jacket size. FPSOs and single deck installations have large continuous equipment areas. Congestion generated overpressures generally increase with distance travelled by the flame front. Layouts that aim to achieve a minimisation of potential flame path length by deck sizing and aspect ratio should not significantly impact fire risk. The main interaction comes in the location and type of boundaries between adjacent areas, which generates confinement issues.
4.3.2.5
Confinement
This is probably the main area of difference in management between fire and explosion hazards. It is generally the philosophy to contain fires within the immediate area of initiation to
71
minimize escalation potential and to discourage the movement of smoke to muster and evacuation areas. This is achieved by the inclusion of fire barriers. These barriers include fire rated decks as well as walls. It is generally the case when managing the explosion hazard that areas are kept unconfined, although this is not always so, for example in the use of partitions to minimize potential gas cloud volumes. Grating would normally be used to disperse gas clouds but this may lead to liquid fuel migrating to decks below. Apart from trying to limit the escalating potential of fires, a major aim of this compartmentalisation is often to limit the fire to an area where the consequences can be mitigated by firewater. For medium and large installations it is not usually practicable to size a firewater pump to deluge all areas simultaneously, the pumps (including stand-bys) would tend to be unreasonably large and expensive. A compromise is generally sought between the size/cost of the pumps and the practicalities of adding fire divisions. Confinement can cause ventilation controlled fires which produce more smoke and carbon monoxide due to incomplete combustion. External flaming may occur which can impact escalation targets and transfer smoke nearer to safe areas such as the TR.
4.3.3
4.3.3.1
Detailed design
General
In detailed design the considerations are focused on the finer points of the installation and the full specification of control systems. With respect to fire and explosion management this will include; pipe routing passive fire protection specification ESD and F&G design severe vibration impact design of firewater and vent/flare Lines
Firewater piping systems, vents and flare lines are generally fabricated from low pressure, low strength, lightweight piping. Their relative fragility however leaves these systems vulnerable to explosion damage if exposed to high drag or relative displacement induced forces. Significant damage may then leave the installation exposed to fires that result from process damage following an explosion. Reference [60] is a good starting point for the assessment of equipment against fire attack.
4.3.3.2
Isolation of Offsite Inventories
Inventories beyond the topsides process, e.g. export lines and flowlines from remote wells, are often significantly larger than that of the process itself. It is important that, following any significant release, the platform can be isolated from these inventories to minimise fire escalation potential. Riser ESD valves are installed for this purpose. It is important that, after the explosion, these valves can close if they have not already done so. In order to ensure this it is important that the valve, spindle and actuator are not distorted in the explosion event. The valve vendor should be able to advise the overpressure which the valve actuator can withstand without loss of functionality. It is necessary to confirm that it will withstand the dynamic as well as static overpressure. Explosion proof enclosures or blast walls may be installed to protect the valve system. Issue 1, October 2003
72
Generally, ESD valves should be fail closed ensuring that damage to the initiation mechanism results in closure. If not, protection should be applied to the actuation system so that functionality is assured following an explosion event. By contrast all blowdown valves should generally be fail open, if not, protection should be applied to the actuation system so that functionality is assured following an explosion event.
4.3.3.3
Gas Ventilation Systems
Detection systems may be considered to fall into Criticality class 2 as they will have fulfilled their function prior to the DLB event. They should however remain operable during and after an SLB event.
4.3.3.4
Severe Vibration and Displacement
Explosion induced vibration will propagate throughout the structure to some degree [57] . In the Cullen report[61], it was reported that a number of witnesses spoke of the severe vibration associated with the initial explosion. People were thrown off chairs and knocked over. In the worst cases this vibration may be capable of damaging control systems. These control systems are usually configured to fail safe so that, for instance ESDVs close and blowdown is initiated. Outputs that do not fail safe will commonly fail as is meaning that ESD valves do not close, blowdown valves cannot be opened, firewater pumps will not be started automatically and active fire protection may be delayed or lost. Severe vibration or blast wind may result in dislocation of instrumentation such as fire detection/CCTV devices such that it makes monitoring of subsequent fires uncertain. These devices may also be damaged by the vibration itself, i.e. acceleration forces. Robust fixing of these instruments should prevent movement, but they should be located where drag forces will have little impact. Each safety critical element should be reviewed with respect to severe vibration. Resilient or special shock mountings may be specified as recommended by the specialist vendors to mitigate these effects. Fire control/ESD systems should not be placed on or close to boundaries and blast walls that will experience significant movement in a blast. This will include blast walls which are designed to deflect and absorb explosion energy. Differential displacement between modules and displacement of module boundaries (walls or deck) may place high loads on to firewater and vent/flare pipework. Flexibility should be built into these pipework systems to accommodate these movements such that active fire protection is not lost and vent/flare lines maintain functionality. Similarly fire protection control measures may be inhibited by loss of signal due to cable failure following displacement forces. Suitable slack should be also incorporated in critical cabling systems to accommodate predicted displacement.
4.4
4.4.1
Special issues relating to installation type

Integrated Platforms
For FPSOs and other single deck installations, fire, blast and missile barriers would only be used to protect items of large or particularly hazardous inventory. For fire area segregation walls will usually be impractical as flames can extend over the barrier and set off deluge in the
73
next area. Should high barriers be considered their impact on area confinement and natural ventilation should be assessed. On some integrated platforms, partitioning may have explosion benefits even though confinement is increased. Partitioning may be used to limit the maximum size of the flammable gas cloud and actually reduce the maximum overpressure experienced. This would then reduce fire area size and may provide some benefit in firewater pump sizing.
4.4.2
FPSO Raised Decks
The area between the storage tank tops and the process deck on FPSOs is a particular arrangement where high overpressures can be generated. The horizontal distance is long and the confinement in the vertical directions is high. It is usually necessary to include as much free area in the process deck as possible by incorporating grating. This will permit vertical venting along the potential flame path and also promote natural ventilation to limit explosive cloud size. The disadvantages of grating are: process fires can impact the tank tops and tank deck piping through the grating; process gas leaks can be directed through the grating to produce an explosive cloud in this narrow space; liquid process leaks fall through the grating and run off the tank tops and into the sea, giving an environmental impact.
These disadvantages must be weighed against the consequences of an explosion confined between plated decks. The potential for liquid spillage incidents to escalate to the cargo tanks via the main deck is reduced whilst maximising interdeck ventilation by the following choices for the process deck [62]. Separation - bunded skids are used for each package to confine liquid spillage Gas Compression - plated deck to minimise ingress of gas into the interdeck area Fuel Gas area - normally grated to maximise ventilation Utilities - grated to maximize ventilation.
4.4.3
Existing Installations
Removal of boundary walls or the addition of vents to mitigate explosion overpressure in previously enclosed modules can lead to additional fire risk or ignition frequency. Removal or breaching of solid boundaries may extend hazardous areas beyond the original limits [35]. Extended hazardous areas may then encompass unrated equipment or impinge on enclosed non-hazardous areas where additional provisions may be necessary such as the installation of air locks at access points or the relocation of HVAC intakes.
4.4.4
Barriers
A compromise has to be sought between increased overpressure due to confinement and: barriers to protect specific items of equipment and people, barriers to limit firewater pump size/cost;
74
barriers to prevent environmental spills; barriers to limit the extent of hazardous areas, cloud spread to ignition sources; decreased congestion generated overpressure due to flammable cloud size reduction. Table 4.1 Barriers for fires and for explosions Fire Explosion
Fire carries the highest risk to personnel, Poor explosion management can lead to fire particularly smoke scenarios via escalation Barriers limit escalation by preventing spread Barriers give confinement and may increase of fires and smoke and protecting specific overpressure items of equipment and people. Barriers between fire areas limit firewater Barriers will limit natural ventilation pump sizing Barriers can limit gas cloud size and cloud spread Removal of barriers on existing plant may impact hazardous area designation Barriers to prevent environmental impact
4.4.5
Congestion
Congestion which generates high explosion overpressures is generally that from the large number of small elements within the module. This will have little impact on fire management except that high levels of congestion would suggest a high potential for escalation in a fire event. On an offshore installation equipment is always in close proximity so fire escalation should be catered for in any case by ESD and depressurisation which will to some extent limit explosion hazard. Firewater pipework can be a contributor to additional congestion and therefore higher overpressures. Protecting these lines by locating against structural elements would mitigate this effect.
4.5
Potential areas of interaction and conflict
Potential areas of interaction and conflict between fire and explosion management are; explosion damage to PFP the suitability of deluge for explosion mitigation; following on from the possibility of the introduction of new ignition sources the rate of area coverage required for optimum explosion mitigation; the damage that explosions can do to lightweight firewater piping thus compromising its ability to fight subsequent fires; extinguishments of a jet fire may result in an explosion; the delay between firewater initiation and its arrival, this is critical for explosion management;
75
the amount of firewater that can be delivered relative to potential gas cloud dimensions;
4.6
Explosion damage to passive fire protection (PFP) Systems
Passive systems provide a reliable means of fire management since they do not depend on any control systems for initiation, being available at all times. PFP rated for jet fires will tend to have a higher degree of mechanical integrity since they must withstand the erosion forces of the ignited jet. However, explosion forces will place more extreme loads on PFP and its substrate [63,64]. In an explosion the forces exerted on the structure and equipment in the blast zone can generate large deflections/distortions in the structural substrate which can result in cracking of the PFP, opening of the joints, delamination or even loss of the material entirely from the surface. Most companies marketing intumescent systems have tested their products in blast conditions with the materials generally maintaining integrity in a blast of about 1.5 bar [63] . Such data should be sought from prospective PFP suppliers to aid assessment of explosion risk. However care needs to be taken in using this data as it is the deflection of the substrate which is likely to be more important than the headline overpressure figure. Cladding materials should be rigidly fixed as blast winds at high velocity potentially have the power to displace them exposing insulation material beneath which may not then be able to withstand jet fire impact. A review of the response of PFP to explosions is given in Reference [63] and [64].
4.7
4.7.1
Use and effectiveness of deluge

Firewater deluge
Firewater deluge has historically been used to prevent process or structural failures by its cooling action or, with foam, to attempt to extinguish liquid process fires. Credit for deluge has been taken mainly for its cooling effect, rather than as an extinguishant since in some rule sets it has only been credited with about a 50% success rate in extinguishing hydrocarbon pool fires and very little in extinguishing hydrocarbon jet fires. These are probably pessimistic assumptions since recent work [65] has indicated some success of deluge in extinguishing or significantly reducing the impact of jet fires. There exists some experimental evidence that low expansion foam, delivered to an area deluge systems may mitigate congestion (flame acceleration) dominated explosions.
4.7.2
Suitability of Deluge
Tests have shown that area deluge coverage is suitable for explosion mitigation where high flame speeds are generated, i.e. in high congestion areas. The large droplets in the deluge spray are broken up by the momentum of the flame to give droplet size suitable for quenching the flame mechanism. Deluge is not however suitable for mitigation of completely confined explosions and, due to the additional turbulence generated, may actually increase overpressure. The size of droplet from standard MV (medium velocity) and HV (high velocity) deluge nozzles will be suitable for both fire and explosion control. Deluge is not an effective management tool when applied as specific equipment protection, e.g. to a process vessel, since the area of influence is so limited. For maximum benefit it should be provided as general area coverage. Deluge curtains can be useful in slowing flame acceleration in large modules to prevent flame speeds accelerating to extreme levels.
76
There is always the possibility that the application of deluge may generate extra ignition sources if acting on unsealed electrical equipment and in particular lighting units. If lighting seals are routinely replaced at the same time as expired light bulbs then the impact of this will be reduced or eliminated.
4.7.3
Rate of Deluge Coverage
The minimum deluge rate for general process area coverage as recommended in ISO 13702 [34] is 10 l/min/m2. Full-scale tests undertaken as part of the Phase 2 JIP [9] investigated coverage in the range 13 to 21 l/min/m2. This showed an increasing benefit of deluge in reducing overpressures as area coverage rate increases, however the increase in benefit between these values is slight. The usual general area coverage rate of 10 l/min/m2 (even with 15% added for hydraulic imbalance) falls outside the rate tested. If explosion mitigation is considered critical a deluge flow rate of at least 13-15 l/min/m2 is recommended for general area coverage.
4.7.4
Firewater Extinguishing of Jet Fires
Initiation of deluge on fire detection is general practice where firewater systems are installed. For gas fires the aim is not to put out the fire but to cool equipment and the structure to prevent escalation. Recent research[65] however has shown that deluge can successfully extinguish some jet fires. This would then result in gas cloud accumulation where previously the gas had been burning. The potential for explosion is then high, especially as hot surfaces will have been created by the initial fire which can then act as ignition points. Any subsequent explosion should however be attenuated by the firewater deluge generally will continue to run. Unless special circumstances exist, the fear of extinguishing a jet fire should not result in any decision not to activate deluge since the initial jet fire is likely to hold the highest risk potential. Special circumstances may occur where an installation is particularly susceptible to blast (even at the deluge attenuated level) and where fire scenarios are short lived due to inventory depletion with low escalation risk.
4.7.5
Deluge Delay
There will inevitably be a delay in the supply of deluge to the module, this is caused by; delay in detecting the gas cloud delay in starting the firewater pump driver delay pressurising the system (if no jockey pump is used) delay in flowing water to the nozzles.
The total delay may be in the region of 60 to 90 seconds. If ignition of the flammable cloud occurs within this time there will be no explosion mitigation by deluge. For fires this delay can still be significant, but a delayed supply will still provide considerable benefit especially for cooling where direct jet impingement has not occurred. Until deluge coverage occurs the module is susceptible to full overpressures. Time delay can be minimised by: rapid detection of the gas cloud. Acoustic leak detection is likely to give quicker detection, especially as it does not need to be in the hazardous cloud to detect the release;
77
reduction in the gas detection level at which deluge is initiated; employing a pressurised ring main with jockey pump; minimising the distance from the deluge valve to the furthest nozzle (consistent with suitable location of the deluge valve for manual initiation); the use of more than one deluge valve to minimise distance between the valve and the furthest nozzle.
4.7.6
Flammable Gas Cloud Dimensions
An approach in dealing with large areas, such as the decks of FPSOs, is to size the firewater pumps to deluge any single fire area and a set of water curtains throughout the process areas. Deluge would then be applied to the fire zone where initial gas detection takes place with water curtains supplied simultaneously. The water curtains may arrest flame front acceleration as it propagates through the process area and thus limit maximum overpressure [9] but they may inhibit through ventilation and encourage re-circulation and mixing.
4.7.7
Deluge Initiation as an Ignition Source
In the past fears have been expressed that deluge initiation upon detection of a gas cloud may increase the probability of that cloud being ignited. This may be due to: static charge generated by the deluge water flow at the nozzle; sparking due to water ingress into electrical equipment.
Studies [51] have shown that the static potential caused by deluge flow is negligible compared with that necessary to ignite a gas cloud. There is no evidence that, for a properly designed and maintained installation, there will be significant risk of ignition from deluge interaction with electrical plant. Electrical plant should however be designed with suitable IP ingress rating to cater for deluge. For existing plant this may be a problem unless seals are routinely replaced at the same time as expired light bulbs.
4.7.8
Firewater on Small Installations
Addition of firewater to a small installation to mitigate fire and explosion will raise maintenance requirements and visit frequency thus increasing the exposure of operators to hazards from the installation. The question to be answered is whether the increased exposure to hazards from more frequent visits is compensated by the protection and mitigation effects of deluge both for fire and explosion and subsequent escalation. For NUIs, firewater systems are frequently not installed because overall risk is increased due to the increased hazard exposure from additional maintenance burden. This situation is unlikely to change unless explosion risk is high. Suitable arguments will need to be put forward to justify the chosen arrangement, by comparison of risk with and without deluge/firewater provisions.
78
4.7.9
Summary of deluge considerations

Table 4.2 - Deluge Considerations For Fire For Explosion Increase General Area Coverage flow to 15 at least l/min/m2 (10 l/min/m2 would still be expected to provide benefit) Specific equipment protection has negligible attenuation effect on overpressure Explosive gas cloud may cover a number of fire areas which cannot be deluged simultaneously Delay in receiving deluge will negate any potential benefit if ignition occurs before spray is applied. Cannot rely on deluge to be active when ignition occurs (delay and reliability issues) Deluge pipework needs to be protected from explosion drag effects Deluge pipework needs to be protected from differential movement/displacement of decks and structures
General Area Coverage of not less than 10 l/min/m2 Specific equipment protection can prevent escalation Firewater capacity generally linked to largest fire area Deluge protection at normal rates is not usually effective for jet fire impingement. Deluge may extinguish fire and give rise to explosion but subsequent overpressure then attenuated by deluge Deluge should remain functional to fight fires after explosion event
4.8
Operational issues
Management for fire and explosion risk in operation is similar, centred on inspection, maintenance, and Permit To Work controls. The aims are to prevent degredation of the hazardous inventory containment system and potential ignition sources, threats to the systems are scrutinised (e.g. corrosion, erosion, vibration) and that proper procedures are followed in undertaking any interventions. Change control is also critical in managing the impact of modifications over the life of the installations.
79
5
5.1
5.1.1
Derivation of explosion loads

Introduction to explosion load determination
General
This clause is based on the basis documents References [18], [19] and [66] and describes the process of derivation of explosion loads. These basis documents contain more detailed information on the topics addressed in this clause. Gas explosions can be defined as the combustion of a premixed gas cloud containing fuel and an oxidiser that can result in a rapid rise in pressure. Gas explosions can occur in enclosed volumes such as industrial process equipment or pipes and in more open areas such as ventilated offshore modules or onshore process areas [67] . For an explosion to occur a gas cloud with a concentration between the Upper Flammability Limit (UFL) and Lower Flammability Limit (LFL) must be ignited. The overpressure caused by the explosion will depend, amongst other things, on: 1. The gas or gas mixture present 2. The cloud volume and concentration 3. Ignition source type and location 4. The confinement or venting surrounding the gas cloud 5. The congestion or obstacles within the cloud (size, shape, number, location) For stoichiometric hydrocarbon gas clouds, filling a closed volume initially at atmospheric pressure, combustion without heat loss will result in overpressures of close to 8 bar. This pressure rise is mainly due to the temperature rise caused by the combustion process and is generally not dependant on the congestion within the volume. This type of explosion is referred to as confined. A stoichiometric air/fuel mixture is such that it contains exactly the required amount of oxygen to completely consume the fuel. Gas explosions in more open environments can also lead to significant overpressures depending on the rate of combustion and the mode of flame propagation in the cloud. All of the above points from 1 to 5 can affect the explosion overpressures in this type of environment. If the rate of volume generation within the explosive region is greater than the ability of the vents to release this volume then the overpressure will continue to rise. Two types of explosion can be identified depending on the flame propagation rate: A deflagration is propagated by the conduction and diffusion of heat. It develops by feedback with the expansion flow. The disturbance is subsonic relative to the un-burnt gas immediately ahead of the wave. Typical flame speeds range from 1-1000m/s and overpressures may reach values of several bars. The overpressures are not limited to the 8 bar maximum typical of completely confined explosions.
80
A detonation is propagated by a shock that compresses the flammable mixture to a state where it is beyond its auto-ignition temperature. The combustion wave travels at supersonic velocity relative to the un-burnt gas immediately ahead of the flame. The shock wave and combustion wave are coupled and in a gas-air cloud the detonation wave will typically propagate at 1500-2000m/s and result in overpressures of 15-20bar.
Most vapour cloud explosions offshore would fall into the category of deflagrations. In an environment typical of gas explosions on offshore platforms the gas cloud engulfs many obstacles including equipment, piping, structure etc, often referred to as congestion. It is also usually confined by a number of solid planes such as plated decks, blast walls, equipment rooms etc. The explosion typically starts as a slow laminar flame ignited by a weak ignition source such as a spark. As the gas mixture burns, hot combustion products are created that expand to approximately the surrounding pressure. As the surrounding mixture flows past the obstacles within the gas cloud turbulence is created. This turbulence increases the flame surface area and the combustion rate. This further increases the velocity and turbulence in the flow field ahead of the flame potentially leading to a strong positive feedback mechanism for flame acceleration and high explosion overpressures. The behaviour of the explosion will be influenced by both the degree of confinement and the congestion within the combustion region.
5.1.2
Dynamic pressures and overpressures
Gas explosions can generate both high overpressure and high-speed gas flows as a result of the gas combustion process. Large components of the structure such as solid decks or walls experience loads due to the pressure differences on opposite sides of the structure. Typically within an explosion there will be a strong variation of the spatial and temporal pressure distribution. There will typically be localised high regions of overpressure with lower values of average pressure acting on large components. The overpressure at a location within a gas explosion will typically rise to a peak value and then fall to a sub atmospheric value before returning to zero overpressure. The duration of the positive phase in an explosion can vary greatly with shorter durations associated with higher overpressure explosions. Typical durations range from 50 to 200ms. For smaller objects such as piping the overpressures applied to the front and reverse side of such items will be of approximately the same magnitude at any moment in time and in this case the overpressure will not apply any net load to the object. For this type of object the dynamic pressure associated with the gas flow in the explosion will dominate the applied loads. Methods for calculating loads acting on intermediate sized objects such as large vessels are described in sub-clause 5.11.
5.1.3
External explosions
Secondary or external explosions may result as vented unburnt fuel/air mixture comes into contact with the external (oxygen rich) atmosphere. As the flame front progresses outside the compartment, an external explosion may occur, which may distort the pressure time history and result in double peaked pressure traces inside and outside the compartment. This may have consequences for the escape- ways and may give rise to a blast wave which may impinge on neighbouring structures, and in particularly the TR. Further descriptions of the external explosion phenomenon are available Reference [68].
81
5.1.4
Far field effects
Following a gas explosion that generates significant overpressures, a pressure pulse will propagate into the surrounding atmosphere. The convection in the flow will tend to make pressure disturbances at the back of the pulse catch up with those at the leading edge of the pulse. This has the effect of decreasing the duration of the positive part of the pulse and steepens the leading edge. A blast wave with near zero rise time will then develop. Often this wave has zero net impulse as it travels away from the explosion. Simple methods exist for calculating the form of this blast wave and its effects on targets in its path [67, 70], some are taken from military and nuclear codes. The peak overpressure in this blast wave will then decrease with distance while the blast wave duration will typically increase and as a result the impulse will decrease more slowly than the overpressure. The blast wave will be affected by other confining objects such as decks, blast walls and accommodation blocks that will result in reflection and diffraction of the blast wave. This may affect the decay of the blast wave and in some cases can increase local overpressures where a blast wave is reflected from a surface or object. The received pressure on a flat surface may be greater than that in the incident blast wave. At pressure levels typical of a blast wave generated by a hydrocarbon explosion, this received pressure may be up to twice the incident pressure, a process which is referred to as pressure doubling.
5.2
Tasks for the determination of explosion loads
The tasks in the determination of explosion loads are discussed in Subclause 5.9. There are two suggested levels of sophistication of approach, the High risk methodology and the Low risk methodology applied as appropriate for low medium and high risk installations as defined by the Risk Matrix given in Subclause 3.4. The category of the installation does not preclude the use of more sophisticated methods of assessment which may result in reductions in conservatism and hence cost. The treatment in this clause concentrates on higher risk methodology techniques with simplifications for the low risk methodology suggested for each of the tasks described. An explosion assessment is performed in the following steps. Where given, the references refer to other sub-clauses. 1. A hole of a given size is assumed to be present in a vessel, piping or riser, leading to a gas or spray release. Immediate ignition is assumed not to occur. [12] 2. The time history of the release rate is calculated. The probability of the occurrence of the release may be estimated from published failure statistics or even from simulation. (subclause 3.5) 3. A dispersion analysis will predict how the gas or vapour cloud develops and disperses under wind and ventilation conditions. Part of this cloud will be within the explosive concentration limits of the gas/air mixture. (sub-clause 5.4) 4. An ignition source within the explosive part of the gas cloud is then assumed to ignite the local fuel/air mix causing expansion resulting from combustion in the region surrounding the ignition point.(see sub-clause 5.5 and Reference [12])
82
5. Explosion loading software is then used to calculate how the flame front accelerates through the surrounding environment. Interaction with obstacles gives rise to increased turbulence, flame folding, increased flame area, increasing overpressures and increasing gas velocities within and outside the gas cloud. (sub-clause 5.6) 6. Overpressures may then be calculated for any barriers in the vicinity.(sub-clause 5.6) 7. Fuel/air particle velocities are also calculated to determine dynamic pressures or drag loads on any structural members, piping or vessels in the vicinity.(sub-clause 5.11) 8. Small objects may be picked up during the explosion, creating secondary projectiles. The peak energy for typical projectiles may be calculated from the dynamic pressure load time history and their mass. 9. Secondary, external explosions may result as the unburnt fuel/air mixture comes into contact with the external (oxygen rich) atmosphere (sub-clause 5.1.3). 10. The explosion loads on piping and equipment may result in further releases with consequent fires or explosions. 11. A blast wave will propagate away from the explosion region and impinge on adjacent structures (sub-clause 5.1.4). This clause deals with tasks 3 to 11 above, a process referred to as Consequence Analysis. Example High level performance standards for the installation are given in the Part 0, Fire and explosion hazard management. For extreme explosion events it is conventionally assumed that fatalities will occur in the vicinity of the explosion. It is only possible to provide barriers to protect adjacent areas. It is unlikely that the SCEs will withstand a worst case explosion scenario defined as that scenario which considers a maximal stoichiometric cloud filling the compartment or engulfing the installation ignited at the worst position. Design explosion loads with a known frequency, which the structure and other SCEs must be designed to resist must then be derived. A method is discussed which uses exceedance curves for representative peak overpressures for the compartment/installation. This is discussed in sub-clause 5.10 on the generation of exceedance curves and sub-clause 6.5 on the classification of SCEs for explosion response assessment. In order to provide some measure of asset protection as well as protecting life and the environment two levels of explosion should be considered. The strength level blast (SLB) and the ductility level blast (DLB) explosions are described in Clause 3 and sub-clause 5.9. A more detailed treatment of these issues will be given in Part 3 of the Guidance. The methods for the determining structural and other SCE response and capacity are described in the next clause.
83
5.3
Determination of explosion frequency
The main reason for using a probabilistic assessment method is to derive relationships for the probability of exceedance of a given explosion parameter such as overpressure or dynamic pressure at a specified location or in a specified region. This enables the range of scenarios to be compared with their probability of occurrence leading to the definition of design explosion loads which can and must be designed against. Some possible methods of deriving exceedance curves are described in sub-clause 5.10 and the Century Dynamics basis document [71]. The first step in the compilation of a frequency versus overpressure curve is the determination of overall explosion frequency. This can be achieved by standard means used in Fire Risk Analysis (FRA) using the following steps: Select representative leak sizes Determine leak frequencies from equipment item counts and generic release frequency data per item Calculate representative release rates based on release size, composition and pressure Calculate ignition frequency, dependent on release rate or the rate of generation of new flammable volume Determine proportion of ignitions for which explosions occur (delayed ignitions).
The above steps are familiar to most safety practitioners and use generic data collected from past hazard events in the UK petrochemical industry [23 to 28]. There is no specific guidance on the above process, companies undertaking QRA tend to have their own individual procedures. The following table however gives an indication of where the data can be located. Table 5.1 Release and ignition data sources Item Release Sizes Possible Data Source Selected to a give spread of potential consequences (from low release rate long duration to high release rate short duration). A typical spread might be: 3mm representing small releases (0-6.5mm) Leak frequency data 10mm representing medium releases (6.5-20mm) 30mm representing large releases (20-60mm) 100mm representing catastrophic releases (60+mm) (Optional) Full bore if significantly different consequence from 100mm
Hydrocarbon Leak and Ignition Data Base [27], the WOAD database [24], OREDA [25] and the UKOOA release statistics review [28] . Leak Rate Calculated from release size, inventory pressure and gas properties [63] . Ignition frequency Hydrocarbon Leak and Ignition Data Base [34] or Classification of Hazardous Locations [35] . Proportion of ignitions Classification of Hazardous Locations [35] . giving explosion Issue 1, October 2003
84
Two possible options are described for this approach [66]. The weak points in this approach are the variability of gas cloud size with ventilation and environmental conditions and the choice of ignition time and location. A Monte Carlo approach may be used to explicitly represent the variability of these and other parameters. Usually a phenomenological method of calculation of overpressures is used in view of the large number of simulations necessary. The increased accuracy in the representation of frequency and consequence variability will offset the reduced accuracy in load determination in the determination of explosion risk.
5.4
5.4.1
Dispersion
General
Once the release rate and frequency has been determined then the dispersion characteristics of the gas cloud, vapour cloud or liquid spray release must be calculated. This may include a time history of the clouds extent and the identification of the likely ignition sources in the flammable range. Three main methods are discussed in this document for the determination of the extent of the gas cloud after a release. They are the direct CFD method whereby the cloud evolution is tracked through time, the workbook approach developed in the JIP on Gas build up from high pressure natural gas releases in naturally ventilated offshore modules [39] , and the simplified method is given in the Explosion Handbook, Reference [13]. Other approaches include the zonal and Shell DICE methods. The direct CFD method has the advantage that ignition sources and their position in the gas cloud may be modelled with the effect of wind speed and direction being represented. The software used for the dispersion simulations may be the same as that used for the explosion simulation itself. The disadvantage is that at present these simulations do take some time to perform in view of the long time scale of the dispersion process as compared with the explosion simulation. This approach is discussed further in sub-clause 5.13 on the NORSOK procedure.
5.4.2
The workbook approach for calculation of gas cloud size.
Cleaver [72] describes an investigation of gas build up in naturally ventilated offshore modules following high-pressure releases. This work was based on an experimental program of 66 experiments in the full size Spadeadam test rig. The objective of these experiments was to investigate the effects on the dispersion process of release location, orientation, pressure and diameter as well as module perimeter confinement and the wind driven ventilation rate. The majority of the releases were at a constant rate of between 0.5 to 10kg/s but the effects of declining release rates were also considered. Gas concentration during the gas release event was recorded at up to 200 locations within the rig. A correlation for the flammable volume of gas within the rig (between 5 and 15 % concentration) was derived based on simple experiments and dimensional considerations. A plot of an upper bound estimate of the fraction of the module filled with flammable gas against the non-dimensional parameter R is given below:
85
1 + + + + + + + + + + # ## # ## # * #
Non-dimensional flammable volume
0.1 ~~ ~
~ ~ + 0.01 0.1 Release parameter, R 1
0.01 0.001
Figure 6 - Plot of Non Dimensional Flammable Volume versus Release Parameter [39]
The Release parameter R is defined as: R= (dm/dt) / ( s Uv L2 ) Where: dm/dt = mass flow rate of gas released into module (kg/s) s Uv L = The density of the released gas = The average ventilation velocity in the module before the gas is released (m/s) = cube root of the module volume
It was generally found that greater confinement gave lower ventilation rates and larger flammable cloud volumes. Note that the larger rate releases themselves changed the ventilation flow within the test rig. In Reference [39] this approach is extended to a workbook form. This requires the separate determination of the ventilation flow rate through a confined and congested region and the determination of the flammable gas cloud volume. Two estimates of the flammable volume are made: A upper but realistic estimate of the flammable volume that a given release would produce for use at the screening stage
86
A mid-range estimate of a typical flammable volume that a release will produce to give a best estimate of the likely outcome.
The flow through the module is characterised by a representative ventilation velocity that is assumed to be related to the external wind velocity. Four generic module layouts are referred to specific details are not described. The normalised volume of the flammable gas cloud is also defined by a non-dimensional relationship. Finally, a relationship for flammable gas volume between two given concentrations is given. It is stated that the workbook could be combined with accidental release rate/frequency data held by regulatory authorities.
5.4.3
Explosion Handbook approach [13]
A further simple method of calculating gas accumulation in a module is described in the Explosion Handbook by Czujko [13]:
Mg =
LVent RLeak 3600 LModule RVentilation

= Mass of gas in the process area (kg) = Distance to module vent of end of congested area (m) = Length of module (m) = Gas leak rate (kg/s)
Where: Mg LVent LModule RLeak
RVentilation = Ventilation rate in air changes per hour It is stated that this simple model will often give a good estimate of the amount of gas within the module, provided that the ventilation flow field is close to uniform. For more complex flow fields the model uncertainty increases.
5.4.4
Equivalent Stoichiometric Clouds
At the current time it is not recommended to directly use dispersed non-homogenous and turbulent gas clouds in CFD or phenomenological explosion simulations due to a lack of testing/validation and therefore there is a lack of confidence in the codes for this application [13]. Instead an equivalent quiescent stoichiometric gas cloud intended to give overpressures similar to the non-homogenous and strongly turbulent clouds ignited in some full scale tests should be used. Three methods for the conversion of dispersed clouds into equivalent stoichiometric clouds are summarised in this sub-clause. Hansen [73] describes a parameter called Q5 that is calculated during FLACS dispersion simulations. To calculate the Q5 parameter the mass of gas at non-stoichiometric concentrations is multiplied by the burning velocity and the volume expansion ratio at the concentration, both normalised to that for a stoichiometric mixture. This process calculates the total mass of gas in the equivalent stoichiometric gas cloud. The filters used in this process are shown in Reference [59]. Note that it is also stated that for very confined modules the burning rate filter becomes less important and in the case of a fully closed vessel, only the volume expansion filter should be used.
87
Pappas [11] describes how the complex shape of a dispersed cloud can be represented using a cubic cloud typically extending from floor to ceiling in the module of interest. In Reference [12] it is stated that this method will generally give pressures of similar strength for the equivalent quiescent clouds as for the non-homogenous and strongly turbulent clouds ignited in full-scale tests. It is also stated that the explosion overpressure durations may be shorter than for the non-stoichiometric clouds that may in turn affect the structural response. In the full-scale dispersion and explosion tests conducted in Phase 3b [74] Advantica proposed an alternative method for calculating a stoichiometric gas cloud volume equivalent to the dispersed cloud in an experiment. This was used to generate an equivalent volume based on the dispersed clouds with results from partial stoichiometric fills of the test rig. For non-stoichiometric concentrations a weighting proportional to the square of the product of the laminar burning velocity times the expansion ratio, both normalised to a stoichiometric concentration was used. This method was proposed for data evaluation purposes. It has not been validated as a methodology for general use. This method was proposed for data evaluation purposes, it has not been validated as a methodology for general use. A curve relating the likely overpressure to the fraction of the module filled with a gas cloud normalised to the fully filled case was derived. For fill fractions above 80 % the explosion overpressures are predicted to be as high as those with a stoichiometric cloud completely filling the test rig. The experimental data and a possible curve fit to it are shown in Figure 7. It is suggested in Reference [74] that a simple straight line could be added to this figure to form an upper bound for the likely overpressures at small fractional equivalent stoichiometric fill volumes.
1.0 80%ile test overpressure 80%ile max fill overpressure 0.8 0.6 0.4 0.2 0.0 0.0 # # # ## # 0.2
Partial fill correlation All Lean or Near Stoich # Some Rich

#
# # #
Ideal Part Fill (Stoich)
0.4
0.6
0.8
1.0
Equivalent Stoichiometric Fraction Fill

Figure 7 - Comparison of normalised overpressure plotted against the equivalent stoichiometric fill fraction for each large-scale realistic release experiment.
The data and correlation for the idealised partial fill experiments are also shown in Reference [10].
88
Note The process of the representation of a dispersed gas cloud of varying concentration as an equivalent stoichiometric cloud is considered by Advantica to introduce uncertainties in the chain of calculations leading to the explosion loads. This has a bearing on the accuracy of the overall process and whether high levels of detail in other parts of the chain are needed or can be justified
It is hoped that this process can be improved or that the CFD/phenomenological codes may be validated against experiment for the case of varying density within the gas cloud.
5.5
5.5.1
Ignition
General
The probability of the occurrence of a detectable overpressure being developed Prexpl is the product of the probability of the release Prrel and the probability of delayed ignition Prign.
5.5.2
Estimation of delayed ignition probability Prign [66]
Delayed ignition of a gas cloud implies that the resultant combustion would produce overpressure effects and can be characterised as an explosion. An overpressure will result from the ignition of an accumulation of mixed air and fuel. This may occur during ignition of a jet fire and may result in an initial fire ball. A significant overpressure is defined in this Guidance as one above 50 mbar and may serve to provide a workable definition of an explosion. 50 mbar is the commonly accepted lower limit for the opening of pressure relief panels. Based on data presented by Cox Lees and Ang [75] a probability of 0.08 for a delayed ignition probability is suggested. This should then be multiplied by a value for the total ignition probability for which a figure of 0.1 is suggested. As there are significant unknowns in both values suggested here it is recommended that a factor of two is applied to both recommended numbers. This gives an overall delayed ignition probability of 0.032. During the Phase 3b tests [10] it was observed that for realistic releases giving a non-uniform cloud density, the ignition of the cloud did not occur every time the ignition source was activated. This was due to the fact that the source may be located in a non-flammable region of the cloud or that the initial combustion ceased as the small initial flame front progressed to nonflammable regions before it could develop. Further information may be found in the OGP (formerly E&P Forum) hydrocarbon leak and ignition database, see Reference [76]. If a full dispersion analysis is performed then intermittent and continuous time dependent ignition may be considered. Assuming a largely uniform distribution in space of ignition sources will result in a time dependent probability of ignition proportion to the rate of generation of flammable cloud volume.
5.6
5.6.1
Explosion overpressure determination

Explosion prediction methods and tools
The commonly used methods for predicting gas explosion loads are have been reviewed [67]:
89
Empirical models based on correlations with experimental data and usually used to predict far field blast effects outside the gas cloud combustion region. The limits of applicability and accuracy of these methods are generally determined by the extent of the experimental data that they are based on. Can be simple and quick to use so they can be a practical design aid but in general the least accurate and cannot address general scenarios, as they should strictly be used within the range of data on which they are based. Examples of empirical models include Baker-Strehlow, Congestion Assessment Method, Multi-energy method andequivalency [18]. Phenomenological methods are simplified physical models that attempt to model the essential physics of explosions. Generally they represent the actual scenario geometry using a simplified system, for example a small number of interconnected chambers with turbulence generating source terms between them, to represent the fully 3 dimensional nature of the real geometry. This can be a reasonable representation of some geometries such as an offshore module but may not be adequate for more complex situations. Phenomenological models typically generate a peak overpressure or a single pressure-time history taken as representative throughout the area under consideration. Some codes can also predict the blast wave that will propagate away from the gas combustion region into the far field. Short run times make this type of model suitable for running large numbers of explosion scenarios. Examples of phenomenological models include CLICHE/CHAOS, SCOPE (note CLICH and CHAOS are now included in the Advantica ARAMAS package) A Monte Carlo approach may be used to explicitly represent the variability of these and other parameters. Usually a phenomenological method of calculation of overpressures is used in view of the large number of simulations necessary. The increased accuracy in the representation of frequency and consequence variability will offset the reduced accuracy in load determination as compared with CFD simulations in the determination of explosion risk. Computational Fluid Dynamics (CFD) are in principal the most fundamentally based of the methods discussed here and have the best potential for accurate prediction of gas explosion behaviour over a wide range of geometries and explosion scenarios and in both the near and far field. These tools solve the conservation equations of mass, momentum and energy including turbulence and combustion in a large number of relatively small control volumes covering the region of interest. These tools can provide a wide range of information about the flow field and the explosion behaviour at the expense of significant effort required to set up a suitable geometry model and significant computational power requirements. In practice accuracy is limited by: Available computation power limiting the numerical resolution that can practically be used Accuracy of numerical models The underlying empirical sub models for Reaction zone Turbulence generation Turbulence length scale Turbulent combustion
In addition the numerical grid is typically insufficient to resolve smaller items of equipment and most pipe work. These items must be represented as they are responsible for a large proportion of the turbulence generated during an explosion so they are represented as drag and turbulence source terms within each cell (so called sub grid modelling or Porosity, Drag Resistance (PDR) models).
90
These models are therefore calibrated against experimental data of which full-scale data is preferable to avoid scaling effects known to exist in gas explosions [77]. The full-scale tests performed in the Spadeadam test rig during Phases 2, 3a and 3b of the Fire and explosion JIP therefore provide important reference data for CFD explosion prediction tools. Importantly Phase 2 of this JIP[9] gives a comparison of predictive capabilities for selected explosion simulation tools. Examples of specialist CFD gas explosion simulation tools include: AutoReaGas, FLACS, EXSIM. A simplified formulation CEBAM has been developed in the US.
5.6.2
Limitations of CFD codes
Whilst CFD codes are considered to be the most accurate and stable codes for the generation of explosion loads and are in widespread use, they all have the following properties: The codes are mostly designed to deal with fully turbulent flames. The codes do not directly model flame distortion and diffusion/hydrodynamic instabilities that occur between ignition and fully turbulent combustion. Consequently the codes must rely on empirical flame folding models that are valid for a limited range of fuel-air concentrations and boundary conditions. The codes do not model flame propagation phenomena involving instabilities associated with acoustic waves and shocks. The codes should not be expected to accurately model flame quenching due to deficiencies in the models, and due to lack of validation with experiments where quenching can be directly observed.
Many of these deficiencies are partly due to the current limited understanding of the various flame propagation phenomena, and due to inadequate computer resources which prevent sufficient spatial and temporal resolution. Important inputs to the analysis are the laminar and turbulent flame velocities. The turbulent flame velocity is related to the laminar flame velocity in Appendix A of the Reference [18]. Further data are available in References [78, 79].
5.6.3
Explosion code review/selection
The relatively limited time available for the preparation of this Guidance precluded a detailed survey of the current status of explosion prediction tools. The information described here was instead based on a recent survey conducted by the Health and Safety Laboratories [67]. Some of the relevant conclusions/discussion from a recent review completed by HSL summarised below:
[67]
are
The phenomenological code SCOPE and simple CFD codes AutoReaGas, EXSIM and FLACS are in widespread use Phenomenological and CFD methods generally give fairly good accuracy (within an factor of two*) so these models yield solutions that are approximately correct The limitations associated with empirical and phenomenological methods (simplified physics and relatively crude representation of geometry) can only be overcome through additional calibration
91
It is recommended to develop advanced CFD codes that will allow fully realistic combustion models and resolution of all obstacles but is stated that it is likely to be 10 or more years before such tools are available. This is primarily due to the large computational expense of this type of model.
It is considered however that the present phenomenological and CFD models are adequate for the assessment process being carried out given the uncertainties in the other stages of the process.
Note: The view in Norway is that a correct application of the NORSOK protocol for explosion simulation will result in an accuracy of +/- 30 % in peak overpressures [12, 11].
Further extracts from this report can be found in Reference [18] along with a brief description of the empirical, phenomenological, and simple CFD codes that are described in the report.
5.6.4
Summary of main conclusions of HSL report [67]:
The limitations associated with empirical and phenomenological models i.e. simplified physics and relatively crude representation of the geometry, can only be overcome through additional calibration. This limits the scope for improvements. In light of the fact that gas explosion predictions are needed now, but that it will probably be ten or more years before the CFD-based models will incorporate fully realistic combustion models, be able to more adequately model turbulence and turbulence-combustion interaction as well as being able to accurately represent all important obstacles in real, complex geometries, one must make the best use of the currently available models. However, it may be unwise to rely on the predictions of one model only, given the uncertainties that remain especially if the model is used outside its range of validation. One must also be aware of the uncertainties associated with whatever modelling approach is used. The accuracy expected from, say phenomenological and simple CFD models is generally fairly good (to within a factor of two), e.g. the models yield solutions which are approximately correct, but, importantly, only for a scenario for which the model parameters have been tuned. This limits the accuracy of these models as truly predictive tools. (number 8 of main findings). Perhaps the safest that can be advised at this point is that it would be unwise to rely on the predictions of one model only, i.e. better to use a judicious combination of models of different types, especially if a model is being used outside its range of validation. (number 9, of main recommendations).
Note It needs to be remembered that the all phenomenological and CFD codes represent the physics to some degree and all are calibrated or validated against experiments. It could be said that all could not therefore be used outside their experimental validation, but it should be recognised that because there is an understanding of the physics involved, it is not unreasonable to move the models outside there region of experimental validation as long as this is done with a knowledge and understanding of the limitations.
92
5.6.5
5.6.5.1
Practical Use of CFD Explosion Prediction Tools

Geometry requirements, methods for early project phases
During the early stages of a typical offshore project, only the general layout and location of the major pieces of equipment are known. The level of geometric detail usually increases as the project proceeds as smaller pieces of equipment and objects such as piping and cable trays are defined. For explosion overpressures predictions at each project stage the likely effects of geometry detail to be added later in the project should be accounted for. If this is not done it is likely that the calculated explosion characteristics such as overpressure and impulse will increase significantly as detail is added throughout the project duration. Two possible methods of addressing this have been postulated [13]. Make allowance for later increases in explosion loads by multiplying the explosion overpressures predicted for a given level of geometry detail by applying a factor for equipment growth (and hence congestion) based on previous project experience Addition of anticipated probable congestion into the explosion geometry model to allow for as yet undefined geometry
Detailed investigation of an integrated deck platform typical of the central/northern North Sea showed that reasonable prediction of the likely final overpressures required the definition of all major equipment, boundaries (decks, TR/accommodation blocks), all piping with diameters > 8, Primary structure, secondary structure with cross section dimensions > 5. The anticipated additional congestion likely to be added as the design is progressed can be based on historical data for similar previous projects, equivalent equipment with all of its associated pipe work. Several possible measures of the completeness of the current geometry model such as the total length of the defined obstacles or various measures of the blockage ratio have also been proposed.
5.6.5.2
Hints, tips and recommendations for use
Further details of these methods are summarised in Reference [80]. Uniform cells should be used in the region of a CFD model where turbulent combustion will take place It is recommended that in FLACS simulations there should be at least 13 cells across an unconfined gas cloud. Fewer cells are necessary with confinement. (P4.42, 72) . For AutoReaGas the recommended constants provided for turbulent combustion modelling (factor slope and turbulent combustion modelling constant) should be used with close to 1m3 cells. It is recommend that uniform stoichiometric concentration gas clouds are used in explosion modelling due to lack of calibration/validation for non-uniform nonstoichiometric concentration clouds A sufficiently detailed geometry model should be used with explosion prediction models that rely on a detailed geometry model of the facility An explosion prediction code with a demonstrated predictive capability should be used, consult your code supplier. The numerical mesh should be extended sufficiently far from the region of interest to prevent boundary conditions from affecting the simulation results of interest to the project
93
The computer code EXSIMPO is available for use with EXSIM which determines the appropriate cell size from the layout.
5.6.6
Validation/calibration of Gas Explosion Prediction Tools
If an explosion prediction tool is to be used to calculate design loads for offshore facilities it should be ensured that the tool is appropriate for the purpose. It has been found experimentally that gas explosion behaviour in confined and congested environments is dependent on the scale of the test [81,9]. Thus one of the main objectives of the Phase 2 BFETS JIP [9] was to provide specific information on the characteristics of explosions in a full-scale test rig intended to be representative of an offshore module. Comparison between results for complete stoichiometric methane fills of a 1:3.2 scale and full size Spadeadam test rig showed overpressures between 5 and 2.5 times greater at full scale. The full-scale test results from the Phases 2 and 3a can now be obtained from the UK HSE and are an important resource for validating/calibrating explosion assessment tools. It is therefore recommended that the suitability of explosion assessment tools should be at least partly assessed by comparison of simulation results with a selection of test cases taken from full scale tests in the Spadeadam test rig. The key to this validation process is to demonstrate the predictive capability of the tool rather than simply a calibration to one set of experiments. It is worth noting that the only assessment of full scale blind explosion predictions, made before the relevant test results were publicly available, were conducted in Phase C of the Model Evaluation Exercise conducted during Phase 2 of the Fire and Explosion JIP [9] . This was a demonstration of certain predictive capabilities of the range of gas explosion simulation tools available at this time.
5.6.7
Example overpressure traces
Results from the explosion tests at the Advantica Spadeadam test site, revealed that the overpressure time histories had a large number of short duration spikes which seemed to be superimposed on a generally smooth curve. Figure 8 shows a typical trace from inside the test rig.
94
Overpressure (bar)
2.00
1.50
1.00
0.50
0.00
100.0
200.0
300.0
400.0
500.0
600.0
700.0 Time (msecs)
Figure 8 - Example overpressure trace (inside a compartment)
The origin of these spikes could be: local supersonic flow and the resulting generated shock waves localised centres of combustion and pressure generation acceleration of the pressure transducers during the explosion local response and subsequent generation of shock waves through the (bolted) structure.
Whatever the cause investigations have shown [82] that the influence of these short duration loads is insignificant for components with natural periods more than 0.02 seconds (natural frequency less than 50 Hz) which includes most components. These spikes which can take the observed overpressures beyond 12 bar may therefore be ignored and pressure traces may be smoothed by time averaging over a period of 1.5 milliseconds. Other more refined smoothing techniques have been investigated [83]. Existing CFD explosion simulation codes do not generate these spikes as they cannot represent any of the processes identified above so overpressure traces from CFD simulations may be used directly as the input loading for some finite element packages (FEA) packages. This form is not characteristic of far field blast waves outside a compartment. A typical trace for this case is shown in Figure 9.
95
Overpressure (bar)
400 300 200 100 0.00 -100 -200 0.700 0.800 0.900 1.000 1.100 1.200 Time (msecs)
Figure 9 - Typical pressure trace at some distance from a vent blast wave.
5.6.8
Extrapolation of the results of a worst case explosion simulation
For an initial screening analysis the following method from Reference [66] is a method for the extrapolation of the results from a simulation based on a worst case scenario with the whole volume is full of a stoichiometric mix of gas for use when partial fills are more realistic. This may occur if the released inventory cannot be sufficient to form a cloud of this size. The peak smoothed overpressure for this worst case scenario simulation will be Pult The reliability of the results of this method will depend on the reliability of the base simulation. The method is based on the assumption that any gas within the module is perfectly mixed and that the probabilities of an explosion occurring at any concentration within the flammable range are equal. It is recommended that the variation of explosion overpressure with ignition point location is investigated by considering at least three ignition points at representative points, such as both ends and the centre of the module, again assuming that the module is fully filled with a stoichiometric concentration cloud. The variation of explosion overpressure with concentration for unmitigated explosions is defined by the following relationship:
PE 2 = PE 1e17.693[( E 2 1.0563)
( E1 1.0563) 2 ]
Where: PE1 = overpressure at concentration equivalence E1 (Pult for a stoichiometric mix) PE2 = overpressure at concentration equivalence E2 E = Concentration of Interest / Stoichiometric Concentration
96
This relationship for the variation of the maximum peak explosion overpressure with cloud size has been developed based on limited medium-scale experimental evidence and FLACS simulations of these events. The method was developed based on experiments for one explosion geometry. The relationship between the fraction of the module filled with stoichiometric concentration and the fraction of the overpressure corresponding to a fully filled module, produced by a given cloud is shown below in Figure 10:
1 0.9 Normalised Overpressure 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 0 0.1 0.4 Normalised Cloud Volume 1
Figure 10 - Normalised overpressure Vs. Normalised cloud volume
The influence of water spray mitigation, based on a small data set, is quantified by the use of a ratio of the unmitigated overpressure to the mitigated pressure Pr.. This varies with the unmitigated explosion overpressure as given below: Table 5.2 Pr - unmitigated/mitigated Peak Overpressure Maximum unmitigated explosion overpressure (Bar) 0 to 0.2 0.2 to 0.5 0.5 to 1.0 1.0 to 2.0 2.0 to 4.0
Pr 1 2 3 3.4 6
> 4.0 8 A relationship for mitigated explosion peak overpressure is also given in the same form as the earlier relationship for unmitigated explosions:
PE2 = PE1e18.215[( E2 1.0007 )
( E1 1.0007 ) 2 ]
The factors given in Table 5.2 represent median values, with a large spread in the data for all overpressure ranges. The use of these factors may considerably under or over estimate the real local overpressure peak values.
97
5.7
5.7.1
Development and application of Nominal Explosion Loads

Intended use of nominal explosion loads
During the concept selection/definition phase of a project it would be useful to have an indication of likely gas explosion loads for use in assessing alternative concepts. At this stage of the project very little detailed information will be available and this will almost certainly be insufficient to allow the use of explosion prediction methods that require the input of geometry models with any level of detail. In addition normal project timescales will not allow time for detailed explosion assessments to be carried out at this time. As the spatial variation of explosion loads will not be well represented, it is not recommended that nominal overpressures or dynamic pressures are used as a design basis at later project stages, for the assessment of existing platforms or for high risk or novel installations. Nominal overpressures are defined as peak representative overpressures by installation/module type determined on a non-statistical basis from acquired experience or simulation for a demonstrably similar situation. If it is necessary to calculate blast wave effects in the far field, for example at an adjacent platform, this could be done using one of empirical blast wave propagation methods from a knowledge of the vent areas and the mass of fuel in the gas cloud. The external explosion which may occur as a result of the ignition of a vented unburnt fuel/air mixture is not explicitly included in the approach although in some of the data the external explosion may have contributed to blockage of the vents and increased the overpressures in the combustion region. At later project stages, and for assessment of existing facilities it is recommended that a suitably validated phenomenological or a specialist CFD explosion simulation tool is used. A Rule Set defining nominal, space averaged, peak explosion overpressures or nominal overpressures may be developed to assess alternative concepts at early project phases. This could be based on data from previous explosion load simulations for the range of concepts, module sizes, module types and process characteristics. It may be more useful to develop a library of example simulations of typical well defined modules, installation types, calculation methods and design explosion scenarios. Frequency information should also be developed alongside the corresponding explosion load. It was recommended that UKOOA/HSE should fund such a project in time for the compilation of Part 3 of this Guidance.
5.7.2
Factors influencing the overpressure values
The Rule set could also include information on the expected variation of the nominal overpressures with respect to but not limited to a subset of the following factors:
Production rate Gas compression pressure Gas composition Number of production trains Module area/footprint Confinement measures Congestion measures Issue 1, October 2003
98
Aspect ratio
It would be desirable if these factors could be as near as possible independent to aid processing of the base data.
5.7.3
Characteristics of a suitable data set
Some data has been collected on a range of concept types and is given in Appendix A of Reference [19]. This data was found to be unsuitable for the generation of reliable nominal overpressures. The overpressures are not defined precisely and may not be representative of the general level of severity of the explosion event simulated. The desirable characteristics of a suitable data set are:
The values need to represent space-averaged overpressures over the affected area which are defined as the average of all simulated (or measured) overpressure peaks within the affected region. It is assumed that in the case of measured overpressures they have been smoothed by time averaging over a window of 1.5ms. There should be sufficient gauge points to represent the spatial variation of pressure within the explosion. The scenarios simulated should represent the DLB design level explosion for the ductility level event occurring at the appropriate frequency level. A CFD or validated phenomenological simulation method should be used for all the data. Contemporary analysis methods and up to date software should be used. A number of ignition points should be considered preferably with information on the probability of ignition associated with each one. The detail on the model representing the geometry should represent obstacles down to piping of 3 in diameter. An indication of the variability of the overpressure peaks throughout the compartment should also be part of the data set. An indication of the form of the overpressure traces (duration, and impulse) should be included. Peak dynamic overpressures at SCEs of Criticality 1 and 2 should be included.
The resulting nominal overpressures, frequencies and durations should then be a good indicator of the expected severity of the design explosion event and the level of risk arising from the explosion hazard.
5.7.4
Bounding (minimum) Overpressures and durations
The following source of bounding overpressures, has been located. Note that the bounding overpressures represent space averaged peak overpressure values. These values are the minimum overpressures that will be acceptable for design according to the DnV Offshore Standard DNV-OS-A101, Reference [84]. If they are used, they will need to be justified with respect to ALARP. Section D600, P9 of these rules provides guidance for hydrocarbon explosions. It should be noted that large quantities of ethylene, acetylene and hydrogen require special consideration. The following extracts are taken from the guidance: In a ventilated compartment the explosion load given by overpressure and duration is mainly determined by the relative ventilation and the level of congestion.
99
For compartment volumes of up to 1000m3, with relative ventilation area of about 0.5, stoichiometric gas cloud ignition expected to give approximately 1bar with a medium level of congestion. High congestion levels may increase overpressures by a factors of 2 to 3. Larger volumes also tend to increase overpressures. Design overpressure in a ventilated shale shaker room with less than 1000m3 volume and moderate congestion may be taken as 2bar, combined with a pulse duration of 0.2s (200 milliseconds) unless a more detailed assessment is carried out. Design overpressure on an open drill floor area may be 0.1bar combined with a pulse duration of 0.2s unless a more detailed assessment is carried out. The vent area Av may be taken as sum of free opening and blow out panel areas where static opening overpressure is less than 0.05bar. Durations for explosions is expected to vary from 0.2s for fairly open compartments to 1s for quite closed compartments. If panels or walls are intended to give explosion relief by failing a peak overpressure of 2-3 times their failure pressure can still be expected in the compartment. This is only the case if ventilation dominates. For large and congested compartments local overpressures may be greater. Long compartments with length/diameter ratio greater than 3 will tend to give higher overpressures due to long flame acceleration lengths. The effective diameter can be estimated as D = A where A is the smallest cross-section area and L is the largest compartment dimension. For completely enclosed compartments generally, bulkheads that must survive an explosion will be designed for 4bar. For process areas on open deck covering not more than 20m x 20m with an un-congested arrangement a design overpressure of 0.2bar with a pulse duration of 0.2s may be used. Volume Blockage Ratios (VBRs) of 0.05 may be considered as not congested. VBR is the ratio of the blocked volume to the total volume considered. For larger or congested process areas a design overpressure peak of 0.5bar with a pulse duration of 0.2s may be used. A volume blockage ratio of 0.05 may be considered not to be congested. See Table D1 in paragraph 617 of the reference for a summary of these results.
5.7.5
Other sources of bounding or generic overpressures.
Puttock [85] describes a negative feedback mechanism between confinement and congestion that tends to limit the typical pressures within an explosion to an overpressure of 8 bar. If an explosion is completely confined typical pressures will reach 8 bar but there will be only limited flow within the explosion due to the confinement, and therefore little turbulence. Conversely with a very open layout strong flows and rapid turbulent combustion can result in high localised pressures but the typical space averaged overpressures within the region are likely to be lower than the peaks because hot combustion products will be able to dissipate. Thus the congestion must be considered to account for the phenomena likely to be seen in an offshore gas explosion.
100
5.8
Impulse and duration related to peak overpressure
It has been observed that faster combustion results in higher peak overpressures but the gas is consumed in a shorter period. This fact may be used to estimate durations and impulses associated with given peak overpressures. Without undertaking detailed modelling it is not practicable to establish the overpressure time history for the specific situation. However, by establishing the blast duration, the peak overpressure loads can be translated into useable loads for preliminary response calculations. This load time history may be translated into an equivalent static load which is more readily usable by the project in the concept definition and FEED stages (see Clause 6). It is recommended that in the absence of project specific data the relationship between impulse and peak overpressure described in Hoiset [86] is used to derive a positive duration for the overpressure based on the assumption of a triangular pressure-time history with equal rise and fall times. These relationships are based on CFD simulations of a small number of geometries and should only be considered as approximate example values. The explosion overpressure impulse, I, is given by:I = 0.042 P + 6,500 (Figure 11)
The positive phase duration, t+, in seconds is then: t+ = 0.084 + 13,000/ P (Figure 12) where P I t+ is the peak overpressure in Pascals (1 bar = 100,000 pascals) is the impulse in Pascal seconds is the positive phase of overpressure duration in the combustion region in seconds.
Impulse kPas Vs OP Bar
25
20
Impulse kPas
15 Impulse kPas 10
0 0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 Overpressure (Bar)
Figure 11 - Generic variation of impulse with overpressure [86]
101
The curves given in Figure 11 and Figure 12 may not be applicable for large open areas such as occur on FPSOs and Spars, as it was derived for enclosed compartments. These curves do not apply to blast waves from a distant explosion as in this case the impulse may be near zero and the positive phase duration may be much shorter. The blast wave from a distant explosion (>20m from the vent) will develop into a sharp fronted wave with a negative phase often represented with duration twice that of the positive phase. If an overpressure simulation is available then a point may be positioned on the impulse/overpressure chart in Figure 11. This will serve to calibrate the model for the specific situation. A line may then be drawn through this point parallel to the line given. This new line may then be used for extrapolation of nominal impulse and duration.
Duration Vs Overpressure (Hoiset)
1.6
1.4
1.2
1 Duration (s)
0.8
Duration s
0.6
0.4
0.2
0 0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 Overpressure (Bar)
Figure 12 - Overpressure duration relationship Hoiset [86]
Note that the assumption of a symmetrical triangular positive phase will not apply if there are two clear paths for the pressure disturbance to reach the observation point such as would be observed on the deck below an explosion. An external explosion may result in a double peak in the overpressure.
5.9
5.9.1
Design explosion loads

Load cases for explosion response
Two levels of explosion loading are recommended for explosion assessment by analogy with earthquake assessment. They are the ductility level blast (DLB) and the strength level blast (SLB). Low risk installations may be assessed using only the DLB. The ductility level blast is the design level overpressure used to represent the extreme design event. The strength level blast represents a more frequent design event where it is required that the structure does not deform plastically and that the SCEs remain operational. This load case is recommended for the following reasons:Issue 1, October 2003
102

The SLB may detect additional weaknesses in the design not identified by the DLB (robustness check). An SLB event could give rise to a DLB by escalation this should ideally not occur as elastic response of SLB and supports should be maintained. The prediction of equipment and piping response in the elastic regime is much better understood than the conditions which give rise to rupture. The SLB enables these checks to be made at a lower load level often resulting in good performance at the higher level (strength in depth). The SLB is a low consequence event important for the establishment of operability. This load case offers a degree of asset protection.
5.9.2
Determination of explosion design loads
Overpressure acts directly on loaded surfaces and is available directly from computational fluid dynamics (CFD) and some phenomenological explosion codes. Design explosion loads were in the past derived from the a worst credible event assuming a gas cloud of maximal extent with stoichiometric composition ignited at the worst time in the worst position. Usually the ultimate peak overpressure Pult derived in this way is far too large to be accommodated by the structure. ALARP arguments are appropriate and can be used to demonstrate that risk levels have been reduced to satisfactory levels which itself relies on frequency and risk arguments. Pult will often correspond to an event with a return period out of proportion with the design life of the installation. A frequency of between 10-4 and 10-5 exceedance per year is considered a reasonable frequency for the ductility level design event by analogy with the treatment of environmental and ship impact loads which are often considered at the 10-5 level. The assessment principles for offshore safety cases document APOSC [32] states that the frequency with which accidental events result in loss of integrity of the temporary refuge within the minimum stated endurance time, does not exceed the order of 1 in 1000 per year. The NPD code [87] also gives a lower limit on TR impairment frequency of 10-3 per year. It is reasonable and conservative to assume that the threat from fires exceeds that from explosions by a factor of 10 to 1 and an impairment frequency of 1 in 10,000 per year is a reasonable estimate for explosion impairment. Hence a target of 10-5 exceedance per year for an explosion event which directly impinges on the TR is reasonable. An explosion event in the process area will be separated from the TR by a barrier or blast wall which should withstand the load and have an impairment frequency of much less than 10 % giving a target frequency for such an event of the order of 10-4 exceedance per year. The space averaged peak overpressure for the compartment is used for determination of the design explosion loads as it is more generally representative of the severity of the event. A local overpressure peak may be used to generate exceedance curves for the determination of load cases for local design of blast wall for instance. Impulse exceedance curves may also be generated which take into account the duration of the load and its peak value are a better measure of the expected response of the target which will be dynamic in nature.
103
The SLB may then be identified from a space averaged peak overpressure exceedance curve, as that overpressure corresponding to a frequency one order of magnitude more frequent or with a magnitude of one third of the DLB overpressure whichever is the greater. The reason for the reduction factor of one third is related to the expected reserves of strength in the structure and the observation that the primary structure will often only experience received loads of this reduced magnitude. These topics are discussed in Clause 6. Figure 13 represents an example (simplified) overpressure exceedance diagram. This curve is conventionally plotted with a logarithmic scale for the vertical frequency axis which gives the frequency of per year which the given overpressure will be exceeded. The horizontal axis is a linear scale usually with the peak space averaged overpressure for the combustion region plotted in bar. This parameter gives a good general measure for the choice of design scenarios. Each of these scenarios may have a large range of local peak overpressures and associated durations within it.
P rexp Frequency (per year) 10 -3
10 -4
10 -5 and frequency of exceedance
10 -6 P str 0.0 0.5 1.0 1.5 2.0 P duct 2.5 3.0
3.5
Overpressure (bar)
Figure 13 - Example overpressure exceedance curve location of DLB and SLB design load cases (Pstr and Pduct)
The SLB overpressure, Pstr may then be identified as that overpressure corresponding to a frequency one order of magnitude more frequent or with a magnitude of one third of the DLB overpressure, Pduct whichever is the greater. The reason for the reduction factor of one third is related to the expected reserves of strength in the structure and the observation that the primary structure will often only experience received loads of this magnitude [88,89]. These topics are discussed in detail in Clause 6. Many other forms of this curve have been produced with various combinations of log and linear axes, this gives the impression that the curves differ in shape which depends on the axis choice. Other forms of curve may be plots of local peak overpressures for a particular location
104
There is some evidence that the curve has underlying exponential distribution characteristics [89,90] which gives a straight line when plotted with log-linear axes as in Figure 13. The same convention may be used for plotting other measures such as dynamic pressure exceedance curves for a particular part of the combustion region. The dynamic pressures corresponding to the SLB and DLB load cases may then be obtained in the same way by selection of the appropriate frequencies of exceedance. The generation of exceedance curves is discussed in detail in sub-clause 5.9.
5.9.3
The COSAC Risk Assessment Tool
COSAC [91] is a commercially available risk analysis software tool intended for concept evaluation and screening at earl project phases. The program is used by building an approximate model of the various field development concepts from a list of elements so that each concept can be ranked and potential concept stoppers can be identified at an early stage. The tool includes an explosion assessment method based on FLACS simulations of more than 15 modules/geometries conducted using the NORSOK procedure to generate an explosion pressure exceedance curve. For a specified solid barrier the model can be used to calculate the explosion pressure for a defined annual frequency of occurrence e.g. 10-4 per year. The model has been developed based on data from ordinary offshore modules and is therefore not recommended for extreme cases.
5.9.4
The PRESTO screening model
Advantica have recently undertaken some work to produce a simple screening model for overpressure prediction. This is based on the Phase 2 and 3 data and proprietary test data. The model includes parameters that characterise the degree of congestion and confinement explicitly. They make no claims for the validity or otherwise of the present version which is still very much at an early stage of development.
5.10
5.10.1
Generating Exceedance curves

General
There is currently much industry interest in the generation of curves of the probability of exceeding a specified explosion load at a given location. These curves can relate to overpressure at a point, or averaged over a wall, or other explosion properties such as dynamic pressure or impulse. Exceedance curves are typically plotted on a graph with overpressure plotted on a linear scale on the horizontal axis and annual exceedance frequency plotted on a log scale on the vertical axis. An exceedance curve will always be a monotonically decreasing (discrete) function.
105
Several methods of generating exceedance curves are in use, some of these are described in Reference [18]. The range of methods represents the fact that at an early stage in a project the information available may only be sufficient to apply a relatively simple methodology but that more complex methodologies can be applied as the project develops. However, the range is also due to the number of factors that can contribute to an explosion occurring and that different methodologies account for these factors differently. The release, cloud formation, ignition and explosion must all be considered in generating exceedance curves. Decisions must therefore be made about how to represent these influences on the explosion. Natural variability, in for example, release or ventilation rate, and uncertainty in both the data and models used should be considered. In addition the choice of models will also affect the methodology applied due to the resources they require. Reference [66] and sub-clause 5.6.7 describe methods of extrapolating from a small number of explosion simulations representing differing ignition points to represent various (equivalent stoichiometric) cloud sizes and the expected overpressures. An exceedance curve may be constructed using these extrapolated results. Sub-clause 5.10.5 presents a simplified method based on the assumption of exceedance curve shape which in theory requires only requires a small number of simulations to be performed. The other point uses the probability of a release forming a cloud combined with the probability of a late ignition Prexp, corresponding to the zero overpressure exceedance probability (subclause 5.5). This method may be used only at an early project phase when sufficient information for more sophisticated methods is not available.
5.10.2 Generation of exceedance curves for design explosion load case determination
The process below is a method of medium complexity for the generation of exceedance curves for the purpose of identification of the design explosion events corresponding to the SLB and DLB. It is advisable to consider space averaged peak overpressures for this purpose as they are more representative of the general severity of the load case. The chosen scenarios will themselves give rise to simulations which have large local variations of peak overpressure. The most rigorous and repeatable method of exceedance curve generation is that following the NORSOK procedure [12] described briefly in sub-clause 5.13. It is important to identify the explosion scenarios with the higher overpressures as these will determine the required exceedance probabilities in the required range (10-5 to 10-4 exceedance). Explosions with a frequency of exceedance of greater than 10-3 will also dominate the accuracy of the exceedance curve around the 10-4 exceedance level. The total probability of an explosion gives a method of determining if enough scenarios have been considered and convergence is being reached. Figure 14 illustrates the sequence of tasks for exceedance curve generation. 1. select leak scenarios (sub-clause 3.5) and determine release probabilities (sub-clauses 2.2 and 5.3) 2. calculate release rate time history 3. calculate cloud size time history (sub-clause 5.4)
106
At the highest level of sophistication this would involve consideration of ventilation rates by wind speed and direction by CFD simulation. At a lower level the expected higher explosion overpressures would occur in situations of poor ventilation with the wind from a direction blocked by a barrier or equipment. A simplified method might assume a near constant release rate to generate a series of cloud sizes with equal probability. The workbook approach as described in Reference [39] and sub-clause 5.4 could be used. 4. calculate ignition probability At the highest level the probability of ignition from a continuous source, will be estimated as a time history and will be proportional to the rate of generation of inflammable cloud volume which should be available from a CFD dispersion calculation. At a lower level the ignition probability could be assumed constant irrespective of cloud size but with say 3 widely spread locations for the ignition sources. 5. calculate equivalent stoichiometric cloud size (sub-clause 5.4.4) note the reservations quoted in this sub-clause on the accuracy of this step in the analysis process. 6. calculate the space averaged peak overpressure (sub-clauses 5.6 and 5.6.6) A high level of sophistication method could use CFD for the cases where the highest overpressures are expected with calibrated phenomenological simulations for interpolation between scenarios if required. Alternatively, a Monte Carlo simulation method may be used based on a phenomenological model used such as ARAMAS which generates space averaged overpressures implicitly. Several thousand simulations may be performed for variations of all input parameters governing environmental, release and ignition. The wider range of parameter variations offsets some of the uncertainties in the extrapolation techniques which could be used if a CFD approach with fewer simulations is used. A low sophistication method may use one of the larger cloud size cases with interpolation for smaller clouds using approaches described in sub-clause 5.6.8 and Reference [66]. 7. assemble the space averaged peak overpressure exceedance curve from probabilities of occurrence of the overpressures for the scenarios simulated. If local overpressure exceedance curves are needed for a reliability analysis of a blast wall for example these may be generated based on the probabilities for the averaged pressures and transfer functions relating these two values for the chosen location [92] . The worst credible scenario assuming a stoichiometric cloud filling the module and ignited at the worst position may not be representative of the general population of explosion events. In addition it will be difficult to determine its probability of occurrence. A representative scenario at around the 10-4 per annum exceedance level or the 10-5 frequency of occurrence level should be used if it can be identified. A simplified method which may be used for the purpose of design explosion load determination, is presented at the end of this sub-clause in 5.10.5. Bruce [93] describes a typical methodology for estimating overpressure exceedance distributions with associated confidence bounds. The probability distributions of the input variables are considered in giving these bounds. Reference [18] forms the basis of this clause and contains a number of reviews of the literature relating to this topic.
107
WIND ROSE
N NW W SW S NE E SE
VENTILATION AREAS FOR EACH FACE OF MODULE

PROB. DENSITY
DISTRIBUTION OF VENTILATION RATES

0.06 0.04 0.02 0 200 100 150 250 300 0 50 CUMM. PROBABILITY 0.08 1 0.08 0.06 0.04 0.02 0
AIR CHANGES/HOUR
FORCED VENTILATION RATE
HOLE SIZE DISTRIBUTION

FREQUENCY
FUEL CONCENTRATION VERSUS TIME

% FUEL
UEL LEL TIME
HOLE DIA.
INVENTORY VOLUME AND PRESSURE FUEL CONCENTRATION PROBABILITY DENSITY
IGNITION/EXPLOSION PROBABILITY VERSUS TIME
PROB. DIST.
FUEL/AIR MIXTURE
OVERPRESSURE DISTRIBUTION
PROB. DENSITY 1.5 1.0 0.5 0.00 E+00 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 0 1.1 1.2 1.3 1.4 1.5
RANDOM CHOICE OF IGNITION LOCATION WITHIN MODULE
OVERPRESSURE
EXCEEDANCE PROBABILITY
0.01
0.001
0.0001 0.00001
0.000001 0.05 0.3 0.55 0.8 OVERPRESSURE (BAR)
Figure 14 - Overview of Probabilistic Blast Modelling Approach [93]
108
5.10.3
Generic exceedance curves
Puttock [92] describes the possible use of generic pressure exceedance curves designed to give a conservative estimate of the required probability for all modules of one generic configuration. As the worst-case overpressure will vary from module to module the generic exceedance curve is plotted as the ratio of overpressure to the worst-case overpressure. One problem with the use of this type of generic curve is that they do not allow for the fact that the level of overpressure will affect the shape of the plot because if the overpressure is already close to 8 bars it is unlikely to significantly increase. Ratios of a parameter called severity index rather than the overpressure can be used to allow for this. Severity index, S, is defined in Reference [92] based on runs of SCOPE 3. S tends to infinity at 8 bars that would correspond to adiabatic combustion of a stoichiometric hydrocarbon without any expansion. An expression for S is given as:
S = P.e
(0.4
P E1.08 1 P
Where P is the overpressure in bars, E is the expansion ratio at atmospheric pressure. Note that this approach assumes that P is a typical overpressure, for example over a complete congested region. If P is replaced by S in an expression fitted to some experimental data then at low overpressures the predicted overpressures will be unchanged. If the correlation is used for S and S inverted to get P using the above equation it will automatically be limited in a realistic way to 8 bar. It is however difficult to prove the general applicability of generic curves as their detail is likely to vary between different modules/plants. It is stated that the only feasible way to take into account the complexity of the physical processes in a gas explosion is to use a Monte-Carlo method that requires performing many thousands of model runs to obtain valid statistics. The SCOPE model that only takes a few seconds to run is used for this purpose. Where further detail is required CFD runs are performed using EXSIM. Transform (or transfer) functions that relate the median overpressure produced by SCOPE to features such as localised high overpressures or geometry effects such as shielding or pressure wave reflection are then defined. The method takes account of variations in leak rate, fuel type, wind speed and direction, ignition location and stoichiometry. Flammable gas cloud sizes can be calculated in two stages using EXSIM (ventilation flow followed by dispersion simulation), or using a zone model to predict ventilation flow followed by a random-walk dispersion method. Transform functions at each receptor are calculated by running EXSIM for range of initial conditions. The idealisation of the module used in the SCOPE input is adjusted if necessary so that with the module fully filled with gas and ignition at the centre of the module would give the same median overpressure with both models. Example exceedance frequency and exceedance probability curves are given for pressure and impulse in the reference.
109
5.10.4
Mobil North Sea Methodology for Early Design Blast Analysis
Reference [66] describes four methods to allowing designers to select appropriate gas explosion overpressures for use in early stages of the design process when only a small number of simulations have been performed (one for each ignition point considered). The relationship between overpressures for clouds of different sizes and simplifying assumptions about the probability of ignition enable the construction of an exceedance curve for use in identifying design explosion loads in the most sophisticated method described. The guidance given is conservative in certain aspects in an effort to ensure that the estimated blast loads remain firm throughout the design process. Four separate approaches are described in ascending order of complexity. The first two approaches are hazard consequences based while the last two are risk based.
5.10.5
Simplified Methods for Pressure Exceedence Curve Generation
This method requires that two overpressure/probability of exceedance points are defined. These are then plotted on a graph with overpressure plotted on a linear scale on the horizontal axis and exceedance frequency plotted on a log scale on the vertical axis. The two plotted points are then joined by a straight line to give a simple relationship between overpressure and exceedance frequency. This method is based on the a priori fact that the statistics of random events such as explosions indicate that the intervals between such events will often have an Exponential distribution[94]. A recent (unpublished) paper by Yasseri [90] has processed the historical data on explosions in the North Sea given by Vinnem [95] and has shown that there is a good fit for the data to the exponential distribution. An exponential distribution gives a straight line for the exceedance diagram with the axes chosen. Possible methods of calculating the two required overpressure and frequency points include the following:
A point at zero overpressure corresponding to the probability of an ignited gas leak Prexpl . A high overpressure, low frequency event based on the ignition of a full stoichiometric concentration fill of the module Pult and its associated probability. A representative explosion overpressure at an exceedance frequency of 10-4 obtained using the COSAC software.
A suitable representative overpressure may be defined as the average of the highest 20 % of the peaks in any particular scenario. This definition is used to avoid distortion of the resulting curve resulting from the variability of local overpressures. A curve based on local peaks will be specific to the locations chosen. Figure 13 shows an exceedance curve generated in this way from a sample representative overpressure and frequency of exceedance obtained by simulation. If the sample simulation corresponds to the worst credible case with a full compartment of a stoichiometric gas cloud ignited in the worst position Pult., then the frequency of exceedance is the absolute frequency. The difficulty is the determination of this frequency and it is argued that this case is not a representative point to take.
110
It is preferred to take a representative sample overpressure nearer to the DLB at a frequency of exceedance of between 10-4 and 10-5 , however there is then the difficulty of estimating the frequency of exceedance, as there will be some cases where the overpressure exceeds this value each with their own frequency of occurrence.
5.11
5.11.1
Loads on piping and equipment

Load cases for piping and equipment response
Sub-clause 3.7.3 identifies three categories of criticality of safety critical elements (SCEs). The dynamic pressure loads should be evaluated on SCEs of criticality levels 1 and 2. SCEs of criticality level 1 and 2 should be assessed against the SLB, SCEs of criticality 1 will be assessed against the DLB as derived in the previous sub-clause. If the general level of dynamic pressure loads is not known then it is acceptable to take a load equal to 1/3 of the overpressure at the location for the DLB load case. The duration should be chosen so that the impulse matches that of the overpressure trace. This load must also be applied in the reverse direction. In open areas, such as the decks of FPSOs, these loads should also be applied in the vertical plane. The performance of the structure and SCEs for these scenarios must then be tested against the appropriate high level and equipment specific performance standards.
5.11.2
Dynamic pressure loads
The explosion loads on equipment items and piping which are classified as SCEs [45,53,96,97] must be determined and are referred to as dynamic pressure loads. These may also be obtained from CFD simulation results and consist of:
Drag loads (similar to the Morison drag loads experienced in fluid flow) proportional to the square of the gas velocity, its density and the area presented to the flow by the obstacle. Inertia loads proportional to the gas acceleration and the volume of the obstacle. Pressure difference loads.
Drag loads dominate for obstacles with dimensions less than 0.3m or on cylindrical obstacles less than 0.3m in diameter in particular in regions of high gas velocity near vents. Both drag and pressure difference loads are significant on objects between 0.3m and 2m in the flow direction. Exceedance curves for dynamic pressures may be developed from simulations and used in the same way as for overpressures in deriving design dynamic overpressures. The situation in Figure 15 represents an explosion in a module compartment. In this example all walls except the West wall are solid. The blast overpressure causes a pressure front to move from left to right from the point of ignition at about the speed of sound in the unburned mixture.
111
S E N W
West wall open
Explosion Vessel 70kN/m Overpressure load Dynamic Pressure Load
Figure 15 - Explosion within a compartment [98,99]
The unburned gas is pushed out of the module through the vented area with a velocity. This velocity will be available directly from a CFD simulation or by the approximate method given in the next sub-clause. The air ahead of this front is pushed out through the vent in the West wall over a vessel and pipe work spanning the vent giving the possibility of vessel or piping failure, with further release of inventory and consequent escalation. The gas velocities in this case will occur predominantly near the vent. The magnitude of drag forces on the pipe work (with diameter D typically less than 0.3 meters) at any time is given by the drag term in the Morison equation. The force should be calculated for engulfment of the obstacle in the burnt and unburnt gas mixture as the burnt gas/air mixture may be travelling at a speed of ten times the speed of the unburnt mixture even though the unburnt mixture is ten times denser. Drag coefficients are given in Czujko[13] and Reference [53]. Further details will be given in Part 3 of this Guidance. A typical time history for the drag load is shown in Figure 16 from Reference [97].
112
5000
4000 Drag (Pa)
3000
2000
1000
0 1.42 1.44 1.46 1.48 1.50 1.52 1.54 1.56 1.58 1.60 1.62 1.64 1.66 1.68 1.70 1.72 1.74 1.76 1.78 1.80
Time (s)
Figure 16 - Example dynamic overpressure trace
Two peaks are shown corresponding to the peak gas velocities ahead of and behind the flame front. In a vented compartment flow reversal of gases into the compartment could also occur at a later stage in the explosion. This would give a trace with a negative phase. Drag loads are particularly important in open areas such as on the deck structures of an FPSO. The gas clouds associated with explosions on FPSOs may be very large and gas velocities up to 500 m/s could be experienced. The direction of gas flow may also be very variable for example in the case of the pipe rack of an FPSO acted on by an explosion ignited at low level. Secondary projectiles may be a problem for FPSOs in view of the higher gas velocities. The drag loads may be used to represent the total force on obstacles with in flow dimensions less than 0.3m. For larger diameter obstacles or vessels, the pressure difference across the vessel will also need to be calculated and added to the drag force above. The IGNs [1] state that the validated methods for determination of loading due to blast wind are strictly only applicable to distant explosions: there is no equally established methodology for structures either within or close to an explosion typical of offshore geometry, in particular in the immediate vicinity of the perimeter of the enclosure where the explosion vents. These validated methods are based on TNT equivalent explosions with non-turbulent fluid flow at a distance allowing the use of Morisons Equation to determine the load on a body. Catlins paper describes some experimental validations of formulae for both vented gas velocity from a compartment open on one face and the loads on vertical cylinders in the vent area [100] .
113
5.11.3
Loads on Vessels[13]
It is possible to estimate an upper bound to the pressure difference force from an explosion pressure trace by assuming or from knowledge of the speed of propagation of the pressure disturbance. If the pressure pulse is considered to propagate with a velocity U then a time interval t may be associated with the diameter of the vessel D through:
t = D/U
The pressure difference across the vessel P may be read off the trace as indicated in Figure 17.
Overpressure (bar)
3.00
2.00
P
1.00
0.00
-1.00
t=D/U
-2.00
-3.00
0.900
0.950
1.000
1.050
1.100 Time (secs)
Figure 17 - Estimation of the pressure difference across a vessel from a pressure trace
This process is conventionally applied for the phase of the explosion where the vessel is in the unburnt air/fuel mix using the appropriate speed of sound. The part of the curve relevant to this calculation is that before the peak. Under these assumptions, this same load may be applied after the peak acting in the opposite direction. A time history of drag load may then be estimated. For piping the response to the drag load may be estimated using a single degree of freedom method such as the Biggs method described in sub-clause 6.8. This same model may be used to estimate the tension effects in one-way spanning blast panels discussed in sub-clause 6.8.
114
5.11.4
Loads on grating
Grating is often used for decking in an effort to allow venting of explosion gases. Tests [97] have shown that the force perpendicular to the grating may be calculated from a Morison drag formulation using the cross sectional; area of the grating presented to the gas flow.
5.11.5
Considerations in the use of CFD
In References [53] and [54] dynamic pressure loads were calculated using the conventional drag formulation given above and directly from CFD simulations, the Direct Load Measurement (DLM) method. In the DLM method, the pressure differential across equipment in each direction is taken from gauge (or measurement) points located on the up and down wind sides of the object and multiplied by the obstacle windage in each direction. It is recommended that this is used for objects greater than 0.3m in diameter. One problem with this method is that overpressures are generally recorded at the cell centres. This should not be a problem for objects large in relation to the size of the control volumes use in the simulation (3 times the cell dimensions). If the object is large and the gauge points are located at the centres of the object cross section then the computed pressure differential may be multiplied by 2/ to allow for the sinusoidal variation of load direction over the surface of the object. It should also be noted that the gauge points would not capture local pressure increases where the flow stagnates on the object if they are far from the obstacle in relation to the object diameter. This may add short duration loads (duration a few milliseconds) particularly a high Mach number flows. For intermediate obstacle sizes it is suggested that the CFD numerical grid be locally refined until the object is sufficiently resolved in the flow field. The DLM can then be applied. Alternatively, it is stated that near module vents forces calculated by the DLM and drag methods are similar. Near the centre of a module the loads on obstacles it is recommended in the references that both approaches should be used and the larger of the two loads used for design. It is unlikely that drag loads would in any case be large at these locations so the pressure difference approach is recommended in this Guidance. For the simulations considered during the referenced work, it was stated that the peak drag pressures were about 30 % of the maximum local field pressures and 60 % of the average overpressures experienced within the module. Methods for dealing with multiple objects that contribute drag forces to the total load on an item of equipment are briefly outlined [53,54], including a method for dealing with groups of objects that are partially shielded from the blast wind.
5.11.6
Estimation of Vented Gas Velocities [100,98]
For the situation of a vented compartment open at one end, with the ambient internal pressure and instantaneous overpressure is , the velocity of the unburned gas may be estimated using the Rankine-Hugoniot equations for the change in pressure and density across a shock wave [100]. There are only two published circumstances where explosion gas velocities have been measured:
115
1. The SCOPE experiments executed by Shell where gas velocities were measured directly 2. The Phase 3b tests where an instrumented cylinder was placed in the vent area of the Spadeadam test rig [83]. The general view is that in CFD codes the pressure and gas velocity is so closely linked at each point in space and time, that validation of pressure may be sufficient to assume that the gas velocities are being correctly calculated. The asymmetric expulsion of vented gases from a compartment may give rise to out of balance loads or strong shock response.
5.11.7
Strong Shock and Global Reaction Loads
The two major sources of out of balance loads from explosions are:
Reaction loads from the expulsion of vented gases. Side loads due to the ignition of an external gas cloud which has drifted to one side of the platform the external explosion.
During a vented internal explosion there may be an out of balance lateral force on the compartment depending on the distribution of vent areas around the module. Initially it seems that the out of balance force on the module will be equal to PA less any net forces on internal equipment, piping and vent obstructions. In fact the time for pressure disturbances to cross the module may be appreciable compared with the load duration and the inertia of the un-burnt products and external atmosphere will affect the net force. The net force on the gas volume contained in the module may also be calculated from rate of change of momentum of the enclosed gas. However, if the local speed of sound is exceeded then the flow becomes choked and a second shock wave front is set up at the vent, which will restrict the flow. Obstructions at the vent such as louvers may accelerate the flow locally and induce these standing shock waves. The backpressure for confined flow may be represented by a loss factor, which represents the loss of momentum encountered by the flow [100].
5.12
Reporting Template for ALARP demonstration
The following should be considered when preparing the final ALARP justification for the management of explosion hazards: Method of selection of explosion scenarios
Available inventories Hole sizes and leak rates Leak locations and directions Wind speeds, directions and ventilation rates Cloud build up
Summary of explosion scenarios considered
116

Gas type and concentration Cloud gas concentration, size, shape and location used in simulations Ignition point locations considered
Summary of explosion overpressure results
Peak/typical overpressures at a point and over structural panels Peak/typical impulses at a point and over structural panels Dynamic pressures
Method of derivation of design basis
Selection of equivalent static pressures if used. Conversion of typical overpressure/dynamic pressure time histories into equivalent triangular form, with justification that this form is appropriate Use of full typical overpressure/dynamic pressure time histories
Statement of explosion loads used in design
Structure, blast walls, decks Equipment Piping Far field blast
5.13
The NORSOK simulation
Procedure
for
probabilistic
explosion
The NORSOK Z-013 standard [12] describes a procedure for probabilistic explosion simulations. This procedure is based on an initiative started in 1998 by Norsk Hydro, Statoil and Saga to accelerate and harmonise the development of probabilistic explosion assessment tools. It is intended to be used for detailed analysis of platforms in operations or the project phases where the necessary detailed information is available for all design elements that will influence the risk picture. The procedure can be used to calculate exceedance curves for the overpressure and frequencies can be established for unacceptable explosion consequences. The procedure briefly also covers response calculation and consideration of overpressure mitigation methods such as deluge. One purpose of the procedure is to standardise the analyses so that the risk of explosions can be compared between different areas, installations and concepts, even if the analyses are performed in different circumstances and by different personnel.
117
The procedure is meant to be used for detailed analyses of platforms in operations or in the project phases where the necessary information on all design elements influencing the risk picture is available. In early project phases the project must be simplified according to the design information available, but the general structure and principles must be maintained. The amount of equipment shall be estimated based on equivalent areas in previous studies. Sensitivity studies shall be used to establish whether minor changes in amount of equipment, pressure relief areas and ventilation will change the gas explosion loads significantly. In cases where low loads are expected or where the structure has high strength so that larger conservatism can be accepted, the procedure may be simplified provided the conservatism is under control. In particular the methods described in the NORSOK standard Z-013[12] represent the most technically rigorous methods available at the time of writing and are the benchmark against which the methods used should be gauged. This Guidance is consistent with the underlying philosophy of the procedure but also aims to identify ways by which the volume of computation effort may be safely reduced.
118
6
6.1
RESPONSE TO EXPLOSIONS
Overview of explosion response
This clause is based on Reference [20] and deals with the methods of analysis of the response of structures, piping and safety critical elements (SCEs) to explosion loads derived following the methods given in the previous clause. Over the last ten years, many structures have been designed to resist uncertain explosion loads by the calculation of the capacity of the structure and the SCEs and the demonstration of robustness in the structure as reflected in an insensitivity of response to variations in load. This approach is to an extent scenario independent and may give added protection against unidentified scenarios and in particular combined fire and explosion scenarios. The robustness approach is still valuable and should be considered in addition to the more rigorous probabilistic methods described in this Guidance, which enable design explosion loads to be determined which should be accommodated by the structure and other SCEs. The methodology for the assessment of explosion response is illustrated in Figure 18.
119
Inputs Peak overpressures (DLB and SLB), durations/time histories, dynamic pressures Pressure exceedance diagrams, element specific performance standards Probability of late ignition of releases Structure geometry, Loads on SCEs and supports, SCE criticality levels From Explosion load determination
Structural Safety Critical elements
Safety Critical piping and equipments items
Check connections and reactions from decks barriers and SCE's to DLB loads
Use dynamic pressure loads From (4) above or estimate Ductility level and Strength Level dynamic pressure load = of DLB or SLB overpressure
Check primary structure to DLB - non-linear or modified code check method Check primary structure to SLB - elastic accidental load case Check secondary structure to DLB and SLB
Check SCEs and Supports to DLB and SLB Dynamic pressure loads
To Evaluation Outputs Response durations/time histories, peak response of structure and SCEs to design explosion loads, ductilities, displacements, stresses and associated probabilities. SCE criticality levels, rupture and associated probabilities, element specific performance standards, escalation targets
Figure 18 - Explosion response
Due to the extreme nature of the ductility level blast (DLB) loads, it is essential to prevent overall structural collapse but local failure may, however, be tolerated, as long as these do not lead to an escalation of the event, whether through progressive collapse, leakage of hydrocarbon inventory or failure of safety critical elements (SCEs). This places considerable emphasis on the requirements for structural and equipment robustness, i.e. ensuring that systems can absorb significant amounts of energy and be able to redistribute internal forces via the provision of adequate alternative load paths.
120
One way of achieving structural robustness, is to prevent premature failure by buckling and shear failures which may produce brittle, as opposed to ductile response. Adequate connections to adjoining members will ensure the ability to redistribute load and enable the structure to mobilise its ultimate capacity. The goal of robustness ensures that the structure has the ability to absorb some of the uncertainty in the loading to which it may be subjected. A review of the research in the area of response to explosion loads since the generation of the Interim Guidance Notes [1] , or IGNs, is contained in Reference [20].
6.2
6.2.1
Information required for explosion response calculations

General
Clause 5 describes the information which will be produced by the explosion loading specialists in order that an installation may be assessed for its ability to resist the explosion event.
6.2.2
Information from the explosion load simulations
For High risk installations, these will include:-
Pressure exceedance diagrams for each combustion zone. Identified strength level blast (SLB) and ductility level blast (DLB) load cases these should include special distributions of peak overpressure and overpressure time histories at critical locations. SCEs and their criticality levels Dynamic pressure exceedance curves for SCEs of criticality 1 for the DLB with time histories of dynamic pressures at these locations. Dynamic pressure exceedance curves for SCEs of criticality 1 or 2 for the SLB with time histories of dynamic pressures at these locations. Other overpressure and dynamic overpressure information for significant scenarios with similar frequency, where the loading pattern differs appreciably from the design explosion events. If this is not available then a range of likely durations should be supplied.
If exceedance curves are not generated then the probabilities associated with the design explosion events should be available. If time histories are not supplied load durations and general shape of the load time histories should be supplied. Low and some medium risk installations will only require the information for the ductility level blast explosion loads. A comparative assessment method may be used drawing on past experience from a demonstrably similar structure geometry and scenario. The nomination of a typical installation to represent a fleet of platforms is acceptable.
121
6.2.3
Other information from non-structural disciplines
The project should also supply
High level and system specific performance standards for evaluation of the results of the assessment. Layout drawings, including process, escape routes, muster areas, the TR, the SCEs and their support structures Any structural drawings and the location of tall structures which may become a hazard during escalation. Details of the assumptions for detection, control and mitigation systems, location and required availability. For dynamic response analyses, the location and masses of all major items should be supplied.
Further exceedance curves will be required from the explosion specialists for dynamic pressure loads, to enable the dynamic pressure loading on pipework to be developed. In order to determine the loading on large items of equipment or vessels, the required items can be identified to the explosion specialist for direct load extraction from the CFD model for various explosion scenarios. Alternatively, a less accurate, but also less time consuming method for the explosion specialist, is to provide generalised pressure-time histories for the equipment locations, together with the speed of travel of the pressure wave. The structural engineer then determines the maximum pressure difference between locations of known separation, having determined the time taken for the wave to travel that distance. If the general level of dynamic pressure loads is not known then it is acceptable to take a load equal to 1/3 of the smoothed peak overpressure at the location for loads on the relevant SCEs and piping. The duration should be chosen so that the impulse is matched to the positive phase of overpressure trace. This load must also be applied in the reverse direction. In open areas, such as the decks of FPSOs, these loads should also be applied in the vertical plane.
6.2.4
Overpressure load considerations
It should be borne in mind that the design explosion loads represent only one of many scenarios and that the reliance on a particular overpressure time history or spatial distribution of overpressure is not advised. The fact that the detail of a given load distribution is only one of many possible scenarios also implies that reliance should not be put on the apparent result that some parts of a blast wall for instance seem to receive less load than others, as a different ignition point may give rise to a different distribution of load. It is therefore not acceptable to design adjacent areas to different pressures without justification. The structural engineer should develop the idealised pressure-time histories for various pulse durations in order to capture the range of dynamic response for the various components of the system to be designed or assessed or preferably use a representative range of overpressure time histories directly if they are available.
122
If a range of pressure time histories is not available then extrapolation of the range of durations supplied should be investigated. The peak pressure/duration relationships [86] given in subclause 5.8 may be used to estimate the peak overpressure for shorter duration loads. The peak averaged overpressure is plotted against impulse in Reference [86]. It is accepted that the design overpressure for the design of a panel will be greater than that for a section of a blast wall which will in turn be less than that for a whole wall. This is a result of the fact that the pressure disturbance is of finite extent relative to the target and hence the averaged pressure will vary with target dimensions. The explosion load specialist may supply a lower level of design load for an extended structure (deck or wall) than for a blast wall. Reference [89] gives a simple method of deriving scale factors. The approach should be applied with care as the direction of travel of the overpressure pulse relative to the target affects the way the pulse is reflected. The approach is suitable for large deck areas or if sufficiently detailed information on the loading pattern is available. In modelling the response of a structural frame, it is conservative not to model the cladding or plate as the shear restraint from such surfaces may be overestimated. The overpressure load on a plate may be applied directly to the bounding members of the plate using the area tributary method. For example the loads on a square plate may be applied to the bounding framing members with one quarter on each, for a rectangular plate the members on the long edges would receive a load proportional to the triangular area joining the edges with the plate centre.
6.3
6.3.1
Response considerations
Elastic Dynamic response
Most of the loads resulting from an explosion are dynamic in nature hence dynamic response must be considered unless some form of equivalent static load can be justified. This sub-clause deals with elastic dynamic response where the primary structure remains elastic during the explosion event. This may be a system specific performance standard for the temporary refuge (TR) primary structure for example. Elasto-plastic response of components is considered in sub-clause 6.8 where Biggs method is discussed [101]. The response of a structure to a dynamic load is commonly characterised by the ratio of the load duration td to the natural period T of the structure. Depending on the value of this ratio, three response regimes are defined, denoted as either impulsive, dynamic or quasi-static. Table 6.1 is a modified version of the one in the IGN to reflect more recent work published in NORSOK [102] and summarises the influence of the loading characteristics on response in the three regimes.
123
Table 6.1 Regimes of dynamic response Impulsive td/T < 0.3 Peak Load Preserving the exact peak value is not critical Preserving the exact load duration is not critical Dynamic 0.3< td/T < 3.0 Quasi-static td/T >3.0
Preserve peak value the response is sensitive to increases or decreases in peak load for a smooth pressure pulse Preserve load duration since in this range it is close to the natural period of the structure. Even slight changes may affect response. Accurate representation of the impulse is important. Not important if response is elastic, but is critical when response is plastic.
Duration
Impulse
Accurate representation of impulse is critical. Preserving rise time is not important.
Accurate representation of impulse is not important.
Rise Time
Preserving rise time is important; ignoring it can significantly affect response.
This table assumes that there is some identifiable natural period for the structure, which indicates that a Single Degree Of Freedom (SDOF) idealisation of the structure is possible. Multi-Degree Of Freedom (MDOF) systems may have a large number of modal periods associated with them, although it is often possible to identify a mode or shape of response with each modal period. If the loading is impulsive much higher peak loads can be tolerated than the static capacity of the target. The limits specified in the Table above have been changed to correspond to those in the Norsok standard [102] . The impulse duration ratio at the impulse to dynamic boundary has been reduced from the 0.4 and 2.0 values given in the IGNs. The Dynamic Amplification Factor DAF (dynamic/static response) does not approach unity for a triangular load pulse until a value of between 5 and 6 is attained. It is important to note that although the load duration may be long, the rise time may be short and this can cause significant dynamic amplification as may also be seen in Figure 19 taken from Reference [103] for the sharp fronted pulse shape..
124
2.4
Rectangular
2.0
Half sine wave

1.6
Triangular
D y namic magnific ation factor,
D
1.2 0.8 0.4 0
0.2
0.4
0.6
0.8
1.0
1
1.2 /T
1.4
1.6
1.8
2.0
Impulse length ratio,t
Figure 19 - Shock spectra [103] (elastic response)
6.3.2 Idealisation calculations
of
overpressure
time
histories
for
response
For some design applications a simplified form of pressure-time history is required. The usual method is idealization of the pressure time history into a triangular form with a positive phase only. Figure 20[1] shows the conventional idealization of a pressure trace.
O verpressure (mbar) 2000
1750
Maximum overpressure (> 1 ms duration) (PMAX )
1500
1000
750
500
250
10 % of maximum overpressure 320 340 350 tr td 380 400 420 Time (ms)
Figure 20 - Idealised pressure trace for a hydrocarbon explosion [1]
125
For determination of deck response to an explosion from below, it is important to represent the negative phase of the loading to enable the calculation of rebound. This form is not characteristic of far field blast waves outside a compartment. A typical trace for this case is shown in Figure 8. The single peak idealization shown in Figure 20 will not apply when external explosions are involved or when there are two paths to the observation point or in some cases of explosions in the moonpools of FPSOs. There are also concerns that the sharp changes in slope in the idealization introduce spurious frequencies into the exciting force and that it is preferable to use the original pressure traces from CFD or use some spectral approach. These topics are under investigation and will be dealt with in detail in Part 3 of the Guidance. Reference [104], discusses the accuracy of various methods of idealization of pressure pulses.
6.3.3
Equivalent static loads
During early design stages, the use of equivalent static explosion loads is generally acceptable to allow progression of the primary structure design using a global static overpressure. It is important that consideration is given to the impact of the dynamics on these loads. The use of Figure 19 is only applicable when elastic response is expected and the structure does not yield locally. For plastic deformations the dynamic amplification factor has a restricted meaning, as a static load which causes yielding would deform the structure without limit. A Dynamic Amplification Factor (DAF), , should be calculated for all loaded members such that the equivalent static load, Lstatic, is related to the peak dynamic load, Lpeak, by: Lstatic = Lpeak For single structural components may be as much as 2, for typical large structures such as module and topside structures, the natural periods are likely to be longer with DAFs less than one. An equivalent static load may be obtained from consideration of the modes of response of a MDOF structure and by choosing the mode (and modal period) corresponding closely to the expected shape of the response if this is available. A DAF may then be calculated for this form of response. Another technique is to perform a simplified dynamic analysis and find an equivalent static load distribution which gives similar displacements to the peak dynamic response. This only applies for elastic response but may enable code checks to be performed using conventional software. The DAF obtained for an extended structure and the appropriate design load may not be applicable for member or local checks. For plastic deformation a time history simulation may be used to estimate the DAF including plastic response using Biggs method described in 6.8.1. For example consider an explosion overpressure of 1.5 bar with a duration of 150 ms as the design load condition. A triangular profile may be appropriate as shown in Figure 20. This can then be translated into transient dynamic response as shown in Figure 21.
126
Transient Dynamic SDOF Response

0.0025
Static Response
0.0020
Dynamic Response
Displacement (m)
0.0015
0.0010
0.0005
0.0000 0.000
0.050
0.100
0.150
0.200
0.250
0.300
0.350
0.400
Time (second)
Figure 21 - Sample SDOF dynamic response
The example presented here indicates that a dynamic amplification factor of 1.125 for a scenario with a duration of 150 ms and for an element with a natural period of 50 ms. For a scenario with load duration 50 ms or for a member with natural period of 150 ms the corresponding DAF would be about 1.9. The equivalent static load is that would cause similar response to the blast impulse. This equates to static overpressure loads between 1.68 bar and 2.85 bar for the static design load conditions. The method could be refined to take account of the variation of impulse and duration with peak overpressure given in sub-clause 5.8.
6.4
6.4.1
Material properties for explosion response

General
The expected large deformations resulting from and explosion and the dynamic nature of explosion loading means that strain rate and strain hardening of the material may occur locally. The treatment of material properties in Reference [20] is at a level more appropriate to Part 3 of the guidance, only a brief summary is presented here. Further detailed information may be found in References [105] to [7].
127
6.4.2
6.4.2.1
Static material properties

General
In a design or assessment project, if detailed and precise material data is available then potentially a more economical design can be achieved. However in most design situations the engineer will typically have to rely on generic data specified in the relevant standards. In the special case of modifications to existing platforms (brown-field projects) mill certificates for the employed steels should be available. As a minimum these certificates will contain useful experimental results obtained from tensile coupon tests on the yield strength, the tensile strength and the rupture elongation of the steels. It should be emphasised that when performing a structural analysis the materials are often assumed to have a limiting strain well below their fracture strain. The reason for this is partly to allow for deficiencies in the adopted analytical modelling tools, and partly to allow for variations not explicitly covered in the geometric and physical description of the structure. As an example the influence of specified tolerable variations in the dimension and mass of the structural components as well their alignment are seldom incorporated into the analytical model. Also local buckling of compression elements and localised necking of tension elements are in general not automatically captured, except by the most sophisticated and detailed of the analytical tools. According to the IGNs [1], the limiting strain can be set to 5 % for a member in tension as well as for a member in bending or compression with a plastic cross-section. The quasi-static stress-strain curve for a typical structural steel specimen tested in accordance with standard tensile test procedures, such as those described in BS EN 10002-1:2001 is typically characterised by four distinct phases:
from the onset of loading, until reaching the upper yield stress, the stress-strain behaviour of the specimen is nearly linear elastic with a modulus of elasticity of about 205,000 N/mm2. hereafter, it follows a rather sudden stress drop down to a lower yield stress, where it remains for a while as the deformations continues to develop, until strain hardening to rupture.
With respect to the upper yield it is known that stress concentrations and welding both have a tendency to reduce if not remove it. However, for the purpose of designing connections and supports against dynamic loading, ignoring the upper yield stress could prove unsafe. In contrast, when designing the individual structural members it is safe to ignore the upper yield stress. The yield plateau, which typically terminates at strains at least 10 times larger than the initial yield strain, is followed by a phase of strain hardening at a continuously diminishing rate until reaching the ultimate stress-strain point. It is interesting that according to the guidelines given in the EC3 Part 1.2 draft code for structural fire design the ultimate strain of structural steel can irrespective of the temperature be set to 15 %.
128
The specific and current mechanical requirements to structural steels to be used in the fabrication of fixed offshore structures are given in material standards [108]. This standard, which has superseded the recently withdrawn BS 7191: 1989, specifies the requirements to variations of the steel grades S355, S420 and S460. These steels are all suitable for installations in the North Sea sector. Typical limiting values for some of the mechanical properties specified in EN 10225 for grade S355, S420 and S460 steel are listed in Table 6.2. Table 6.2 Mechanical properties typically specified for structural offshore steels Name S355 S420 S460 Reh N/mm2 355 420 460 Rm N/mm2 470 630 500 660 530 720 Af % 22 19 17
It should be noticed that the minimum yield strength Reh refers to the upper yield strength. The requirements to the tensile strength Rm is given in terms of an upper and a lower limit, and the ductility in terms of a minimum rupture strain Af. The rupture strain is measured over a gauge length of 5.65S0 , where S0 is the original cross-sectional area of the test piece. In situations where the yield phenomenon is absent the yield strength should replace this parameter with the 0.2 % proof strength Rp0.2. It should be emphasised that the actual yield strength of steel frequently is significantly larger than its guaranteed minimum value. In the case of the high quality offshore steels tested in Reference [109] the upper yield strengths were measured to be up to 26 % larger than their guaranteed value, with an average of about 13 %. Such differences between the guaranteed and the actual yield strength need to be accounted when estimating the magnitude of the forces transferred through the joint details into the supporting structure.
6.4.2.2
Stainless steels
Compared to carbon steel the stress-strain curve for stainless steels are characterised by a smooth rounded response with no definite yield point. Another major difference in the mechanical performance at ambient temperature between the two types of steel is the improved ductility of stainless steel. Table 6.3 lists typical values for the mechanical properties of various stainless steels as specified in Reference [110]. As is the case for carbon steels, the actual yield strength, here taken as the 0.2 % proof strength, is usually significantly larger than the minimum specified in the standard. For the experimental test series described in Reference [111] the measured proof strengths were in average observed to be 28 % larger than the specified minima. Furthermore, the mechanical requirements given in the table refer to material in the annealed condition. Thus in situations where the structural elements will be subjected to some degree of cold forming without a following heat treatment, the yield strength in the work hardened zones need to be adjusted upwards.
129
Table 6.3 Mechanical properties typically specified for stainless steels Name 1.4404 (316L) 1.4401 (316) 1.4362 (2304) 1.4462 (2205) Rp0.2 N/mm2 220 220 400 460 Rp1.0 N/mm2 260 260 Rm N/mm2 520 670 520 670 630 800 640 840 Af % 45 45 25 25
Strain hardening should always be accounted for when designing for the dynamic reaction forces, whereas it safely can be ignored when designing section sizes.
6.4.3
Strain Rate Effects
It is well known that the stress-strain characteristics of steel depend on the rate of straining, and that, at least until the onset of strain softening, an increase in the strain rate increases the stresses corresponding to given strains. The more precise effect that high strain rates have on the stress-strain characteristics of a given steel quality is a complicated function of its temperature, chemical composition and internal microstructure. However in general it is the case that the more the steel can be strengthened by heat treatment or cold working the more sensitive its mechanical behaviour is to an increase in the strain rates. Strain rate sensitivity is traditionally expressed in terms of the Dynamic Increase Factor (DIF). For a given strain rate and a given material property the DIF is defined as the ratio between the value of the material property measured under dynamic and quasi static loading conditions, strain rates of 2.5x10-3 s-1 .As a consequence the tested value will typically be about 8 % larger than the long term yield strength. In general the dynamic testing of steel specimens has shown that the elastic modulus is unaffected by strain rates, and that the strain rate sensitivity decreases with an increase in the plastic strain. It is also generally accepted that the strain rate effects are the same whether the material is loaded in tension or compression, and that the Dynamic Increase Factors are isotropic in their nature. Although an increase in the rate of straining reduces the fracture toughness of steel it is unlikely that the strain rates associated with hydrocarbon explosions will significantly reduce the fracture toughness of the high quality structural steels used for offshore installations. One of the most used models to describe the rate effects on the yield strength is the Cowper Symonds model:
f yd fy
1/ q = 1+ D
Table 6.4 [111,1] lists the coefficients D and q recommended for calculating the dynamic yield strength of various structural steels.
130
Table 6.4 Coefficients D and q for dynamic yield strength Material Mild steel Stainless steel (304) Stainless steel (316L Stainless steel (2304) Stainless steel (2205) D s-1 40.4 100 240 3489 5958 q 5 10 4.74 5.77 6.36
Figure 22 compares various empirical models with experimental data. The experimental data for stainless steels were taken from Reference [7], and for high quality carbon steels suitable for fixed offshore installations from Reference [1]. For typical steel structures, the strain rates associated with hydrocarbon explosions will seldom exceed 1 s-1. This compares with the strain rates of 103 s-1 frequently encountered in metal working processes and hard impact situations. However the risk of employing the Cowper Symonds formulation to fit experimental strength data is the loss of some accuracy for the strain rates which are most relevant to gas explosion scenarios. For strain rates less than about 1x103 s-1, an essentially linear relationship between the stress and the logarithmic strain exists. It should be mentioned that the strain rates vary both spatially and temporarily within a structure. Thus when performing a non-linear finite element analysis it is necessary to know the complete stress-strain behaviour at all encountered rates. Likewise it is assumed that all conclusions regarding the uniaxial stress state can be generalised to the multiaxial stress state.
1.6 1.5
Test data for BS 7191 grade 355 and 450 steels Upper Yield Strength ratio Lower Yield Strength ratio
Mild Steel
316L
2304 2205
Dynamic increase factor
1.4 1.3 1.2 1.1 1.0 0.9 0.8 1E-006 1E-005 0.0001
0.001
0.01
0.1
10
100
1000
strain rate s-1

Figure 22 - Strain rate effects on typical offshore steels
131
6.4.4
Strain hardening
Strain hardening may also be taken into account for tension members and plastic sections by taking design strength to be the ultimate strength divided by 1.25 [1] . This effect should not be considered when designing supports against reaction forces. It is, however, necessary to demonstrate that the strains are high enough to mobilize the benefits of the strain hardening. The following groups of structural members may sustain high plastic strain without losing strength from local or overall buckling.
Tension members Members in axial compression or in bending and axial compression whose slenderness ratio does not exceed 15 and the cross-sections comply with the criteria of compact section Members in bending whose cross-sections comply with the criteria of compact section and whose slenderness ratio () does not exceed certain values.
6.5
6.5.1
Structural performance standards

Introduction
A performance standard is a statement which can be expressed in qualitative or quantitative terms of the performance required of a system, item of equipment, person or procedure and which is used as the basis for managing the hazard. High level performance standards have been given in Part 0, Fire and Explosion Hazard Management, they are reproduced below. In an explosion event, at least one escape route must be available after the event for all survivors. For a manned platform a Temporary Refuge (TR) or Safe Mustering Area must be available to protect those not in the immediate vicinity of an explosion and to survive the event without injury. For the ductility level blast (DLB), the primary structure should not collapse with escape possible from safe areas after the event. Safety critical elements, defined as those elements critical to safety [30,31], should have fulfilled their function or remain operational. Plastic deformation of the structure is acceptable provided collapse does not occur and barriers remain in-place and are able to resist any subsequent fires. The ability of the structure to satisfy these requirements will depend on its ability to respond in a ductile manner and the ability of the barrier connection details to respond without rupture. The frequency with which accidental events, from all causes, will result in loss of TR integrity within the required endurance time will not exceed 10-3 per year [32]. The required endurance time is the estimated time for people to travel from their work stations to the TR, then to the primary and secondary means of escape, allowing for the possibility of helping injured colleagues. Performance standards may also be referred to as acceptance, screening or performance criteria.
132
A Safety-critical element (SCE) is defined as, any structure, plant, equipment, system (including computer software) or component part whose failure could cause or contribute substantially to a major accident is safety-critical, as is any which is intended to prevent or limit the effect of a major accident. In addition to the high level Performance Standards above it will be necessary to define measurable performance standards for specific key items or systems relating to the systems functionality, availability and survivability. These are referred to in this document as element specific performance standards used in the evaluation stage of the explosion assessment. These are sometimes referred to as low level performance standards.
6.5.2
Criticality categories for SCEs
It is helpful to consider a hierarchical approach to the identification of SCEs. It is suggested that the number of SCEs (systems, equipment or functions) requiring detailed assessment are classified into three levels of criticality with respect to the explosion hazard as below. Criticality 1 Items whose failure would lead direct impairment of the TR or emergency escape and rescue (EER) systems including the associated supporting structure. Performance standard These items must not fail during the DLB or SLB, ductile response of the support structure is allowed during the DLB. Criticality 2 Items whose failure could lead to major hydrocarbon release and escalation affecting more than one module or compartment. Performance standard These items must have no functional significance in an explosion event and these items and their supports must respond elastically under the strength level blast (SLB) Criticality 3 Items whose failure in an explosion may result in module wide escalation, with potential for inventories outside the module contributing to a fire due to blowdown and or pipework damage. Performance standard These items have no functional significance in an explosion event and must not become or generate projectiles. As is common in the design of structural systems under other forms of accidental loading, e.g. earthquakes, performance criteria for the DLB are set such that permanent deformations can occur, but overall collapse is prevented. In addition to this is the requirement that the explosion must be contained, in order to prevent an escalation of the event. Consideration needs to be given to limits of deformation, as determined by the location of pipes and equipment and to the performance of these items. The limits specified for the structural elements should not exceed those required for the supported or adjacent equipment to function adequately. Performance levels for structural elements, that are normally considered, are:
Strength Deformation limits Local and Global ductility Rupture
133
Global collapse
This guidance document recommends two levels of structural assessment, strength level analysis for the SLB and an ultimate capacity analysis or ductility level analysis for the DLB. The performance standard relating to strength of members is more suitable for the strength level analysis, as this is predominantly a stress based check using static design codes. For the DLB, ultimate capacity check the yield stress limit will be exceeded and member stress is not appropriate for judging member response. At the ductility level, deformation limits are normally adopted.
6.5.3
Deformation Limits
Deformation limits for structural elements are normally specified in terms of deflections, often given as a ductility ratio defined as the ratio of the maximum displacement of the element to the deflection required to cause first yield at the extreme fibres. This is a global deformation parameter, which is commonly used in a Single Degree of Freedom (SDOF) model. A local ductility parameter may also be defined in terms of the support rotation. For a class 1 section, Reference [112] allows a limiting support rotation of 2 degrees and a ductility factor of 10 (whichever governs) as reasonable estimates for absolute values to ensure safety for personnel and equipment and consistent with maintaining structural integrity in the inelastic range. It should be noted that such levels of ductility will have design implications for members containing plastic hinges to ensure the ductility levels can be achieved. This is normally achieved by providing lateral restraint at hinge locations to the unbraced compression flange (Part 3 of the Guidance Document will cover these details). Norsok standard Annex A, N-004 [113] gives the range of allowable values of depending on the section classification assuming no axial restraint to the beam and the boundary conditions. This is given in Table 6.5. Table 6.5 Allowable ductility values [113] Boundary Conditions Cantilevered Load Concentrated Distributed Concentrated Distributed Concentrated Distributed Cross-section category Class 1 6 7 6 12 6 4 Class 2 4 5 4 8 4 3 Class 3 2 2 2 2 2 2
Pinned
Fixed
Consideration of attached fire protection may impose a lower limiting strain or deflection. The displacement of the component must also be limited to prevent impacting SCEs and equipment items.
134
6.5.4
Rupture
Structural integrity is often assessed using strain limits, which if exceeded would cause rupture. Current guidance on allowable strain values are to set the critical percentage strain limit at 5 % at weld locations and 15 % in the parent material away from welded details. These values refer to average local strain values. However it is important to be aware that strains at this level are quite sensitive to a number of parameters and tests show a significant scatter of strains at fracture. The Norsok Standard [113] highlights a number of factors which influence the strain values such as material toughness, presence of defects, strain rate and presence of strain concentrations. Strains are normally adopted as a failure criterion when using finite element models to judge response. It should be noted that variations in strain are quite common depending on the modelling assumptions used and care in interpreting these values at critical points is required.
6.6
6.6.1
Structural assessment
Introduction
The degree of complexity adopted in establishing the response of the topside requires considerable engineering judgement at an early stage in order to avoid unnecessary delays in the design process. Screening of various options for blast walls or potential behaviour of walls and decks under a number of explosion scenarios requires cost effective, reliable and accessible solutions. In many cases this may mean that complex Non-Linear Finite Element Analysis (NLFEA) is unlikely to be an option in the early stages of the design cycle unless planned well in advance. Once the design has matured and safety critical elements of the structure have been identified, NLFEA is likely to be required to verify the design. For retrofit systems, it may be important to obtain the ultimate capacity at an early stage which may require a more refined analysis at the outset. This will assist in determining the degree of retrofit required although other factors such as shutdown period if hot work is required and space available will also influence the options available. It is also important to bear in mind that simple models may not give a satisfactory design for large overpressures as many of these tend to rely on bending capacity from a static analysis with some form of load factor to account for the dynamic response.
6.6.2
Design Criteria
In order to decide on the level of assessment that is required for various parts of the structure and at different stages of the design process, the philosophy for the explosion design cases and corresponding performance standards need to be established. The extreme loading applied to a structure during an earthquake is often compared with an explosion event on a topside due to the small probability of occurrence. Also, many of the concepts used in design for earthquakes[112] such as attention to detail to connections and ductility requirements apply equally to topside explosion response. For earthquake design it is common to consider two load cases for the design of structures and equipment: 1. For a frequent earthquake with low seismic forces, the structure or equipment should remain undamaged. For the structure this is essentially a serviceability check and must remain elastic.
135
2. For a strong rare event, the structure can sustain damage but overall collapse should not occur. - definition
In blast mitigation applications the prime objective is often energy absorption and not static strength, particularly for the extreme low probability scenarios, although limiting deformations need to be set in some parts of the structure which may be influenced by plant, equipment and piping. In general, increasing the stiffness of a structure can result in local stiff points which attract high loads and lead to brittle failure modes which may compromise the integrity of the whole system. Undesirable modes of failure are:
Those resulting in an overall collapse of the structure Those involving sudden brittle failure such as local buckling
By analogy with the approach used to assess structures for their ability to resist earthquakes, two levels of explosion loads are recommended for explosion assessment. The strength level blast (SLB) and the ductility level blast (DLB) obtained from consideration of exceedance curves or from the use of derived nominal overpressures as discussed in sub-clause 5.7. The SLB may be typically in the region of 0.5 0.6 bar. It should not be less than the 0.34 bar, which is given in the building code [114] as a minimum lateral pressure to be resisted by walls in order to achieve a minimum level of robustness in the connection details.
6.6.3
Strength Level Blast (SLB)
One aim of this approach is the use of existing design codes which are predominantly based on static design, with enhanced factors to allow for the material properties due to strain rate effects and differences between guaranteed minimum yield strength and coupon tests. This is likely to involve simple numerical models such as the Biggs SDOF idealization [101] or a static finite element analysis for the primary steelwork. The use of simple models will allow a rapid assessment of the suitability of the layout of the primary steelwork and the screening of a number of pressure time histories to establish the bounding case from the loading. Performance standards based on design strength are adopted for assessment with this loading level. It is important to be aware of limitations of this approach: 1. Design codes are based on static design and not dynamic loads. This is particularly important when checking members in compression as buckling is a time dependent phenomenon which may invalidate some of the static code checks. It is essential to allow for the enhanced reaction forces at connection details due to the enhanced yield stresses which may occur. Membrane forces may occur in some elements which may not have be accounted for in some code checks
2. 3.
6.6.4
Ductility Level Blast (DLB)
At this load level, permanent deformations due to yielding are acceptable. For parts of the structure which need to contain the blast, care needs to be taken to ensure that they remain intact to prevent an escalation of the event. Some local rupture of structural elements can be tolerated if it can be shown that progressive collapse will not occur.
136
In some cases a maximum deflection limit may be specified to avoid compromising supports to vital equipment or pipework, which may lead to an escalation of the event. The adequacy of components is checked against performance criteria based on maximum deformation and strain rather than strength. Analysis of this level of deformation inevitably requires the use of more complex analytical tools, such as non-linear finite element techniques which are capable of modelling large deformation and strain. It is also important to capture the effects of interaction of the structural elements as a system, in order to assess the possibility of a global collapse mechanism occurring. Uncertainties still exist at such large strain values, which are inevitable in many instances, and care needs to be taken when interpreting the results of non-linear analyses.
6.6.5
Dimensioning Explosion
Dimensioning explosion loads[89,115,116] are of such a magnitude that when they are applied to a simple elastic analysis model, the code check results in members dimensioned to resist the worse credible event or ductility level explosion. This approach has largely been superseded by the modified code check method described in sub-clause 6.10.5. The definition of the SLB in this guidance may also serve to perform this check for the DLB with the more stringent requirement that the stresses in the primary structure remain below yield. Joints, panels, barriers and connections still need to be checked against the DLB directly preferably using a non-linear elastic plastic method of analysis.
6.6.6
The simple demonstration of ALARP
One method of the demonstration of ALARP using a strength level analysis is to apply a static pressure load to the structure and observe, through code checks, when member failures occur. If the pressure is then ramped up in stages, there will come a point where the incidence of failures rapidly starts to increase and begins to take in the majority of the members. At this point it may be argued that it would be unreasonable to strengthen or change the member properties as it would impact on members designed by the other load cases. Design to this equivalent static pressure could then be said to be ALARP. It is, however, unlikely that the differing levels of response to dynamic loads at the same peak level as determined by the natural periods of the target structural elements will be adequately represented without undue conservatism. The variability of pressure in the explosion load cases is also not represented in this method. The validity of this method will depend on the severity of other load cases which have been used in the original design of the structure.
6.6.7
General remarks on structural response
Yasseri [88] recently published an article in the FABIG newsletter where a useful hierarchy of structural systems was described. Components which were subjected directly to the blast, such as walls, deck plating including stiffeners and cladding are defined as the secondary system. The primary system is defined as those elements which have blast loads transmitted to them from the secondary system and consists predominantly the primary structure typically consisting of plate girders, beams, columns and trusses. For the primary structure, which is crucial to the survivability of the structure under the extreme load condition, it is necessary to ensure that it remains predominantly elastic in the overall failure mode and parts of the structure that are allowed to yield are detailed for high ductility. This will be predominantly the blast walls and plating, which if allowed to deflect will reduce the loads transmitted to the primary framing.
137
This places emphasis on the connection details, which need to be assessed for large rotations in order to achieve a robust structure. The overall aim of the philosophy in this clause is to ensure that the concept of robustness is built in at an early stage. At the strength level blast, the structure should remain elastic and the structure should have enough ductile capacity to survive the ductility level blast load case.
6.7
6.7.1
Response prediction methods

General
Several techniques of varying complexity are available for predicting the blast response of topsides. These range from simple hand calculations and graphical solutions to more complex 3-Dimensional computer models capable of modelling geometric and material non-linearity, tearing of welded connections and contact with other parts of the structure or plant and equipment. However, with all of the models available, a considerable degree of engineering judgment and experience is required in order to convert the real structure into the idealised model. The general philosophy is to start with the simplest methods (ensuring a conservative approach) and if failure is indicated, proceed to more sophisticated methods of analysis. The three main levels of analysis are: 1. 2. 3. Screening analysis Strength level analysis Ductility level analysis
These are described below in sub-clauses 6.7.1 to 6.7.3. The following may enable simplifications to be made in the analysis method. Non load-bearing elements, typically panels, fire walls, and blast panels may be checked in isolation. The stresses in panels and cladding usually dominate the stresses due to frame movement. Panels and some blast wall systems may be conservatively idealized as one way spans. Resistance displacement curves may often be determined statically, dynamic response may then be determined using a modified Biggs [101] method. Dynamics of simple structures may be represented with knowledge of dominant natural period. Biggs method extensions are available for loaded components [98] . It is preferable to model the primary structure response to the SLB using an elastic frame model as single member assessment does not take into account the transfer of loads between connected loaded surfaces and any co-existent static loads. It is preferable not to include nonstructural cladding and plates in the model as their response is mainly in membrane action and their shear strength may be overestimated.
138
6.7.2
6.7.2.1
Screening analysis
Condition assessment
Screening analysis for an existing installation consists of condition assessment which may involve a survey followed by design basis checks. The transfer of conclusions and load characteristics from the analysis of a similar platform is acceptable for this and for Strength level and ductility level analyses.
6.7.2.2
Design basis checks
Design basis checks consist of checking the basis of design for the installation and determining if the methods used for the design are acceptable in the context of the fire and explosion events considered. If the structure and appurtenances have been checked for a Safety level or Ductility level earthquake loads following API RP 2A [47] (9th Edition sub-clause 2.3.6e.2 or later) then the strong vibration response to explosions need not be checked.
6.7.2.3
Component checks
Component checks may be employed if the component is non-load bearing in the operational condition or if the component does not form part of the main framing. Methods of dynamic response assessment such as Biggs method [101] may be used as described in sub-clause 6.8.2. Where loads from connected structures are represented component check methods may be employed. There are however many limitations on the method which are discussed in subclause 6.8.3. A major consideration in explosion response is that deflections of the structure must be limited to allow escape. Typically the deflections into escape ways should be limited to about 150mm. The allowable deflection into equipment spaces will depend on the clearances to equipment. The deflections of the Primary structure will normally be satisfactory if it passes the normal strength or utilization checks. Blast and firewalls are however designed to deflect to exploit the ductility of these items and so deflection checks for these items will be necessary. Buckling checks must also be performed to ensure that the full plastic capacity of a member can develop.
6.7.3
6.7.3.1
Strength level analysis

General
The integrity of an offshore structure may be checked using a linear, elastic, beam model. It is conservative not to include the restraint from the cladding or barriers in the primary frame computer model. In some circumstances it is advisable not to include the cladding as plate elements as the shear restraint from these elements will be overestimated in a small deflection elastic model. This applies particularly if an external explosion load is considered which puts the side walls with respect to the pressure into shear. In a dynamic analysis the masses and their distribution should be included in the model. In checking the primary structure it is conservative to include the loads from barriers but to ignore their strength contribution.
139
The response of cladding panels and plates that form part of the primary structure may be analyzed in detail using finite element analysis assuming the supporting beams are fixed at the main nodes of the structure. The justification for this is that the stresses in the panel are dominated by local response of the panel out of plane and that the stresses induced by the deflection of the main framing are comparatively small. If necessary this assumption can be checked by application of prescribed displacements to the edge of the panel corresponding to the frame response. Buckling checks must be performed to ensure that the full plastic capacity of a member can develop. These checks should be made particularly for deck beams loaded from an explosion below as flanges usually in tension may be in compression during the explosion. These checks should ideally be performed using the loads for the DLB and SLB load cases. Deck beams loaded by an explosion below should also be checked for re-bound effects.
6.7.3.2
The inclusion of static loads
An equivalent static load as described in sub-clause 6.3.3, will need to be defined for application of explosion loads as a static load case. The dead loads in the structure need to be combined with a realistic estimate of live or operating loads to perform a strength level analysis treated as a design load case. Environmental loads need not be included. API [47] recommends that 75 % of the live loads are included in the combination for the earthquake analysis. It is recommended that the same proportion of live loads are taken for the explosion load case. The loads from an existing fatigue analysis load case may also be suitable.
6.7.3.3
Code checks for Strength level analyses
Blast resistant structures and their supports are designed to respond in a ductile way to explosion loading mainly in bending. The shear behaviour of structures at their supports and in the joints of the primary frame will also affect the utilization factors derived in the code checks. The safety factors implicit in the code checks will be different from those associated with bending. Shear strains at supports should generally be limited to the elastic limit. Additionally, for a dynamic situation these shear forces will be quite different from the values obtained by static analysis as a result of the inertia forces acting on the structure. The benefits of this effect are exploited in blast wall design, as the support or reaction loads may be less than the applied overpressure load. Plastic deformation of a blast wall also has the effect of limiting the reaction loads on the supports. For a loading duration near the natural period of the member the shear forces could be higher. Checks should be made where this is likely using a dynamic amplification factor based on the ratio of load duration to natural period (see Figure 19). Code checks may be re-interpreted to take account of the following inherent reserves of strength, both material and plastic reserves as discussed in sub-clause 6.4.3. Material effects are discussed in sub-clause 6.4.
140
6.7.4
Ductility level analysis
6.7.4.1 Interpretation of the Output from a Non-Linear Finite Element Frame Analysis
For most ductility level analyses code checking will either not be appropriate or the response simulation software will not contain a code check module within the software. Checking of members will be done explicitly with regard to performance standards, which may take the following forms.
Strength limit checks similar to code checks; failure is defined to occur when the design load or load effects exceed the design strength. This criterion may be applied in the plastic region. Deformation limit checks. Permanent deformation may be acceptable so long as safety critical equipment is not impinged upon and collapse is not caused even in the presence of a fire. Mechanisms may be formed momentarily during an explosion. Buckling checks, which identify where plastic response may be limited by local buckling. Fracture checks to identify weld and member failures.
Members may be classified as plastic, compact or non-compact (BS5950). Plastic and compact members will generally reach their full plastic capacity before buckling. If the structural response software is capable of representing finite displacement effects, plates may be included in the model to represent barriers and loaded surfaces. The inclusion of plates with equivalent thickness to represent mid point deflection will also help to represent the tension and shear effects from these items. The restraining effect of cladding can conservatively be omitted from the computer model so long as the loads applied to them are applied to the bounding members according to the area associated with each one. Some packages will not take account of the loss of shear restraint from the cladding as it is deformed; in this case it is preferable not to include the cladding as plates in the model.
6.7.4.2
Deformation Limits
Deformation limits are discussed in sub-clause 6.5.3. Additional Guidance is given below. Compact sections may be designed using code checks without supplementary local buckling checks up to first hinge formation. Sub-clause 7.2 of Reference [5] gives formulae for checking for local buckling of beams working beyond the elastic limit. Checking of columns under axial compression is dealt with in Reference [117]. In most situations blast walls are arranged to span from floor to ceiling without direct support from the columns. Isolated columns only receive load from dynamic pressures and could be in tension during an explosion. Allowable ductility ratios based on earthquake design practice are available for I sections, box sections and circular sections from Reference [117].
141
Buckling checks must be performed to ensure that the full plastic capacity of a member can develop. These checks should be made particularly for deck beams loaded from an explosion below as flanges usually in tension may be in compression during the explosion. These checks should be performed using the dimensioning explosion load level. Reference [5] gives criteria for the prevention of lateral torsional buckling based on slenderness ratios for beams. Large deflection effects such as web crushing and flange curling are dealt with in Reference [5].
6.7.4.3
Joint Design
The principal ultimate failure mechanism for joints is rupture or brittle fracture unless the joint is stronger than the members which are connected to it. The basic design principle is to design them so that loading or imposed rotation causes ductile deformation of a connecting member. This follows general practice in earthquake design. A more detailed appraisal is given in Reference [5].
6.8
6.8.1
Single Degree of Freedom Idealisations

General
The basic analytical model used in many blast design applications is the Single Degree of Freedom (SDOF) system. Much of the guidance developed in the past such as Reference [118] is based on the Biggs method [5] Other methods based on an energy balance to obtain isodamage curves developed by Baker [118] are also adopted and the basis and limitations of these techniques are described in this sub-clause. A detailed treatment of the Biggs method will be given in Part 3 of the Guidance.
6.8.2
6.8.2.1
Component Response Biggs Method[101]

General
Components may be analysed in isolation as long as the interaction with the surrounding structure through fixity and the applied loads are negligible or are represented in the component model [98] . Single Degree of Freedom (SDOF) methods represent a structural system as a single mass whose motion is resisted by a single linear, or non-linear spring. The magnitude of the mass and the stiffness of the spring are determined such that the displacements in the SDOF model are the same as a characteristic displacement of the real system, usually taken to be a point at mid-span. The SDOF method is limited to structural systems, which can be easily simplified to a single mass and spring. These are systems where the overall response may be represented by a characteristic displacement and the deflected shape is similar to the first or lowest mode of vibration of the system.
142
The SDOF method can easily be programmed onto a computer, which can calculate the displacements at each time increment. The equations of motion can be modified during the time-stepping process, to allow the modelling of changes in structural behaviour at certain displacements. For example, the change in structural stiffness caused by plastic deformation can be introduced when the yield displacement of a beam has been exceeded; hence realistically modelling the increased displacements that occur after plasticity has been reached. Explicit solutions of the equations of motion do not have to be found, and hence it is relatively simple to use non-linear force and resistance inputs without significantly increasing the complexity of the program. This is particularly useful in the analysis of blast panels, where the resistance-displacement relationship is complex. The Biggs method requires two basic inputs, the resistance displacement curve and an idealized loading time history. Design charts are available [1,101] for the calculation of the peak response, xmax, given the load duration to natural period ratio, td/T, and the ratio of peak overpressure load to component ultimate plastic resistance, Fm/Rm. The charts are based on a simplified bi-linear resistance behaviour, which is inaccurate for fully or partially fixed members as well as for members where tension effects are significant. This procedure is illustrated in Figure 23. The mass and stiffness of a structural member must be carefully represented in the SDOF model to ensure that the model displacements accurately represent the displacements of the actual member. The mass and stiffness of the member, as well as the loads applied to it, are modified using transformation factors which are calculated taking into account the deflected shape and the loading and mass distributions [1,101]. The values of the transformation factors are dependent on the deflected shape of the member under the blast load. If the deflected shape of a member changes as it is loaded (for example if plastic deformation occurs) the transformation factors must be adjusted. Methods of calculation of mass KM and stiffness KL transformation factors for beams and panels are given in References [1] and [101]. The natural period of the member is given by:
T = 2
where
Me ke
Me = Actual member mass M times KM, the mass transformation factor. Ke = Actual member stiffness k times KL, the stiffness or load transformation factor.
A typical idealized resistance-displacement curve for a simply supported beam is shown in Figure 23[98]. Under increasing uniform loading, the member deflects elastically up to its yield displacement xe. Further loading results in no increase in the resistance of the member it is assumed that the member is deforming purely plastically. If the displacement reduces after plastic deformation then it is assumed that the resistance of the member returns to the preplastic (or elastic) form on a line parallel to the line representing the initial elastic deflection. Typical member response is shown in Figure 21. Member damping is not usually modelled in this analysis, and hence the member oscillates freely after the blast load has been released. In practice, damping is not important, as it is generally small for structural members oscillating in air, and in any case it is the maximum displacement rather than subsequent oscillations, which is important.
143
Pm F e( t) 1000 FORCE
800
600
400
200
0 0 R RE S I S TANCE R m 1000 2 800 0.1 0.2 0.3 0.4 0.5 0.6 TIME(s) td LOA D DURA TION
600
1 3
400 S LOP E K e 200 Xe 0
Xm DIS PL ACEM ENT
F(t) B LAST WALL
Figure 23 - Biggs single degree of freedom model [101]
144
UKOOA FIRE AND EXPLOSION GUIDANCE Part 1: Avoidance and mitigation of explosions 6.8.2.2 Representation of Fixity Conditions
The degree of rotational and axial fixity at the ends of a structural member affects its elastic stiffness and hence its natural period. The bi-linear resistance displacement relationship used in the Biggs design charts is only accurate for simply-supported members, where the member reacts either purely elastically or purely plastically. For partially or fully fixed members, elastic/plastic behaviour occurs before the member reaches its ultimate plastic resistance. The Biggs charts use an approximation of member stiffness to give a bi-linear resistance curve for all fixity conditions. The stiffness used in the Biggs method is determined such that the area under the actual and idealized curve are equal, and hence the energy or work done to a given deflection is the same for the two curves. A range of values of Fm/Rm and td/T were used to generate the sets of curves shown in the Biggs design chart Figure 24 for a simply supported member under a triangular load with a rise time equal to half the load duration. Similar charts for differing rise times of triangular loading are given in References [1] and [101].
145
100 80 50
Rm /F1=0.2
0.3
0.4
0.5
0.6
0.7
20
0.8
10 8 y m /y el = 5 0.9
1.0 0.8 0.5

F(t) F1 R
1.00 1.20 1.60 2.00

Rm
ym
0.2 0.1
0.1
0.2
t 0.5 t d t d Triangular pulse load 0.5 0.8 1
y t y el tm Resistance Displacement function function 2 5 8 t d /T
Figure 24 - Biggs' design chart overpressure rise time equals half load duration
This chart enables the peak response of the member to be calculated. The vertical axis is in terms of the ductility, which is the number of multiples of the yield displacement the member will reach under the loading. To use this chart:
146

Determine the peak resistance Rm, effective stiffness and yield displacement Xe for the member. Determine the effective peak force Fm from the peak force Fpeak and the load factor Kl. (Fm = Kl x Fpeak) Calculate the equivalent mass of the member Me Determine the natural period of the member from the effective mass and stiffness Choose the nearest curve corresponding to the ratio of Fm/Rm Read off the ductility for the peak response corresponding to the td/T for the member Calculate the peak response from the ductility indicated on the vertical axis
The reaction loads at the ends of the member may also be estimated using this method although the accuracy may be doubtful as detailed strain information is not represented in the model. These formulae are not accurate for two way spanning panels but are reasonable for the assessment of one way spanning panels or beams. Similar charts may be constructed for partially fixed members by applying a rotational spring stiffness, Ks, to the ends of the member [98] . Ks tends to infinity for a fully fixed member and to zero for a simply supported member. The degree of end fixity for a member is determined from the flexural stiffness of the connecting structure. At low values of fixity, a plastic hinge is initially formed in the middle of the member, with additional deflection causing plastic hinges to occur at the ends until the ultimate plastic resistance is reached. At high values of fixity, plastic hinges are initially formed at the ends of the member. Increased deflection causes a plastic hinge to be formed in the middle of the member. The transitional stiffness occurs at Ks=6EI/L. This stiffness gives the greatest elastic resistance for the member. Here I is the second moment of area, L is the length of the member and E is the Youngs modulus for the material. The degree of fixity significantly alters the natural period of the member. The natural period for a fully fixed beam is less than half that of a pin-ended member. The ability of a member to resist axial loads is reduced if its fixity is reduced. The buckling load for a pin-ended column is 4 times smaller than that of a perfectly fixed column.
6.8.2.3
Out of Plane Equipment Loads
Attached equipment alters the natural period of the member by increasing the mass, which must be accelerated during blast loading. A one degree of freedom idealization may be adopted to check the response of deck sections if a Screening Analysis is being performed. The effect of static out of plane loads is to cause an initial deflection of the member. The deflection will be positive in the case of a floor beam subjected to blast loading from above, and will be negative in the case of a ceiling beam subjected to blast loading from below. The initial deflection due to the out of plane loading effectively changes the position of the origin on the resistance displacement graph. The resistance function may be modified to take into account equipment loads. The same Biggs chart may be used to estimate peak response so long as the natural period and resistance function are modified to represent attached masses.
147
UKOOA FIRE AND EXPLOSION GUIDANCE Part 1: Avoidance and mitigation of explosions 6.8.2.4 The Effect of In-Plane Loads
Whilst purpose designed blast walls will have no static loads applied to them, there is often a need to assess the capacity of module walls and columns with in-plane loads present. In-plane (i.e. axial) loads have 4 effects on the response of structural members: 1. Axial loads reduce the plastic moment capacity of a section. At the dead and live loads normally applied to structural members the reduction in plastic moment capacity is small. Axial loads change the stiffness and hence the natural period of a member. The stiffness of a member will reduce to zero at the Euler buckling load. As an axially loaded member deflects under blast loading an additional moment will be generated by the axial load about the original centreline of the member. This P-delta effect is modelled by converting the moment caused by the axial load into a lateral resistance, which is then subtracted from the original beam resistance An axial load may be applied eccentrically to the member, creating an initial central deflection. The reduction of blast resistance due to eccentric axial loading is modelled by reducing the resistance of the member at the initial deflection.
2. 3.
4.
The dominant effect on response is the p-delta effect. As blast walls are usually arranged to span from floor to ceiling the direct explosion loads on columns are small these effects may be ignored in a Screening Analysis.
6.8.2.5
Barriers and Cladding Response
Blast walls are usually designed to deform plastically and act predominantly in bending to minimize the reactions on the primary structural members of the platform. A great deal of effort is usually expended in designing the edge connections of the blast wall so that the reaction loads are transmitted to the supports without damage to the supporting steelwork. Because of the inertia of the wall it is possible to design these connections such that the transmitted shear forces and moments are much less than the peak overpressure force on the wall. Purposebuilt blast walls are usually free standing, spanning from floor to ceiling and are not an integral part of the supporting structure. The capacity of a blast or fire wall with stiffened plate construction may be estimated for Screening Analysis purposes using yield line analysis for the plate sections[119]. Other formulations for resistance estimation are given in the API Bulletin 2V[119]. Work by Shell[120] indicates that the ultimate capacity of panels may be much larger than formerly thought. In particular the finite deflection capacity of a simply supported plate is larger than the classical estimates of the capacity of a clamped plate with the same dimensions and span. The possible failure modes of the wall may include panel failure, stiffener failure, and whole wall failure. Each mode corresponds to a different plastic hinge, or yield line pattern. Local and torsional buckling of stiffeners and wall plate may also occur before plastic hinge formation. The failure mode corresponding to the lowest ultimate resistance is the critical failure mode of the wall.
148
The calculated resistance will also depend critically on the edge support conditions assumed which may in turn depend on the form of loading. High pressure loading on adjacent panels may give rise to clamped edge conditions between panels even though the panels would not otherwise merit this approach. Tension and membrane effects often indicate an increased resistance but the restraint from the surrounding structure through inertia or stiffness may not be sufficient for these effects to be fully mobilized. Penetrations such as piping and cable runs should be arranged to pass through the wall at the top or bottom of the wall to limit deflections and induced strains in the wall. The penetration should be fire and gas proof. The penetrated section of the wall should be designed to have the same stiffness and strength as those parts of the wall where no penetrations exist. The dynamics of the wall and penetrations may need to be checked if large mass items are attached to the wall. Examples of connection and penetration details will be given in Part 3 of the Guidance. Efforts have been made to include tension and membrane effects into Biggs method [98,121,8] with mixed success. A detailed assessment of these will be made in Part 3 of the Guidance.
6.8.2.6
Rebound
Rebound must also be considered. This occurs when the load has subsided and the stored elastic energy in the wall is released. This may be taken into account by assuming a reverse load or suction at a level of 1/3 of the original overpressure with the same duration. Biggs method may also be used to determine the rebound response if a suction phase is included in the load time history. Other authors have developed a rebound dynamic amplification factor which may be used to calculate rebound response (116].
6.8.3
Limitations of Biggs Method
The advantage of Biggs method is that it is simple and easy to apply once the structural system is idealised into a single degree of freedom system. However, the basic Biggs model is clearly based on simple bi-linear structural behaviour assumptions which may limit its applicability for design of modern lightweight systems. It is important to bear in mind that in the past, guidance which was developed for blast resistance design was based on using structural strength, weight and standoff from the explosion source to control response. Some of these limitations of the technique which need to be considered before adopting the method include the following: 1. It is not an easy task to convert anything other than the simplest structures into equivalent spring mass models. A great deal of engineering judgement is required in determining meaningful models and interpreting the solutions. For example, modules are normally framed for lifting and to give redundant load paths, making the overall structure of the module difficult to describe as a one degree of freedom system. The deformation of structural components such as walls and decks is highly dependent on the degree of restraint provided by the primary steelwork. Although some membrane action can be incorporated into the model, it is difficult to accurately model the stiffness of the boundary. This places severe limitations in trying to characterize the resistance function of the SDOF model when modelling plated structural components.
2.
149
3. Ductility factors which are used are normally for idealised simple beam models. These may not be appropriate for the actual MDOF structure where different patterns of yielding could give the same overall inelastic peak deflection but the local ductilities may be significantly different. The Biggs method implicitly assumes that the deflected shape under blast loading is normally the same as the static deflected shape. Many multi-degree of freedom systems or systems with complex mass distributions do not respond in this way. This also applies to some stiffened plate blast walls. The loads obtained from a CFD model may indicate that they vary significantly in both space and time requiring some conservative idealisation to simplify them so they can be used with the SDOF model. The method relies on the fact that the mass can be lumped, but deck type structures are likely to have significant mass components from plant and equipment. This spatial variation in the mass may well invalidate the assumed shape function and give nonconservative results. Biggs [101] does address this problem but often the refinements of his method are not implemented. If the rebound is more important, which may well be the case if the ceiling of a module supporting plant is being considered, care needs to be taken [122] . The prediction of rupture is very unreliable as there is no detailed representation of the strain distribution within the structure. High ductility deflections are not well represented by the flat portion of the resistance displacement curve representing plastic response.
4.
5.
6.
7.
Although some of the limitations above seem severe, the technique has been successfully used in design situations, particularly where the resistance function has been accurately determined. Reference [122] shows an example of a stiffened plate which whose resistance function was determined via a static NLFEA and combined with the spring mass model. The deflection time histories compared well with an explicit NLFEA up to pressures of the order of 3 bar. Beyond this, the model was unable to give accurate deflection values. This was thought to be due to the spread of plasticity which results in a change of the shape function used in formulating the spring mass idealization.
6.8.4
Pressure Impulse Diagrams
Rapid assessments of maximum response are very useful in a preliminary structural design, particularly where there are a large number of load cases to screen. The previous Biggs model described how transformation factors can be developed using an energy balance to convert the structural element into a spring mass model. The same concept is adopted in developing pressure impulse diagrams which is described in detail by Baker [118]. For an impulsive load, the kinetic energy imparted to a structure or structural element by a short duration pulse, or external work for a long duration pulse, is determined and the strain energy is then equated to the strain energy the structure develops while deforming.
150
A suitable shape function is required to describe the deformation under the loading and both elastic and plastic behaviour can be accounted for. The resulting expressions for the two loading regimes are then rearranged such that a non-dimensional plot of pressure against impulse can be constructed. A number of curves are normally plotted for varying levels of damage which may be defined in terms of the ductility parameter . This allows rapid assessment of the damage or vulnerability to a number of different loading conditions. The method is capable of representing membrane action in elements such as plate components. The method can also be applied to certain systems which are also not easy to define using a SDOF model. The method can also be taken a step further by constructing pressure impulse diagrams for a number of different elements such as beams, plates and columns for a series of damage levels. The damage calculated for each component is then combined in a weighted manner, depending on the vulnerability of each component, to define overall module damage.
Impulse assymptote
Fail Pressure
Increasing
Safe Impulse
Pressure assymptote
Figure 25 - Pressure impulse diagram
6.9
6.9.1
Non-Linear Finite Element Analysis

General
The non-linear finite element analysis method (NLFEA) is potentially a very accurate tool, and often the only tool available, for predicting response. In contrast with the more conventional methods the NLFEA simulates the complete stress-strain history within the volume of the structure. Furthermore the impediments to the common use of this powerful modelling tool are continuously being pushed back by advances in computer technology. However, though the necessary computer speed and data handling capabilities may prove no longer to be a problem, it is still very much a specialists tool because of its general-purpose characteristics, and because the method inherently overestimates the resistance of structures. The successful application of NLFEA requires a sequence of carefully considered modelling, and possibly submodelling, decisions as well as a number of control checks before total confidence in the predicted results con be achieved.
151
6.9.2
Choice of NLFEA tools
A suitable NLFEA tool should as a minimum have the capability to account for non-linear and rate dependent material behaviour, geometric non-linearities, large displacements, local and global instability in the structural response simulation. Geometric non-linearities are here assumed to include opening and closing of gaps, material ruptures and contact between separate components.
6.9.3
Construction of the finite element model
One of the first choices the analyst is facing when defining a numerical model of a given physical problem is to set the outer boundaries of the model, and the type, or combination of types, of elements to be employed. In general beam elements are employed for the analysis of complete modules, shell elements for the analysis of decks, walls and structural components, and solid elements for the analysis of connection details. The use of solid or continuum elements potentially leads to the most accurate predictions, but are also much more costly in terms of computer resources. Furthermore an increase in the complexity of the model also increases the possibility of human errors. The numerical model should include sufficient parts of the supporting structure to ensure that the end-restraints are modelled realistically. This is especially the case when determining the membrane forces developing in structural components undergoing large displacements. The membrane forces have the effect of increasing the resistance of a structural member by delaying the onset of buckling, and can also significantly alter the reaction forces. In this context it should be noted that when membrane forces develops in one part of the structure they are usually counterbalanced by compressive forces in other parts. These compressive forces may have an adverse effect on the stability of the structure. Rather than opting for a high overall level of detailing in the modelling of structural assemblies it is often possible, without loss of accuracy, to employ the output of one model to drive a displacement controlled analysis of a sub-model. An example of sub-modelling is the assessment of the containment pressure of a blast wall. Typically the stiffened or corrugated plate is represented by shell elements. A sub-model of solid elements is employed in order to assess whether or not the ultimate resistance of the welded connections has been exceeded. The converse of displacement driven sub-modelling is to use the results from a few lower level analyses, such as those carried out to find the deformation capacity of connections and welds, to define member performance standards applicable to the higher level analysis. A further complication often encountered in the NLFEA is the presence of mathematical singularities, which occur where elements meet at sharp corners. The analyst need to be aware of this numerical phenomenon, and may have to investigate this in further detail by employing refined models. In order not to overestimate the ductile capability of members, it is very important that the finite element analysis takes due account for all the potential buckling modes. As a consequence the mesh density need not only to be fine enough for apparent convergence, but need also to be sufficiently fine to represent all the dominant local buckling modes. Sufficient fineness can be obtained by dividing each structural element susceptible to buckling into at least 6-8 elements across the width. Furthermore the analyst may have to introduce imperfections or destabilising loads in order to trigger numerical buckling.
152
For large assemblies it is not practical to make the mesh fine enough to pick up all the buckling modes. Hence the individual structural components need to be checked until the analyst is satisfied that all potential failure modes have been accounted for. Regarding meshing it is also considered to be good practice to keep the aspect ratio of the elements as close to unity as possible, and only to gradually change the sizes of the elements in the mesh. Post processing tools can play an important role when investigating whether the meshing is adequately fine. For most models it is necessary to specify appropriate multiaxial constitutive equations for the material. For steel materials Von Mises yield criterion used in conjunction with an isotropic hardening rule and an associated flow can be employed in situations where the critical response is reached during the pass of the positive phase of the blast loading. In the special situations where plastic strain reversal is significant a kinematic hardening model is preferred. The spatial and temporal distribution of strain rates, and their adverse influence on the reaction forces need always to be considered when performing a plastic analysis. When analysing structural components it is usually assumed that the pressure time history is uniformly distributed over the surface. However when carrying out a global structural analysis the ability to describe non-uniform loading, which also varies in time, is often required. Blast loading should at all times remain normal to the surface of components undergoing large displacements. Furthermore the analyst should recognise and possibly need to include the fact the structure is in a state of static equilibrium at the time of blast loading. Ignoring the service loads when calculating the blast resistance will not necessarily be conservative. Permanent loads associated with heavy equipment are best modelled by transferring the load through discrete fixing points, which can be mutually constrained. Other service loads are included using a smeared approach.
6.9.4
Solution techniques in NLFEA
Two fundamental different solution techniques can be adopted based on implicit and explicit time integration algorithms. In general the explicit method is best suited for the analysis of blast loaded structures, where the transient response are to be measured in tens of milliseconds, and large plastic deformations develop. The primary reason being that the explicit algorithm requires relatively little computational effort in each time step since no formal matrix factorisation is necessary. Implicit methods on the other hand are essentially static codes running in time domain, and will as such require much more memory and disk space. The degree of non-linearity of the problem makes the larger time steps permitted in the implicit codes of little practical value. Another advantage associated with the explicit codes is that they have an inherent ability to initiate most of the local buckling modes. The most severe limitation for non-linear finite element modelling is the dependence on low level performance standards, which in general means that a significant amount of time may need to be invested in setting up the models and interpreting the results. However in most cases the reward is a more cost efficient design.
153
6.10
6.10.1
Response of the Primary Structure

Introduction
There are a number of effects which tend to mitigate the effect of explosion loading on the Primary structure [116, 88] and enable it to resist unexpectedly high loads without modification. Detailing of barriers and connections may however be required to bring the structure up to full capacity. The loading direction resulting from an explosion may also necessitate further stiffening to prevent buckling if this is not allowed. Isolated columns and beams will be loaded by drag or dynamic pressure loads which are only important near vents and are often much less than the overpressures. The method of load calculation is discussed in the context of piping and vessels in sub-clause 5.11. Other mitigating effects including scale effects, the limitation of reaction loads by secondary member capacity and the effects of dynamics and plasticity are discussed in this sub-clause. Finally these effects are discussed in the context of modified code checks in sub-clause 6.10.5
6.10.2
Global Loading scale effects
It is quite clear that the Advantica Spadeadam explosion test rig used in the UK project on Fire and Explosion engineering has repeatedly been subjected to local overpressures over 10 bar which it was not designed for. The structure has withstood these pressures with minimal damage. The simplest factor, which affects global primary structure response, is the scale factor or coherence factor. The following cases are given only as an illustration of the scale effect. The precise geometry of the target structure and the loading pattern will change these conclusions and a detailed assessment of these factors should be made depending on the scenario considered. Considering the situation of a pressure disturbance travelling along a wall or for a ridge of pressure travelling across a deck. The pressure disturbance is considered to be a pulse travelling with a velocity of about 340 m/s (the speed of sound C0 in ambient conditions, neglecting convection with the gas flow) giving a length scale of the disturbance ld = td x C0 of about 17 m for a 50 ms pulse. A typical bracing member or panel of length l equal to 8 m will hence see a peak averaged pressure of 0.75 of the peak. A module wall of length L equal to 35 m will see a peak averaged pressure of 0.25 of the peak value. This indicates a scale factor of 1/3 on the global load/member load for this situation. In situations where a large deck is considered these conclusions may only apply locally as the pressure loading pattern may be circular or irregular in shape.
6.10.3
Global Received loads
Global loads on primary members are also dependent on the capacities and dynamic properties of the connected panels. Often the loads transmitted into the primary framing will be reduced by panel capacities and the delay in load transmission due to delayed panel response. The panel peak response may well occur long after the load has subsided and if a suction phase is present then the panel response itself may be reduced. Often the direction of the loading on the primary framing may be changed locally due to panel membrane effects. These membrane loads may be balanced globally if panels of similar dimensions are attached to either side of the columns.
154
6.10.4
Plasticity and dynamic effects
The Biggs chart shown in Figure 24 may be used to estimate the benefit to member capacity resulting from plastic deformation and dynamic effects (within the constraints that the chart is applicable to the structure and loading considered). If a member has a td/T ratio of 0.2 for example, and a ductility of unity is required (elastic response) then the static resistance to load ratio is about 0.6 and the member will resist (dynamically) a load of 1/0.6 = 1.67 times the member resistance. For elastic response the dynamic amplification factor for this case is 0.6. If a ductility of 10 is allowed then the resistance to load ratio is about 0.15 and the member will resist a load of 6.67 times the member resistance. Hence the ratio of the capacity allowing a ductility of 10 to the elastic capacity is 6.67/1.67 or a ratio of 4 for structures with a load to natural period ratio of 0.2. Values above 4 may be reached for structures with long natural periods (large frame structures or compliant structures). The allowed ductility will depend on the applicable performance standards. A ductility level blast performance standard could well allow a ductility level of 10 for decks and beams.
6.10.5
Modified Code Checks
The design of the topside components of an offshore hydrocarbon production facility is traditionally carried out using codes of practice based on conventional static design, where the elements are required to remain elastic under normal service load conditions. This normally involves comparing maximum stress levels in the member with allowable values permitted in the code of practice. As an initial screening process, this approach can be used before further checks and analyses are carried out, particularly if the overpressures are not high, less than 0.5 0.6 bar. The checks can be carried out with some relaxation on the design yield strength which are normally based on guaranteed minimum values and an allowance for the increase in the yield strength due to strain rate effects. Allowing for strain rate effects will extend the elastic range and this needs to be considered in the buckling checks. Also, the forces at the connections will increase, whose adequacy needs to be considered. Checking primary structure against the SLB (in the case where the load is 1/3 of the DLB) will often size the members for the DLB. Experience suggests that the Primary structure will not experience the full overpressure loading as the loading acts first on secondary members, barriers, cladding and plate [88,89]. Unity or utilization checks to the appropriate standard (e.g. AISC) may be re-interpreted to reflect the reserves of strength in the structure. When compared with a Ductility level analysis this approach often result in a less efficient and heavier structure. These methods will not be suitable for the analysis of a situation where a fire has preceded the explosion unless allowance is made for material weakening and geometric imperfections and permanent deformations resulting from the fire.
155
Blast resistant structures and their supports are designed to respond in a ductile way to explosion loading mainly in bending. The shear behaviour of structures at their supports and in the joints of the primary frame will also affect the utilization factors derived in the code checks. The safety factors implicit in the code checks will be different from those associated with bending. Shear strains at supports should generally be limited to the elastic limit. Additionally, for a dynamic situation these shear forces will be quite different from the values obtained by static analysis as a result of the inertia forces acting on the structure. The benefits of this effect are exploited in blast wall design, as the support or reaction loads may be less than the applied overpressure load. Plastic deformation of a blast wall also has the effect of limiting the reaction loads on the supports. For a loading duration near the natural period of the member the shear forces could be higher. Checks should be made where this is likely using a dynamic amplification factor based on the ratio of load duration to natural period (see Figure 19). Code checks may be re-interpreted to take account of the following inherent reserves of strength, both material and plastic reserves. The following factors may be applied to the final utilization: 1. The explosion event is an accidental event and hence the stress may be allowed to approach yield. A factor of 1/0.67 (1.5) is then appropriate on the allowable utilization. Alternatively the yield stress may be enhanced by the same factor to allow for nonlinear relationships for some aspects of utilization factor calculation. The material strain rate effect will generally give an increase of yield stress of the order of 20 %, this value is used in the nuclear industry [69]. This value may be higher locally, in particular in high strain regions of a blast panel. A factor of 1.2 may be applied to the acceptable utilization or to the yield stress. Strain hardening will occur around regions of local plasticity. Where it is appropriate (for tension members, plastic sections in compression and/or bending) allowance may be made for this by taking the design yield strength as the ultimate tensile strength divided by 1.25 (IGNs [1] ). The occurrence of plastic hinging may be taken into account by factoring the acceptable utilization factor by the ratio of the plastic Zx to elastic section modulus Sx. This factor is generally greater than 1.12 and will be in the range 1.1 to 1.5. The member must be able to sustain the formation of a plastic hinge before buckling, i.e. in tension or be a plastic section.
2.
3.
4.
As discussed above shear checks should also be made using the correct dynamic reaction loads with strains being limited to elastic limits. Taking into account all the factors above gives a possible acceptable utilization factor of 1.5 x 1.20 x 1.25 x 1.1 (a factor of 2.5) for a tension member. Usually the benefit of both strain hardening and strain rate yield strength enhancement is not taken into account. The recommended acceptable utilization factor is hence 1.5 x 1.20 x 1.12 = 2.0 for primary members acting in bending and/or compression under explosion loading so long as the member does not buckle where local buckling is not acceptable. Buckling checks for members working beyond the elastic limit are discussed in References [5] and [117]. It is stated in Reference [117] that semi-compact and compact sections may be designed using code checks without supplementary local buckling analysis up to the formation of the first hinge.
156
The above approach assumes a working stress approach is being used for primary framing design. The limit state approach may also be used with the equivalent elastic load level for the DLB (the dimensioning explosion load) being derived from consideration of the differing partial safety factors suitable for the ultimate limit state and elastic limit state. These topics are discussed in References [89] and [88].
6.10.6
The use of NLFEA in global response
One of the key limitations to effective assessment of the global response to explosion loading, has been the time and cost of NLFEA structural analysis. The computer hardware was simply not generally available to enable the whole topsides structure to be modelled and analysed for the response to localised dynamic loading with a rapidly changing load function. Assessment and design tended to be component oriented, with little understanding of the interaction of effects between components [122] . As the understanding grew, through full scale testing, of the actual overpressures realized in an explosion, so the need to achieve greater resistance or capacity in decks, walls and connections has grown. Non-linear and dynamic analyses became commercially viable for even small design houses at component level using PC based software. Finite element packages enabled single degree of freedom solutions to be improved, through consideration of support stiffnesses and axial membrane resistance. Single component assessment could be expanded to the consideration of panels or complete walls and decks. The influence of penetrations could be addressed and the detrimental effect of local stiffening on global ductility became evident. A common misunderstanding in the design of blast walls is the relationship between the design overpressure and the strength of the wall, interpreted through its stiffness. In the mitigation of explosion loads, the key consideration is the ability to absorb energy through ductility, and the delay of peak response to a time where the load has dissipated or reversed. The inclusion of penetrations and local reinforcement for the support of piping or equipment, will introduce hot spots in terms of stiffness, which may reduce the explosion resisting capacity of the wall. The deformation of the wall, when subjected to explosion loading, may also violate the integrity of any attached pipework or equipment. In the assessment of explosion resistance of existing platforms, simple linear elastic designs are often reviewed using non-linear, dynamic techniques to identify additional capacity without the need for reinforcement. The capacity of a blast wall or deck, in terms of explosion loading, is limited by its weakest component. This could be the situation where the connection is made by means of a weld with a 5 % strain limit, as compared to the 15 % strain limit of the parent material. In some situations, making a wall more flexible may increase its ultimate capacity to resist blast. Removing or revising over-stiff details, say by making a heavy column base pinned rather than fixed, may allow the development of plastic hinges throughout a wall and through greater overall deformation before key component failures. Later response may exploit the benefit of the suction phase in the loading.
157
6.10.7
Global response considerations
Another key area for not fully appreciating the response of the structure to explosion loads is at the interface between walls and decks, or in the open truss work behind a blast wall, which ties two decks together. Finite element analyses may well consider a full wall or deck, but modelling a complete module or integrated deck, an assembly of modules or a complete topsides of a fixed or floating facility, requires another order of magnitude of effort, computing power and cost. Accurate modelling of both geometry and mass distribution is required, in order to achieve a realistic dynamic response. Many different blast simulations may be required in order to generate a realistic envelope of responses for specific details. A balance has to be reached between the extent of the model and the level of detail in order to be cost effective. Inclusion of small details, such as penetrations and stiffeners, may not influence the global response and thus becomes irrelevant for a global model. Application of point masses at deck level at primary model nodes may also be sufficient to achieve an acceptable accuracy for vertical dynamic response. Elevated masses may be required for significant items of equipment or vessels where rotational effects may be important and local horizontal loads are present. Major pipework may need to be modelled if it could influence the dynamic and explosion response of the structure, particularly if it has been detailed in such a way as to provide an explosion resistance load path between decks via pipe supports. Elastic global models may be conservatively used to determine accelerations on primary elements remote from an explosion, or on complete modules such as the Living Quarters, or for lifeboat and muster areas. Dynamic amplification for such areas can thus be determined for use in local analysis. Rigid boundaries for panel assessments are not necessarily conservative if the operating condition deformations are not considered. The sensitivity of the explosion capacity to deadweight and operating load should be addressed, as should the sensitivity to residual fabrication deformations and stresses. Welding residual stresses should also be considered in connection assessment, especially if key components are limited in capacity by the 5 % weld strain limit. The weld geometry needs to be addressed for ultimate capacity calculations, especially in fillet welded details, as a considerable portion of the total capacity of a connection may be absorbed by secondary loads generated by eccentric load paths. In the assessment of explosion capacities of existing installations, deflection criteria may become critical, especially in circumstances where blast panels come into contact with primary framing braces at loadings beyond the design overpressure. This can be common with linear elastic designs, say to 600 mbar design overpressures, which are revised to 2 bar overpressures following updated CFD modelling. The danger here is that the framing braces may not have the capacity to carry the transferred loads from the blast wall, in combination with the dead loads from the deck above. Destabilisation of the brace could result and potential toppling of any supported tall structures. In these circumstances, the total dynamic loading on the brace needs to be considered, including the explosion loading on connected decks.
158
An advantage of global models is the ability to visualise modes of mitigation, which may otherwise not be apparent when focussing on individual components or panels. Tying long span decks together to limit the deflection under heave is a means of limiting damage to equipment and pipework, which would otherwise suffer consequentially from large displacements. The loading required for design can be extracted from a global dynamic analysis which incorporates the ties the ties affecting the dynamics of the deck girders. Care must be taken in detailing, however, in order to prevent operating loads being transmitted into the ties.
6.11
6.11.1
Response of equipment, pipework and vessels

General
In areas of a production facility with an explosion risk, the following load conditions or actions need to be addressed for pipework, vessels, equipment, cabling and their supports, plus other miscellaneous items, such as scaffolding and loose items:
Dynamic pressure loads (comprising drag and inertia components) Differential pressure Differential movement Strong vibration Missile impact and generation
Areas remote from, or physically separated from, the areas with the direct explosion risk should also be assessed for these actions if there is a potential consequence to personnel safety or integrity of safety critical systems, including personnel escape provision. Dynamic pressure loads are discussed in sub-clause 5.11 and are potentially the most severe design loadings on equipment, vessels, pipework and cable trays. Differential movements may generate significant loadings where adjacent supports respond in a differing manner to an explosion. For instance, a vessel will be supported from the deck of a module, but pipework connected to the vessel may be supported from the roof of the module. In an explosion, the deck and roof will deflect in opposite directions, imparting loads on the vessel nozzle, potentially triggering a further hydrocarbon release, which could be catastrophic in terms of escalation of the event. Similar effects could be seen with pipework connections to equipment and with pipe branches, or where supports are positioned either side of stiff deck elements leading to support rotations in opposing directions. Loose items subjected to blast wind, components that break free of their supports as a consequence of explosion loading effects, or fragments of equipment or vessels generated by the break-up of those items in explosions all have the potential to become missiles which can then impact other equipment, vessels, pipework or critical electrical and control systems. The potential for loose items to become missiles needs to be controlled by good working practices; the potential for items to break free and become missiles, or for vessels and pipework to break apart and become missiles, needs to be controlled by design.
159
The dynamic response of the vessel or equipment on its support steelwork is fundamental to the reactions that are generated. Very stiff supports will generate high reactions; flexible supports will generate lower reactions. Too flexible a support condition may not be tolerable for operational reasons, or continued integrity during or following an explosion event. Too much movement may also contribute to vibration modes of failure for connecting pipework.
6.11.2
Response of equipment and vessels to Explosion Loading
For large diameter vessels, there should be consideration of the near-uniform pressure loading, as well as differential pressure and blast wind. Process vessels need to be assessed for the vessel stability when subjected to explosion overpressures. In many cases the blast overpressure will have negligible effect if the internal operating pressures are of a greater magnitude. However, the external overpressure could be a significant cause for concern if ignition was to follow blowdown, as process vessels are not normally designed to withstand net external pressure loads in excess of 1 bar. In most circumstances, the critical explosion loading effect on a vessel will be a lateral loading or overturning effect on the supports. For the assessment of existing installations, this may be well above the design loading magnitude, as the design explosion loading would have been on a par with the accelerations allowed for in the transportation or earthquake scenarios. Under the higher explosion loadings now prevalent, this may no longer be the case and modification of the vessel supports may be required. As discussed above, support strengthening may lead to an increase in the support reaction, so modifications should be carefully assessed. Often a linear elastic design may be demonstrated to have adequate ultimate capacity if assessed using non-linear dynamic techniques, with full use of material certificates. The vessel should be considered rigid in order to develop support reactions, but the uncoupling of loads onto the deck steelwork needs to be considered in conjunction with the deck loading from explosion. A simple SDOF solution may not be appropriate, whereas simple NLFEA would be. For equipment supported on Anti-Vibration Mounts (AVMs), this could mean retention of lateral stops or shear keys, which would otherwise be removed after the transport and installation phase. The deck plating or under-deck bracing must be assessed for adequate resistance to the lateral explosion loads. Tall equipment (relative to the support footprint) must be assessed for the possibility of toppling under explosion loading. A similar approach to the large vessels discussed above can be taken for the support reactions and the response of the under-deck steelwork. Attachments to equipment must be assessed for the possibility of differential movement between the equipment supports and the attachment supports. This is particularly important with small bore pipework, e.g. fuel gas lines and instrument pipework. Long spans for smallbore pipework should be avoided in order to limit vibration problems caused by flow turbulence, but normal operating vibration considerations are likely to govern.
160
6.11.3
Response of Pipework to Explosion Loading
Pipework supports are generally designed to withstand gravity loads and allow thermal expansion of the line. Flowlines are designed to tolerate a specified rotation or lateral movement of a well conductor or pump caisson. In some instances, the lateral loading caused by slugging forces must also be allowed for. However, the lateral loading generated by blast wind loads must also be accounted for, in order to prevent excessive midspan deflections or displacement of the pipe from its supports, which in turn would lead to rupture of the line or flange leakage and an escalation of the event. In general terms, line pipe is inherently ductile and consideration should be given to the adoption of flange class ratings which are higher than the design pressure rating of the pipe, in order to prevent flange failure under explosion loading [58] . Differential movement between adjacent supports, whether at a pipe branch or transition from deck to roof support, or between modules, must be accounted for in considering explosion loading. It may well be prudent to design the first support from a pipe branch as a structural fuse, in order to prevent a line from breaching under explosion loading . Explosion loading assessments should not be restricted solely to oil and gas lines, but must also include deluge pipework, as being essential for mitigation of potential fires following explosion. Pipe runs on FPSOs are designed to accommodate significant movement as a result of vessel flexing; safety critical pipework on fixed structures, in regions of significant potential movement when subjected to explosion loading, should have the same considerations. Explosion loading on pipework will be significantly increased by turbulence and congestion. Reduced piperack support reactions may be achieved by the use of baffles or slipstreaming aids, in order to present a single large rounded face to an advancing shock wave. Given the problems associated with developing a time-domain loading for a complete pipe run, an appropriate test for robustness would be to consider each pipe span as simply supported and use either a Biggs SDOF approach or a static load solution in a standard design pipe stress analysis. The tension capacity of the piping dominates the response and so a pure plastic resistance may be assumed for the pipe span considered with the mid point deflection being the relevant response variable. Plastic hinging soon occurs at each end of the pipe and hence the pipe may be assumed simply supported. Consideration of the equilibrium of a length of pipe between supports as a catenary will give a time history of the tension Tp in the pipe and the extreme deflection of the mid point enables the plastic strain at each end to be estimated using methods given in the previous sub-clause. An average plastic strain limit of 5 % and a peak local strain limit of 10 % may be used to determine failure of the pipe. This failure criterion applies to all reasonable pipe sizes and is insensitive to pipe diameter. If the pipe supports are attached to beams of similar section properties then the differential movement of the deck under an explosion should not be a problem.
161
6.11.4
Strong Vibration
Strong vibrations are caused by shock or displacement waves transmitted through the decks and walls as a consequence of the explosion. These need to be allowed for in the design of sensitive equipment, piping, electrical connections and instrument panels. Strong vibrations could lead to the toppling of tall items of equipment or instrument cabinets, damage to valve actuators, or large bending forces on long unsupported spans for pipework or cable trays. It should be recognised that vibrations can be either vertical or lateral, depending upon the support arrangement of the item relative to the deck or wall transmitting the shock wave If the structure and SCEs appurtenances have been checked for a Safety level or Ductility level earthquake loads following API RP 2A 9th Edition (sub-clause 2.3.6e.2) or later then the strong shock response to explosions need not be checked. In the Cullen report[61], it was reported that a number of witnesses spoke of the severe vibration associated with the initial explosion. People were thrown off chairs and knocked over. Once the force is calculated it may be applied to a dynamic global platform structural model [57]. The displacements and accelerations at points on the topsides may then be calculated. These accelerations are potentially damaging to essential safety systems such as:
Emergency escape and rescue systems The temporary refuge and its supporting structure Emergency lighting systems Emergency power supply and battery systems P.A., telecommunication systems and navigation aids Fire water systems Emergency shut down systems
One further consequence of shocks of this kind is that pipe runs between modules may be stressed due to relative displacements between modules. This would be particularly important for the fire water main. If the accommodation module or Temporary Refuge (TR) is supported on anti-vibration mounts the acceleration may be further amplified due to resonance by the low frequency components of the shock. For a fixed platform the integrity of the substructure should be checked against out of balance explosion loads. It is likely that the explosion loads will have a duration in the range of 50 to 100 milliseconds whereas the substructure will have a sway natural period in the range of 2 to 4 seconds. For elastic response of the jacket, a dynamic amplification (or reduction) factor may be calculated from the ratio of load duration td to natural period T or extracted from the curve given in Figure 20. A reduced equivalent static load may then be derived which can be applied to the fixed platform computer model.
162
Typical dynamic reduction factors of the order of 0.05 may apply in which case problems with the substructure are unlikely. This load case may then be eliminated from consideration, on the basis that the equivalent static loads on the substructure are smaller than those induced by waves and currents. Floating, tethered and moored installations are unlikely to suffer serious response to this form of loading because the natural period in the horizontal direction is much longer than the load duration. Awareness of strong vibration is therefore essential in the design and protection of safety systems used for emergency shutdown, emergency power, communications, fire protection, deluge pipework, fire and gas detection, HVAC, EER etc. Systems which some may consider not to be Safety Critical also need to be assessed for strong vibration loading: e.g. grating on escape routes, stair towers, module stools. Such systems are fundamental to the safe evacuation of personnel from the facility and strong vibration or blast wind loading may be the governing design load case. Control and instrument cabinets in utilities areas, which are protected from the direct influence of explosion loading, should be assessed for the risk of toppling by strong vibrations. Battery racks should have a retaining bar across the front of each shelf. Even book shelves in critical areas such as the Control Room should be assessed for the risk of displaced objects, which may fall and damage control panels or cause injury to key personnel. Massive objects with sensitive connections to adjacent machinery should be particularly addressed. Isolation or shut down valve actuators, rotating machinery such as pumps, turbines and compressors, HVAC dampers and lifeboat mountings should be reviewed for the consequences of shock or strong vibration loading. Walkdown is now a commonly used tool to perform a qualitative assessment of the risk of damage from strong vibration [58] .
6.12
Areas of uncertainty
There are a number of areas which still need to be addressed that relate to structural response. These will be addressed in Part 3 of the Guidance. 1. Assessment of response at high ductility levels is still difficult due to uncertainties in predicting both the performance of welded details under dynamic loading and in sensitivities in finite element modelling. The difference between guaranteed minimum yield stress values and actual coupon tests can give rise to a significant increase in reaction force, particularly in strain concentration regions which will amplify strain rate behaviour. The ductility values given in Table 6.5 are based on 2 dimensional beam models. However in three dimensional systems tri-axial effects, effects of bending and twisting in the third dimension are significant and will reduce the available ductility. There are limited performance criteria in order to assess the reduction in available ductility.
2.
3.
163
7
7.1
DETAILED DESIGN GUIDANCE/DESIGNING EXPLOSION RESISTANCE

General
FOR
This clause of the Guidance is based on Reference [21] and incorporates additional design and operations experience to provide guidance on methods and particular areas of detailed design that are not covered elsewhere in this Guidance. Industry initiatives that have generated detailed design and operating practice guidelines are briefly discussed. The detail design aims have been identified in this part of the Guidance Document, to enable co-ordinated best design practice, such that significant changes can be avoided late in the design process. Detailed guidance will be given in Part 3 of the Guidance Document.
7.2
7.2.1
The Design Sequence

Introduction
The approach in this section is to work through the design process in a generally sequential manner, identifying those areas that have an impact on explosion hazards. Conflicts between the requirements for different engineering disciplines will be identified, as will the conflicts between explosion and fire hazard management or mitigation. Some areas will be covered on a phase by phase basis, others on a discipline by discipline basis, as best suits the delivery of the discussion and its understanding. The readership is intended to be broad and the issues understood by all disciplines (engineering, management, verification and compliance) through all phases of project development, execution and operation.
7.2.2
Project Appraisal and Concept Selection
Given the number of competing options available, concept selection is normally achieved by means of comparative, qualitative and quantitative assessment based on cost, risk and timescale. The following subject areas have an influence on explosion hazard: New build or modification a new build project essentially starts with a clean sheet of paper and thus has little or no constraints in terms of layout, materials or structural form. An existing facility modification, by contrast, will have constraints in terms of viable location, weight, layout, interfaces with existing plant, power, spares, materials, accessibility and impact upon the existing Safety Case and HAZOP assessments for the facility. generally the selection process for sub-sea or topsides wellheads is related to satellite facilities where processing and main export is accommodated elsewhere. Explosion hazard is not normally a primary consideration, as the satellite structure, if selected, would be a minimum facilities, normally unmanned installation. With sub-sea wellheads, all fluids would be transferred to the main facility for processing; with a minimum facilities platform, primary separation may be included, but the topsides wellheads makes for improved accessibility for maintenance. Current technology has made the subsea option more viable, especially where the main facility is in close Issue 1, October 2003
Sub-sea or topsides wellheads
164
proximity. Inventory The gas content of the received fluids is the primary contribution to the explosion hazard, with the pressure of the flow, coupled with volume in the case of vessels, being the key parameters in determining the magnitude of release for a given leak size. The temperature of the fluids has an influence on the degree of absorption of gas within the crude oil, but is much less significant in terms of explosion hazard than pressure. The sweetness of the crude and the water content are the primary contributors to corrosion risk, with sand entrainment being the key contributor to erosion. The process area has the highest risk on the facility, in terms of explosion hazard, as a consequence of the high pressures and the number of potential leak sources in the pipework, pressure containing vessels and machinery. It is normal to distance the gas compression plant from the separation vessels, where possible, to reduce the escalation risk for any single event. These have the next highest risk, due to the amount of flanged pipework required to connect the trees to the manifold and the tendency of this pipework to move in concert with the conductors. The utilities area is much less vulnerable to serious explosion hazards, but a risk is still present, for example with fuel gas for power generation. the availability of a convenient nearby pipeline, with available capacity, may determine whether export of oil is by tanker or pipeline. To date, gas has either been flared, exported by pipeline, or reinjected into the formation for later export; excessive flaring is no longer considered to be an option in many parts of the world, due to environmental considerations. The required pipeline entry pressure will contribute to the compression requirements for the platform. The degree of gas compression has a significant influence in the potential for leaks and the resulting gas cloud sizes in the process area. The other factor in determining compression requirements is whether gas or electrical submersible pumps are used for artificial lift of the oil. The gas lift lines are a major potential hazard due to them being small bore, high pressure and subject to vibration due to tree movement. A major hazard is also presented in the loss of containment of the gas in the well annulus. Switching from gas lift to electrical submersible pumps is generally not an option on existing installations, due to the compressor design requiring a minimum throughput to maintain efficiency for new installations the electrical submersible pump option is much safer. Regulations vary in different parts of the world and cognisance is therefore required of the relevant governing regulations for the installation location, irrespective of where the design is executed.
Separation of process, drilling, utilities and accommodation
Wellbay and drilling facilities
Export route
Gas lift
Regulatory regime
165
Budget, timescale and external factors Best practice may sometimes be compromised by the available budget and project timescale, whether for new build or modifications to existing installations. Similarly external factors such as lift vessel availability may influence or determine the outcome of a particular decision, resulting in a less than optimum solution. The degree of compromise should be documented for evidence in hazard review and project safety audits. The initial hazard review can make judgements based on past experience and advise on the consequences of initial engineering or management decisions. This review process must be open, however, to new understanding on explosion loading and response, as well as to the capabilities of new technology or design methods. The initial QRA must be based on current generic data for leak and ignition frequency, or take account of proposed high integrity solutions which offer better hazard management, in order to be meaningful and aligned with the design process.
Initial hazard review
Given the number of competing options available, concept selection is normally achieved by means of comparative assessments both qualitative and quantitative, based on cost, risk and timescale. The following subject areas have an influence on explosion hazard:
New build or modification a new build project essentially starts with a clean sheet of paper and thus has little or no constraints in terms of layout, materials or structural form. An existing facility modification, by contrast, will have constraints in terms of viable location, weight, layout, interfaces with existing plant, power, spares, materials, accessibility and impact upon the existing Safety Case and HAZOP assessments for the facility. Sub-sea or topsides wellheads generally the selection process for sub-sea or topsides wellheads is related to satellite facilities where processing and main export is accommodated elsewhere. Explosion hazard is not normally a primary consideration, as the satellite structure, if selected, would be a minimum facilities, normally unmanned installation. With sub-sea wellheads, all fluids would be transferred to the main facility for processing; with a minimum facilities platform, primary separation may be included, but the topsides wellheads makes for improved accessibility for maintenance. Current technology has made the sub-sea option more viable, especially where the main facility is in close proximity. Inventory The gas content of the received fluids is the primary contribution to the explosion hazard, with the pressure of the flow, coupled with volume in the case of vessels, being the key parameters in determining the magnitude of release for a given leak size. The temperature of the fluids has an influence on the degree of absorption of gas within the crude oil, but is much less significant in terms of explosion hazard than pressure. The sweetness of the crude and the water content are the primary contributors to corrosion risk, with sand entrainment being the key contributor to erosion.
166
Separation of process, drilling, utilities and accommodation The process area has the highest risk on the facility, in terms of explosion hazard, as a consequence of the high pressures and the number of potential leak sources in the pipework, pressure containing vessels and machinery. It is normal to distance the gas compression plant from the separation vessels, where possible, to reduce the escalation risk for any single event. The wellbay and drilling facilities have the next highest risk, due to the amount of flanged pipework required to connect the trees to the manifold and the tendency of this pipework to move in concert with the conductors. The utilities area is much less vulnerable to serious explosion hazards, but a risk is still present, for example with fuel gas for power generation. Export route the availability of a convenient nearby pipeline, with available capacity, may determine whether export of oil is by tanker or pipeline. To date, gas has either been flared, exported by pipeline, or re-injected into the formation for later export; excessive flaring is no longer considered to be an option in many parts of the world, due to environmental considerations. The required pipeline entry pressure will contribute to the compression requirements for the platform. The degree of gas compression has a significant influence in the potential for leaks and the resulting gas cloud sizes in the process area. Gas lift - The other factor in determining compression requirements is whether gas or electrical submersible pumps are used for artificial lift of the oil. The gas lift lines are a major potential hazard due to them being small bore, high pressure and subject to vibration due to tree movement. A major hazard is also presented in the loss of containment of the gas in the well annulus. Switching from gas lift to electrical submersible pumps is generally not an option on existing installations, due to the compressor design requiring a minimum throughput to maintain efficiency for new installations the electrical submersible pump option is much safer. Regulatory regime Regulations vary in different parts of the world and cognisance is therefore required of the relevant governing regulations for the installation location, irrespective of where the design is executed. Budget, timescale and external factors Best practice may sometimes be compromised by the available budget and project timescale, whether for new build or modifications to existing installations. Similarly external factors such as lift vessel availability may influence or determine the outcome of a particular decision, resulting in a less than optimum solution. The degree of compromise should be documented for evidence in hazard review and project safety audits. Initial hazard review The initial hazard review can make judgements based on past experience and advise on the consequences of initial engineering or management decisions. This review process must be open, however, to new understanding on explosion loading and response, as well as to the capabilities of new technology or design methods. The initial QRA must be based on current generic data for leak and ignition frequency, or take account of proposed high integrity solutions which offer better hazard management, in order to be meaningful and aligned with the design process.
7.2.3
Sub-sea Layout
As discussed above, the sub-sea layout can significantly influence the topsides inventory and the topsides hazard. Additional elements to those already covered above, include:
167

sub-sea isolation valves (SSIV); high integrity pipeline protection systems (HIPPS); emergency shutdown valves (ESDVs); pipe-in-pipe risers; new or pre-installed risers; in-field pipelines; sub-sea storage.
Several of these elements affect topsides risks by their vulnerability to dropped object hazards causing sub-sea leaks. The pipe-in-pipe solution requires the use of vents to control leaks, in which the construction arrangement inhibits in-service inspection and repair. This arrangement may be preferable to single skin risers for reasons of insulation to maintain oil temperature. The use of new or pre-installed risers is a judgement as to the fitness-for-purpose of the existing riser, given its current condition and design specification, as balanced against the construction risks, operational risks, cost and impact on the global structural integrity of a retrofit custom designed riser.
7.2.4
Process Engineering
Having got the reservoir fluids to the topsides, the process design then has to evaluate and specify equipment which will convert the fluids to export specification, in such a manner that the changing circumstances through the life of the field can be met, together with any allowances for future expansion. The influences on explosion hazards here are leak sources and the magnitude of the release, generally through mechanical connections, but also associated with corrosion and human intervention. Areas for consideration include:
separation; cooling/heating; compression; water injection; sand entrainment; metering; vessel size and configuration; storage prior to export.
Water injection is included here as being associated with aquifer water and the pipework contributing to process area congestion. Sand is primarily a source of vessel and pipework erosion; water is the primary source of corrosion.
168
Vessel size is a consideration in terms of the quantity of the topsides inventory and the potential for fuelling a fire in case of rupture. Vessel size is also crucial in terms of reducing pressures during blowdown. Smaller vessels may thus be more controllable in emergency situations, but may be less efficient in operating terms. The layout stage is important in the provision of adequate inspection and maintenance access, selection of laydown and storage areas and mechanical handling routes between the laydown areas and the relevant equipment. The design should be influenced by reliability, operability, inspection and maintainability particularly in late field life.
7.2.5
Pipework
The initial pipework sizing and routing follows the layout process. Operational considerations included here are: provision of fixed and spring supports; valve locations; flange locations to facilitate installation and maintenance; material selection for robustness (wear control and corrosion resistance). The key areas for explosion hazard potential are leak sources and the magnitude of release, generally through mechanical connections but also associated with corrosion, fatigue, erosion and human error. The following also need to be considered in terms of explosion hazard management:
large deflections overloading flanges; joint damage due to mechanical impact; use of pipe supports as structural fuses to protect pipework at branches; area congestion; bundling and shrouding of pipes to reduce explosion turbulence; shielding of safety critical pipework to reduce drag wind loading.
Design should be influenced by the maintenance of piping joint integrity, inspection, maintainability and robustness. There should be a challenge to lagging/insulation for personal protection or heat conservation due to issue of corrosion risks hidden under lagging and also to the materials selection in the context of late field life costs and integrity.
7.2.6
Power Requirements and Electrical Systems
The power requirements can be determined after the compression and main pump designs are at an advanced stage. The main considerations here, in terms of explosion hazards, are associated with hot surfaces and electrical sparks. Elements for consideration include: motors; transformers; switchgear and distribution boards; control panels and junction boxes. The security of supply to critical services (e.g. TR pressurisation) and protection of generator and TR HVAC intakes from smoke/gas ingress. The key design considerations are inherent safety and robustness.
169
7.2.7
Instruments and Controls
A key consideration in terms of explosion risk is whether instruments are powered by air, electricity or fuel gas, the later obviously having an associated leak potential and the middle option an ignition potential. Intrusive instrument tappings are a major potential source of leaks and non-intrusive options are recommended if possible. Local or remote control is significant in terms of manning levels within hazardous areas. The Control Room layout is critical in terms of the potential for human error in crisis management information overload is now recognised as a cause of delay in response times. Cabinets in hazardous areas need to be robust to withstand explosion loading and prevent missile penetration. Instruments and controls (valve wheels, handles, switches etc) need to be accessible to minimise or eliminate the need for scaffolding or other temporary access, hence reducing congestion, vent paths and potential missile material. A review of potential standardisation of components is likely to lead to reduced human error. The durability of components and software should be an important design consideration, along with the potential for upgrade or expansion to accommodate future platform modifications. The mixing of system types or overloading of components can lead to increased explosion risk.
7.2.8
ESDV, Blowdown, Pressure Relief Devices and Isolation Systems
The Emergency Shut-Down Valve (ESDV) system provides the means of isolating the installation from import and export pipelines, in order to control the topsides inventory in an emergency or quickly terminate export in the case of a pipeline or riser leak. The blowdown system rapidly transfers the gas or oil inventory to the vent, flare or reservoir in a controlled manner, in order to reduce the potential for further escalation in the case of a fire or leak. Pressure relief devices are provided on process systems to prevent rupture of pressure vessels and leakage of pipework joints under applied pressure arising from faults in the process control system or as a result of fire. The isolation systems enable safe and secure isolation of key inventories and components to enable draining and purging of fluids prior to maintenance or inspection. The same influences and design requirements apply to general pipework, but both the blowdown and isolation systems require a very high integrity, reliability and survivability in order to function safely. These systems can involve a large number of flanged connections and isolation systems are associated with components that are regularly subjected to manual intervention. An area of potentially poor design that has become apparent recently is that onshore refinery based design codes for blowdown systems [49] are based on fire loads which are too low for the offshore industry [123] . These codes do not take account of the stress distribution in the vessels and the strength of the vessel steel is reduced faster than is applied in the codes, as a result of the higher heat load that would be typical. The vessel integrity may thus be compromised before the blowdown is achieved. Reference [60] is a good starting point on this topic, although work is continuing at the time of writing. Reviews of blowdown system efficiency are also now considering sequenced blowdown as a means of improving overall response time. Such reviews need to assess manual versus automatic or semi-automatic shutdown of systems on high-level gas detection.
170
Considerations for reliability and robustness of systems include the use of double isolation valves, high integrity seals, the attachment of small bore bleed pipework in double block and bleed isolations and the selection of appropriate pressure relief valve devices. Some operators have experienced a number of failures of bellows in balanced bellows type relief valves [124] . An impaired pressure relief valve may fail to prevent an explosion or lead to a sudden large toxic gas release in the event of rapid escalation of fire. Bellows failure may be caused by valve chattering, incorrect material specification or pressure rating, incorrect installation, incorrectly specified fatigue life or incorrect dimensional tolerances on the valve seat and bellows manufacture.
7.2.9
Utilities Requirements
Utilities systems in themselves are not contributors to explosion risk, however, they can contribute to congestion and their failure under explosion loading may reduce the ability to mitigate a following fire or contribute to secondary incidents such as chemical spills. Utility systems include: firewater deluge; seawater cooling; diesel and potable water tankage; chemical storage; HVAC. The design and routing of deluge mains is of primary importance in ensuring a robust system capable of withstanding the Strength Level Blast and providing continued deluge coverage outside the affected area in a Ductility Level Blast.
7.2.10
Layout
The equipment layout is usually based on good past experience and an awareness of design details that can lead to problems with poor ventilation, congested explosion venting, blast wind turbulence and high explosion overpressures. The finished layout may then be validated by CFD modelling. The main layout considerations are: process economics; accessibility; pipework protection; ventilation; congestion; escape routes; trip hazards; mechanical handling provision; storage; maintenance access; growth provision; HVAC; cable trays; pipe racks; lighting; communications.
7.2.11
Structural Arrangement Topsides
In the sequence of design phases, a suitable nominal overpressure for a facility type and location may be available for initial structural sizing. A load factor would be required to enable sizing by elastic methods, as non-linear analysis would be too extravagant for initial sizing, this could apply 50 % of the nominal load for elastic design, with safety factors of 1.0 and characteristic material properties; one third to one half of the DLB has been quoted elsewhere for initial estimates of SLB loading. The primary structural steelwork will often have been sized for other load considerations (operating loads, installation or environmental) but blast walls will be sized for these blast loads.
171
Topsides structural and architectural design includes the following considerations: modules and module stools; integrated decks; blast walls, wind walls and fire walls; floors, equipment supports and pipe supports; stairways and escape routes; bridges and bridge supports; lifeboat and liferaft supports; doors and windows; passive fire protection (PFP); lift points; tall structures drilling derrick, cranes and masts; living quarters (LQ) and temporary refuge (TR); Control Room and Workshops; Helideck; fabric maintenance and inspection; growth provision; decommissioning. In the design of architectural features such as doors and windows in the LQ, whose failure could lead to TR impairment, it is important to consider the negative pressure impulse immediately following the initial high positive pressure impulse. The ability of doors and windows to resist outward loading is generally much lower than that of inward loading due to the construction details and assembly method.
7.2.12
Structural Arrangement Substructure
Whilst less susceptible to direct impairment from explosion loading, the substructure arrangement can have a bearing on the behaviour of the facility under extreme events. The main structural forms for manned installations are:
Fixed steel platforms; Gravity based steel platforms; Spars TLPs Gravity base concrete platforms; Jack-up production and drilling platforms; Floating structures semi-submersible, FPSO.
Some fixed steel platforms have diesel tanks in the legs close to the topsides; FPSOs have storage tanks beneath the process modules; jack-up production facilities will have diesel tanks in the side double skin or crane pedestal. Subsea oil storage is not considered to be an explosion risk, however, such tanks will require vent pipework to control gas build-up and allow tank purging. Conductor and riser support is important in the control of flowline vibration topsides. Such vibration can have a significant impact on attached small bore pipework fatigue, particularly with gas and chemical injection pipework. The provision of pre-installed risers and J-tubes for future satellite development can significantly reduce the explosion hazard associated with construction activities on the topsides. A robust sub-structure design will significantly reduce the explosion risk associated with strong lateral vibration resulting from major boat impact hazards. Structural redundancy will ensure adequate support to the topsides in the case of a surface pool fire, ensuring that gross deformation of the topsides does not result, leading to secondary releases and explosion risk.
172
7.2.13
Explosion & Fire Hazards Review
If the ALARP (as low as reasonably practicable) criterion has not been met, following assessment of an existing structure, for example, the degree of non-compliance needs to be established and various options described elsewhere in this Guidance will need to be considered to further determine the optimum route for reduction of the explosion hazard: A comparative exercise is required to document the pros and cons of one or more of the options, equating cost, risk savings, timescale, practicability etc. For modifications to existing installations factors such as lack of bed space and production downtime for modifications are significant factors in the calculation.
7.2.14 Modifications to existing installations: Survey, Hook-up and Commissioning

The balance between construction risk and operational risk in pipework modifications needs to be carefully assessed. It is sometimes impracticable to handle long lengths of new pipework offshore, especially where complex geometries are involved. Flanged connections present an ongoing operational leak risk, but welded connections are difficult to achieve on a live installation, requiring pressurised welding habitats the manning levels for which often require more space than is available. The balance is thus drawn between the cost of lost production and the increased hazard presented by more pipe flanges. If high integrity flanges are used, where the flange class ratings are higher than required for the design pressure rating of the pipe, then the system ductility will be tolerant of explosion loading and brittle modes of failure and flange leakage will not result. With all piping systems the location of flanged joints must be considered in conjunction with the selection of support locations, to avoid joints being placed at locations where high ductility is required. Nitrogen leak testing is recommended for all hydrocarbon pipework following new construction and maintenance. Leaks can often be detected in existing pipework following a shutdown, even where no intervention had occurred, as a consequence of joint relaxation upon cooling or accidental mechanical impact. The need for detailed dimensional surveys for pipework tie-ins at the hook-up stage is demonstrated time after time. Reliance on as-built drawings has caused many project delays, whereas a single visit offshore to confirm the accuracy of the recorded data would have ensured a better fit-up and eliminated clashes with items not included on the referenced drawing. The use of PDMS (Plant Design Management System), which integrates data from all disciplines in a 3-D model, has vastly improved clash control, but as-built models are still rare. The consequences of being ill-prepared at hook-up, in terms of explosion hazard, are that piping joints are cold-stressed and on-site fit-up rectification is required for pipework or structures, that may involve hot work. An additional requirement for works on existing installations is a well-developed installation scheme. Craneage requirements, laydown availability, mechanical handling routes, clearances and temporary removals (pipework, cabling etc) all need to be clearly defined and prepared for. The consequences of unexpected problems can again be associated with human error, leading to gas leaks, ignition sources and hence explosion risk.
173
7.3
7.3.1
Best practice in explosion hazard design

Introduction
Best practice is a subjective term, but will be used here to describe the outcome of a design process that would result in the minimal explosion risk for a viable concept. The term viable is necessary, as the absolute minimum risk may result in a design that is not commercially viable. Design is a balance between conflicting objectives. Rarely will two designs have the same set of parameters and therefore the same outcome. In each design process, the needs of each design discipline must be weighed against each other, as well as those of the operating requirements, the regulatory requirements, commercial considerations and safety. ALARP (as low as reasonably practicable) is one term used to measure the acceptability of the resulting risk to personnel safety, commercial viability and the environment. This sub-clause outlines briefly the considerations used to arrive at a best practice design. These considerations are constantly changing as new technologies and new explosion behaviour or response information becomes available. Detailed guidance will be contained in Part 3 of the Guidance Document.
7.3.2
Management of the Explosion Hazards
High risk activities, such as start-up, testing, sampling, blow-down, draining, flushing and venting, can have the associated risks reduced by good design, as well as good working practices. Other high risk activities like construction and maintenance, well operations, relief valve testing and simultaneous operations will also have reduced associated leak risks through good design and planning. Design has a big influence on the prevention of ignition. Hot surfaces, electrical equipment, lights, and equipment earths are all fixed ignition sources that need to be designed or selected with recognition of the potential explosion hazard. Selection of a higher specification, different location or gas tight enclosure will reduce the ignition risk. Temporary ignition sources, such as hot work or poorly earthed scaffolding or equipment, need to be eliminated or controlled, by design and operating procedures. The need for a calm weather policy should be considered. External ignition sources, such as ship exhausts, helicopters and lifeboat engines, also need to be considered in the design process.
7.3.3
Derivation of Explosion Loadings.
An increase in venting area can be achieved in modifications to existing installations as a mitigation measure. Venting panel locations can also be optimised, to best suit the particular geometry of the structure and identified ignition sources. The effects of venting on escape routes and adjacent areas needs to be considered, however. Similarly, the consequential damage caused by displaced wind walls or blow-out panels must be considered.
7.3.4
Response to Explosions
The key factor in the response of the structure or equipment to explosions is the limitation of escalation damage, or containment of damage. Measures to be considered under this category include: the minimisation of potential missiles; the strengthening or protection of critical safety systems and critical equipment; the protection or behaviour of the primary and secondary structures subjected to explosion loads; the deflection of decks; behaviour and ultimate capacity of blast walls; mechanisms of escalation and the stability of tall structures; the protection from loss of containment damage to process systems components.
174
The subject matter in this category is very broad and needs to be addressed by simple, generic guidance in this Part 1 document, with detailed assessment being performed in accordance with Part 3 of the Guidance. Several of the measures are procedural, especially in the area of missile limitation. The design based issues, whether for new or existing installations, can involve multi-discipline aspects, not just structural. Blast wall performance can be compromised by the need for pipe transits, cable conduits and access manways. Capacity is not necessarily related to stiffness but to ductility. Connection capacities can be more critical than span capacity. Increased capacity in existing systems can often be demonstrated through the use of non-linear analysis, where simple elastic methods were used in design the strain limitations of the welded connections may be the limiting factor. Mechanical strengthening may have to be achieved through cold work solutions, if platform shutdowns are to be avoided. Complex loading situations need to be considered on space frame systems, with understanding of the real collapse and failure mechanisms, where computer modelling may only represent idealised post-yield and joint behaviour. Equally important, the initial failure in the system may not represent the ultimate capacity, as the failed component may be redundant. The consequence of component failures within the collapse sequence must be appreciated. A weld failure along the edge of a blast wall may enable release of gas or flame into a previous safe area, with a potential tunnelling failure resulting. In other instances, say within a double skin wall, there may be no significant consequence from first failure.
7.3.5
7.3.5.1
Specific Considerations for Blast Walls

Corrugated Profiles
Corrugated profiles are commonly constructed from stainless steel due to its high energy absorption characteristics and good corrosion resistance. Typical failure strains for ASTM 316 stainless steel are in excess of 50 % with ultimate capacities in the region of 600 N/mm2. PrePiper Alpha, firewalls were used in situations where explosions were a possibility. However these were not initially designed for the blast loads and many were constructed from mild steel. The walls typically span from floor to ceiling and are normally provided by specialist blast wall suppliers. The height of wall that can be provided varies between 3 and 8 metres and thicknesses are typically from 6 mm to 12 mm. The behaviour of the wall is very much controlled by the web and flange slenderness limits, the column slenderness of the wall, the flange to web ratio, corrugation angle and the end connection details. It is important to be aware of the interdependence of some of the controlling parameters such as the angle of corrugation which will control the degree of restraint to the flange. Also the web/flange ratio plays a crucial role in controlling buckling of the section. Previous research [125] on profiled flooring systems suggests a maximum value of 1.5, although limited profiles were given which may not be appropriate for blast walls. A guide issued by FABIG, Technical Note 5 [6] provides guidance for web and flange slenderness limits based on stub girder tests in order to classify the section. In traditional static design of typical universal beam members in bending, codes give slenderness limits for web and flange elements independently despite the fact that one provides restraint to the other.
175
Extensive validation work has been carried out to ensure designs are conservative based on this specification with an effective width concept adopted to account for the actual stress state. With profiled sections under blast loads there is little published data to provide the same extent of validation for using these results. Also the web in this case is loaded by the pressure providing a destabilising load. It should also be noted that Reference [6] provides guidance on the selection and design of profiled barriers. However, this deals with design criteria for predominantly elastic wall profiles and recommends the use of NLFEA to provide performance standards for ductility factors greater than 1.5 for plastic sections. It is important to be aware of the change in behaviour of the wall with increasing depth. For relatively shallow profiles the corrugations can open up under a blast pressure load allowing some of the energy of the explosion to be absorbed by the deflection of the wall. This also has the effect of reducing the forces applied at the supports. If a deeper wall is adopted which is very stiff, then little of the blast energy will be absorbed via bending deflections. This will attract high shear forces which will impose large forces at the connections and could induce buckling of the cross section. Buckling issues need to be carefully checked for deep troughed walls. Double skin profiled systems have also been adopted recently where the skins were separated by an air gap with the same profile used for both layers to allow for a blast occurring from either side. The concept being that one of the skins becomes sacrificial while the gap increases the standoff from the explosion and impacts the second skin. The wall is designed to be flexible to allow much of the energy to be dissipated in bending.
7.3.5.2
Stiffened Panels
Stiffened panel blast walls consist of a flat plate stiffened by a series of vertical and horizontal stiffeners and is supported by the main steel structure. For integrated decks the stiffeners are continuous and are required to carry large service loading. As a result, they are likely to be closed hat type sections. Although plates can resist high loads through membrane action, this will be transferred to the main structure as an axial force and requires careful consideration, particularly if the deck is carrying high service loading. Many stiffened panel walls have connection details which minimise the transfer of high axial forces to the main structure for this reason. Where there is a need to assess the capacity of module walls and columns with in-plane loads the effects of static loads need to be considered on the response of structural members:
7.3.5.3
Support Details for Blast Walls
Support details for any blast barrier are crucial to ensure that the integrity of the wall is not breached during an explosion and must be detailed such that they are not the weak link. Walls are normally attached at their top edge to the flanges of primary beams, normally allowing rotations to occur such that large membrane forces are not developed. It is important to ensure that any stress concentrations, which may not always be avoided, occur in the components of the connection rather than the weld itself. The connection must be sized to transfer the computed reactions and to assure that any plastic hinges can be maintained in the assumed locations. They should be designed for a capacity that is greater than its supported member. The bottom of the wall is commonly welded to a channel or angle section attached to the top of the deck in order to allow for rotation to occur. In some cases the wall is welded directly onto the deck which has no rotational flexibility, relying totally on the top connection for this.
176
Results from a recent JIP, which investigated tests on firewalls carried out at the Spadeadam test site, together with numerical studies, have shown that flexible angle connections arranged in a dog-leg configuration performed well in terms of energy absorption capability [6].
7.3.5.4
Increasing Blast Capacity for Existing Structures
In situations where walls have limited clearance strengthening schemes which considerably stiffen the wall have been adopted. Yasseri [126] has discussed a number of these, including adding a facing plate (flat or corrugated) to the wall or the addition of an X-bracing or stiffening in the form of a light grillage welded to the wall. However limiting the deflection of the wall means less energy of the blast will be absorbed in bending which will attract high shear forces at the connections. Stiffer walls also tend to exhibit more brittle failure modes.
7.3.5.5
Transits penetrations in Blast Walls
Ideally no penetrations should be allowed in the wall as these are likely to reduce the available ductility under blast loading. However, if they are required they should be located at the top or bottom of the wall, or other locations where deflections will be a minimum. For existing installations the problem is likely to be more complex, as there are likely to be many penetrations including doors in some instances. These need special attention particularly in relation to any likely stiffening which can introduce undesirable stiff areas which attract high loads. In addition to the above considerations, it is also necessary to define whether the service moves with the wall or not. For instance, a large pipe can be regarded as a fixed object and the wall must move relative to it. However, a cable has a degree of flexibility, and providing adequate extension is available, can be anchored to the wall.
7.3.5.6
Combined Behaviour of Decks and Walls
It has been suggested that internal ties, which restrict the differential movements between the floor and the ceiling, may be incorporated into the design to enhance its blast resistance. The ties must be designed so that do not carry any compressive loading occurring as a result of operational loading or the explosion rebound of the deck structures. In order reduce local loading effects the ties should preferably link the stiffer members of the deck structures.
7.3.6
Integration with Fire Hazard Management
The integrity of door strengths and seals is of primary importance on air lock systems. The doors and seals need to retain integrity through both the positive and negative parts of the explosion impulse, the greater strength in the door mountings being present to resist the positive pressure loading.
7.3.7
Operations, Inspection and Maintenance Issues
Good design is intended to deliver a reliable, robust system to the workplace that meets the required specification. How that system is operated and maintained is outside the control of the designer, although recommendations can be made regarding inspection, maintenance and operating procedures.
177
In designing modifications to existing installations, the designer can assist with the continuation of existing safe working practices and safety records by using the same equipment and material specifications as are prevalent, in addition to consistent sparing philosophies and tool sizes as are in use for that installation. Operating procedures should recognise the explosion hazards associated with the misuse or poor maintenance of equipment. Rigorous testing procedures should prevail to ensure that any intervention activities with pressurised hydrocarbon systems are executed only after depressurisation and purging is confirmed. Following reinstatement of systems, nitrogen leak testing is recommended to confirm joint integrity. Inspection and maintenance procedures should be regularly reviewed to assure that best current practices are considered, whilst retaining the intended operating philosophy and design parameters. Inspection methods should recognise the function and performance of insulation or fire protection systems and ensure that the performance is not compromised by removal of such systems in order to gain inspection access.
7.4
7.4.1
Industry and Regulatory Authority Initiatives

ATEX Directives
The ATEX (Atmospheric Explosion) Directives 94/9/EC and 1999/92/EC cover electrical and mechanical equipment and protective systems, which may be used in potentially explosive atmospheres (flammable gases, vapours or dusts). The term equipment is defined as any item which contains or constitutes a potential ignition source and which requires special measures to be incorporated in its design and/or its installation in order to prevent the ignition source from initiating an explosion in the surrounding atmosphere. Also included in the term equipment are safety or control devices installed outside the hazardous area but having an explosion protection function. Protective Systems are defined as items that prevent an explosion that has been initiated from spreading or causing damage. They include flame arresters, quenching systems, pressure relief panels and fast-acting shut-off valves. These directives have been adopted by the European Union (EU) to facilitate free trade in the EU by aligning the technical and legal requirements in the Member States for products intended for use in potentially explosive atmospheres.
7.4.2
Bolted Pipe Joints
An essential aspect of maintaining integrity in mechanical joints is correct joint design and analysis. In the case of bolted flanges this is achieved through the use of design codes such as PD5500 and ASME VIII as well as correctly executed working practices with regard to joint make up. In the case of bolted joints, this includes sequence of bolt tightening, method of tightening (torqueing or tensioning) and leak testing. These factors all influence the integrity and pressure retention capacity of the joint and if any or all of these are not rigorously followed, failure will result. A UKOOA guideline [115] is in preparation that covers the lifecycle activities of bolted pipe joints, including the critical aspects of system design, construction, maintenance and operation. It will set out the principles of joint integrity management and provide examples of best practice to assist operators in develop their own management systems. Training and competency are significant contributors to successful safe operating practices and demonstrate that good design alone is not sufficient where manual intervention is required with hydrocarbon systems.
178
7.4.3
Small Bore Pipework, Tubing and Flexible Hoses
These components are commonly used in process systems both for instrument connections and other process duties. A common definition of small bore is 50mm and under. Small bore piping and tubing is often site run without any particular assessment of the strength and integrity of the configuration. They require special treatment due to this and the fact that it is often difficult to provide assurance of their capacity when exposed to accidental loads such as blast loads. Most concerns with these systems are associated with vibration and fatigue, which could lead to uncontrolled releases, as the received explosion loads are of small magnitude. In actuality the loads derived from large differential movements between supports on these systems can be critical, but then the additional released inventory may not be significant in terms of the unfolding event. The recently published Guidelines for the Management, Design, Installation and Maintenance of Small Bore Tubing Systems [127]) records that "small bore tubing systems are the single largest contributor to the incidence of process containment rupture in potentially hazardous plants". As such, the adoption of these guidelines go some way to assuring the integrity of tubing systems under operational loading, such as vibration, and should be adopted as a basis for good practice for resistance to accidental loads, such as mechanical impact, which are a further cause of releases. A joint UKOOA/HSE workgroup is to be set up to review general industry best practice on flexible hose management. Shells flexible hose management system has been offered as a starting point. This system uses a risk matrix to categorise the consequence of hose failure in terms of human injury, environmental impact and production or equipment losses. An inspection and hose replacement frequency is determined by the hose classification and performance standards for hose condition and competency standards for operators have been established. All Shell installations have been reviewed for compliance with this strategy.
179
8
[1]
REFERENCES
Bowerman H., Owens G W, Rumley J H, Tolloczko J.J.A., Interim Guidance Notes for the Design and Protection of Topside Structures Against Explosion and Fire, Steel Construction Institute Document SCI-P-112/487, January 1992. FABIG Technical note 1, Technical note on Fire resistant design of offshore structures', SCI 1993. FABIG Technical note 2, Technical note on Explosion mitigation systems, SCI 1994. FABIG Technical note 3, Use of ultimate strength techniques for fire resistant design of offshore structures, SCI 1995. FABIG Technical note 4, Explosion resistant design of offshore structures, SCI 1996 FABIG Technical note 5, Design guide for stainless steel blast walls, June 1999. FABIG Technical note 6, Design Guide for Steel at Elevated Temperatures and High Strain Rates, SCI 2001 FABIG Technical note 7, Simplified methods for analysis of response to dynamic loading, 2002. Selby C A, Burgan B A, Blast and Fire Engineering for Topside Structures Phase 2, Final Summary Report, Steel Construction Institute, ISBN 1 85942 078 8, 1998 Johnson D.M., Cleaver R.P., Gas explosions in offshore modules following realistic releases (Phase 3B) Final summary report, Advantica report R4853, February 2002. Pappas J., The NORSOK Procedure on Probabilistic Explosion Simulation, Paper 5.5.1, ERA Conference, Major Hazards Offshore, London 27-28 November 2001, ERA Report 2001-0575. NORSOK, Guideline for Risk and Emergency Preparedness Analysis, Z-013. Design of Offshore Facilities to Resist Gas Explosion Hazard, Engineering Handbook, Ed. Czujko J., CorrOcean 2001. Industry Guidelines on a framework for risk related decision support, UKOOA, Issue 3, February 1999. Bleach R., Updated Guidance for fire and explosion hazards Part 1 Avoidance and mitigation of explosions, CTR 103, Explosion hazards philosophy, Genesis Oil and Gas Consultants, August 2002 Bleach R., Updated Guidance for fire and explosion hazards Part 1 Avoidance and mitigation of explosions, CTR 104, Management of explosion hazards, Genesis Oil and Gas Consultants, August 2002. Bleach R., Updated Guidance for fire and explosion hazards Part 1 Avoidance and mitigation of explosions, CTR 107, Interactions with fire hazard management, Genesis Oil and Gas Consultants, August 2002.
[2] [3] [4] [5] [6] [7] [8] [9] [10] [11]
[12] [13] [14] [15]
[16]
[17]
180
[18] Fairlie G., Updated Guidance for fire and explosion hazards Part 1 Avoidance and mitigation of explosions, CTR 105, Derivation of explosion loadings method support dossier, Century Dynamics Ltd., August 2002 Warwick A., Updated Guidance for fire and explosion hazards Part 1 Avoidance and mitigation of explosions, CTR 105, Preparation of updated guidance for fire and explosion hazards Derivation of explosion loadings, W.S. Atkins Inc., August 2002 Louca L.A., Friis J. and Carney S.J., Updated Guidance for fire and explosion hazards Part 1 Avoidance and mitigation of explosions, CTR 106, Response to explosions, IC Consultants and Aker Kvrner, August 2002 Carney S.J., Gall D., Louca L.A., Friis J., Updated Guidance for fire and explosion hazards Part 1 Avoidance and mitigation of explosions, CTR 108, Guidance on detailed design, Aker Kvrner, IC Consultants, August 2002. Explosion assessment guidelines, Genesis oil and gas consultants, report J6838 for the HSE June 2001. Hydrocarbon release reduction campaign, HSE books, HSE OSD report OTO 2001 055, HMSO 2001. Worldwide offshore accident database, (WOAD), DnV Publications, OREDA Offshore reliability data, Penwell Books. Offshore Accident and Incident Statistics Report 1998, OTO 98: 952, HSE, HMSO, 1998. Accident statistics for fixed offshore units on the UK continental shelf 19911999, DnV for the HSE, OTO 2002 012, HMSO 2002. UKOOA Hydrocarbon release statistics review, UKOOA, January 1998. Offshore Installations (Prevention of Fire and Explosion and Emergency Response) Regulations (PFEER), HMSO, 1995 Offshore Installations (Safety Case) Regulations (SCR), HMSO 1992. Offshore Installations and Wells (Design and Construction, etc.) Regulations (DCR), HMSO 1996. Assessment principles for offshore safety cases (APOSC), HSE Books, HSG181, ISBN 0 7176 1238 4, HMSO 1998. The offshore installations and pipeline works (Management and Administration) Regulations, HMSO, (SI 1995/738), (MAR) Petroleum and natural gas industries Control and mitigation of fires and explosions on offshore production installations Requirements and guidelines, 1st Edition. 1999, ISO 13702. Area Classification Code for Petroleum Installations, Institute of Petroleum. March 1990. (IP 15)
[19]
[20]
[21]
[22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34]
[35]
181
[36] [37] [38] [39] Electrical apparatus for explosive gas atmospheres Part 10. Classification of hazardous areas, BS EN 60079-10. Explosive atmospheres. Explosion prevention and protection BS EN 1127-1 : 1998. Code of practice for control of undesirable static electricity, BS 5958 : 1991. JIP Gas build up from high pressure natural gas releases in naturally ventilated offshore modules Workbook on gas accumulation in a confined and congested area, BP Amoco, CERC, BG Technology, May 2000. Policy and Guidance on reducing risks to ALARP in Design, HSE web site http://www.hse.gov.uk/dst/alarp1.htm Principles and Guidelines to Assist HSE in its Judgement that Duty Holders Have Reduced Risk as Low as Reasonably Practicable. http://www.hse.gov.uk/hid/spc/perm12.htm Reducing risks protecting people, HSEs decision making process (R2P2), ISBN 0 7176 2151 0, HMSO 2001. http://www.hse.gov.uk/dst/r2p2.pdf . Control of Risks at Gas Turbines Used for Power Generation, Guidance Note PM84 HSE. Alderman J.A., Carter D., White paper working group 1 Philosophy and management strategy, International workshop Fire and blast considerations in the future design of offshore facilities, June 2002, Houston Texas. http://www.fireandblast2002.com A Review of Potential Ignition Sources on Offshore Platforms, HSL Report, FS 99/09. Successful health and safety management, HSE books HS(G) 65, 1991. Recommended Practice for the planning, Designing and Construction Fixed Offshore Platforms Working Stress Design, API RP 2A-WSD, 21st Edition. API (American Petroleum Institute). Wishart J. et. Al., White paper working group 2 Safe design practice, International workshop Fire and blast considerations in the future design of offshore facilities, June 2002, Houston Texas. http://www.fireandblast2002.com API Recommended Practice 521, Guide for Pressure-Relieving and Depressuring Systems, 4th Edition, March 1997. Evans J.A., Johnson D.M. and Lowesmith B., Explosions in full scale offshore module geometries Main report, (Phase 3A) HSE books OTO 1999 043, 1999. Electrostatic hazards associated with water deluge and explosion suppression systems offshore, HSE books, OTO 95 026, 1995. Guidelines for instrument-based protective systems, Issue 2, UKOOA November 1999.
[40] [41]
[42] [43] [44]
[45] [46] [47]
[48]
[49] [50] [51] [52]
182
[53] Natabelle Technology Ltd, Explosion Loading on Topsides Equipment: Part 1 Treatment of Explosion Loads, Response, Analysis and Design, Health and Safety Executive Report OTO 1999 046, March 2000 Natabelle Technology Ltd, Explosion Loading on Topsides Equipment: Part 2 Treatment of Explosion Loads, Response, Analysis and Design, Health and Safety Executive Report OTO 1999 047, March 2000 Control of risks at gas turbines used for power generation, HSE Guidance note PM84. Tahan, N., Nicholson, R.W, Walker S. and Tandberg, D. The Design and Testing of a Louvered Blast Relief System, 3rd Intl. Conference and Exhibition Offshore Structures Design Hazards and Safety Engineering, London, 15 16 November 1994. Walker S and Klair M, 'The Escalation Consequences of Accidental Shock Loads', 3rd Intl. Conference and Exhibition Offshore Structures Design Hazards and Safety Engineering, London, 15 16 November 1994. Morrison G., Strong Vibration and Design for Robustness HSE ERA Conference Offshore Structural Design Hazards, Safety and Engineering, November 1994. Tam, V.H.Y.. Barrier Methods for Gas Explosion Control, Safety on Offshore Installations, ERA Report, 99-0808, December 1999 Review of the response of pressurised process vessels and equipment to fire attack, HSE, OTO 200 051. The Public Enquiry into the Piper Alpha Disaster, Cullen The Honourable Lord, HMSO, London, 1990. Fire and Explosion Aspects of FPSOs, FABIG Technical Meeting Notes, SCI, May 1997. Explosion Resistance of Passive Fire Protection, International Coatings Ltd. Report TN006. Blast and fire engineering project for topside structures, Report FR6 Fire performance of explosion damaged structural and containment steelwork, 1991. The effectiveness of area water deluge in mitigating offshore fires, FABIG Technical meeting review. Gregory J., Early design blast analysis, RISX Ltd. Report RISX/12-01-01/01, November 1998. Lea C. J., Ledin H. S., A Review of the State-of-the-art in Gas Explosion Modelling, Health and Safety Laboratory Report CM/00/04, 19 February 2002 Marsano S, Bowen P.J., ODoherty T. Modelling the Internal/External Interaction from Vented Explosions, 13th Australasian Fluid Mechanics Conference, Melbourne, Australia, 13-18 December, 1998. Structural Analysis and Design of Nuclear Plant Facilities, ASCE 58, 1980.
[54]
[55] [56]
[57]
[58] [59] [60] [61] [62] [63] [64] [65] [66] [67] [68]
[69]
183
[70] [71] Structures to Resist the Effects of Accidental Explosions Department of Army, Washington, D. C TM5-1300, November 1990 Walker S., Corr R. B., Tam V.H.Y., Guidance for the protection of Offshore Structures against Fires and Explosions, BP Corporation, Document Reference CH152R002 API Draft 0, September 2001. Cleaver R P, Humphreys C. E., Robinson C. G., Accidental generation of gas clouds on offshore process installations, J. Loss Prev. Process Ind., 7, pp 273-280, 1994 Hansen O R, Bergonnier S, Renoult J ,Wingerden K, Gas Explosions in Offshore Modules Following Realistic Releases (Phase 3B): Final Summary Report, Appendix E Phase 3B Lessons Learnt from CFD, Gexcon Report Number Gexcon-01-F36018-1, Advantica Report Number R4853, 2001 Cleaver R P, Halford A R, Gas Explosions in Offshore Modules Following Realistic Releases (Phase 3B): Final Summary Report, Appendix H An Analysis of the Phase3B Large-Scale Gas Explosion Experiments, Advantica Report Numbers R4853 and R5107, 2001 Cox A W , Lees and Ang , Classification of Hazardous Locations E&P Forum, Hydrocarbon Leak and Ignition Database, May 1992 Mercx W P M, Johnson D M, Puttock J, Validation of scaling techniques for experimental vapour cloud explosion investigations. Process Safety Progress, 14, No. 2, 120-130, 1995 Bray K.N.C., Studies of the turbulent burning velocity, Proc. Roy. Soc. London. A 1990 431, pp315-335.. Harris R.J., The investigation and control of gas explosions in building and heating plant, ISBN 0 419 13220 1, E&FN Spon Ltd., 1983. Brewerton R W, Methods for increasing the Accuracy of Explosion pressure predictions in early phase of new topsides projects, HSE Report OTH 541, 1998. Mercx W P M, Johnson D M, Puttock J, Validation of scaling techniques for experimental vapour cloud explosion investigations. Process Safety Progress, 14, No. 2, 120-130, 1995 Shearer M J, Tam V Y H, Corr R.B, Analysis of results from large scale hydrocarbon gas explosions, J. Loss Prev. Process Ind. 13, 167-173, 2000 CREA Consultants Limited. Analysis of Structural Response Measurements Phase 3B Spadeadam, OTO 055/2000, 2000. Det norske Veritas, Offshore Standard DNV-OS-A101, Safety Principals and Arrangements, January 2001 Puttock J S, The use of a combination of explosion models in explicit overpressure exceedence calculations for an offshore platform, Major Hazards Offshore Conference, London, November 2000.
[72] [73]
[74]
[75] [76] [77]
[78] [79] [80] [81]
[82] [83] [84] [85]
184
[86] [87] [88] [89] Hoiset S, Hjertager B H, Solberg T, Malo K A, Properties of simulated gas explosions of interest to the structural design process, AIChE Process Safety Progress 17, 1999 Acts, Regulations and Provisions for the Petroleum Activity, Volume 2, NPD, December 1992. Yasseri S.F., An Approximate Method for Blast Resistant Design, Paper R429, FABIG Newsletter January 2002, SCI publication. Walker S., Corr R.B.., Tam V.H.Y.., Bucknell J. and OConnor P., Simplified Approaches to Fire and Explosion Engineering, Paper 3.3.1, ERA Conference, Major Hazards Offshore, London 27-28 November 2001, ERA Report 2001-0575. Yasseri S.F., Target explosion loads for offshore installations strength level and ductility level events, FABIG newsletter, October 2002. Lund J K, COSAC, The Tool for Efficient Hazard Identification and Risk Assessment in the early phase of a field development, ERA Major Hazards Offshore Conference, London, November 2000. Puttock J S, Improvements in guidelines for prediction of vapour cloud explosions, Int. Conf. and Workshop on Modelling the Consequences of Accidental Releases of Hazardous Materials, San Francisco, September 1999 Bruce R L, Blast Overpressure Prediction Modelling the Uncertainties, Offshore Structural Design ERA conference, Hazards, Safety and Engineering London November 1994, ISBN 0 7008 0587 7. Mood, M.A., Graybill, R.A., Boes, D.C. Introduction to the theory of statistics, 3rd Edition, McGraw-Hill, 1974. Vinnem J.E., Blast load frequency distribution assessment of historical frequencies in the North Sea, Preventor report 19816-04, November 1998. Corr R B, Tam V Y H, Snell R O, Frieze P A, Development of the limit state approach for the design of offshore platforms ERA Conference, London, 1999. Corr R.B. and Tam V.H.Y., Gas explosion drag loads in offshore installations, Journal of Loss Prevention in the process industries, 11 (1998) 43-48. Walker S and Haworth M.W., Sensitivity of response of topside structures to fires and explosions, HSE OTO 97 043, 1996. A Guide to the offshore installations (Safety Case) regulations 1992, HSE L39, HMSO 1992.(ACOP) Catlin C.A. et al. The blast loading imparted to a cylinder by venting of a confined explosion, ERA Conference, Offshore structural design against extreme loads, London, 3-4 November 1993. Biggs J.M., Introduction to Structural Dynamics, McGraw Hill, 1964. NORSOK Standard N-001, Structural design, Rev 3, August 2000. Clough, R.W, Penzien, J. Dynamics of Structures, McGraw-Hill, 1975.
[90] [91]
[92]
[93]
[94] [95] [96] [97] [98] [99] [100]
[101] [102] [103]
185
[104] [105] [106] Blast and fire engineering project for topside structures, BRI, The effects of simplifications of the explosion pressure-time history. Second impression, 1991. Blast and fire engineering project for topside structures, Report BR4, OTI:602 The effects of high strain rates on material properties, 1991 Blast and fire engineering project for topside structures, Report FR1, OTI:604 Experimental data relating to the performance of steel components at elevated temperatures, 1991 Blast and fire engineering project for topside structures, Report FR2, OTI:605 Methodologies and available tools for the design/analysis of steel components at elevated temperatures, 1991. BS EN 10225: 2001 Weldable structural steel for fixed offshore structures Technical delivery conditions. Jones, N. and Birch, R.S. Elevated Temperature and High Strain Rate Properties of Offshore Steels, The Steel Construction Institute. OTO Report 2001/020 EN 10088-2:1995, Stainless steel Technical delivery conditions. Jones, N. Structural Impact, Cambridge University Press, 1997. Earthquake Resistant Design for Engineers and Architects Dowrick, D. J. 2nd Edition, Wiley, 1987. Norsok standard Annex A, N-004 BS 6399 Part 1, Loading for Buildings Code of Practice for Dead and Imposed Loads. Guidelines for The Management of Integrity of Bolted Pipe Joints, Jan 2002, UKOOA. Walker S, Corr BR, Tam VHY, OConnor PA, Bucknell J, New guidance on fire and explosion engineering, paper OMAE02-28623, OMAE 2002, June 23-28, Oslo, Norway. Kato B., Rotation capacity of steel members subject to local buckling, Proc. 9th World Conference on Earthquake Engineering, Japan 1989. Explosion Hazards and Evaluation Baker, W. E. et al Elsevier Science Publishers, 1988. Bulletin on design of flat plate structures, API Bulletin 2V (BUL 2V) 1st Edition., May 1 1987. Taylor P.H., Stewart G., Harwood R.G., Blast wall strength estimated using finite displacement theory, OMAE98-1423, 17th conference on Offshore Mechanics and Arctic Engineering, 1998. Izzuddin, B., Simplified Methods for Dynamic Response Analysis. FABIG Technical Meeting, January, 2002.
[107]
[108] [109] [110]. [111] [112] [113] [114] [115] [116]
[117] [118] [119] [120]
[121]
186
[122] Louca, L. A., Punjani, M. and Harding, J. E., Non-Linear Analysis of Blast walls and Stiffened Panels Subjected to Hydrocarbon Explosions J. Constructional Res. Vol. 37, No.2, pp. 93-113, 1996. Medonos S. and Berge Dr. G., Why API Recommended Practice may Lead to Unsafe Design of Pressurised Systems. ERA Major Hazards Offshore Conference Nov. 2001. HSE Offshore Division Safety Notice 2/2002 May 2002 Balanced bellows pressure relief valves problems arising from modification of the bonnet vent. Rockey, K.C. and Evans, H.R., The Behaviour of Corrugated Flooring Systems, Thin Walled Structures, Crosby Lockwood, 1967 Yasseri, S.F., Fire and Blast Information Group Newsletter, Retrofitting of Blast walls for Offshore Structures. Issue No.15, 1996. Guidelines for the Management, Design, Installation and Maintenance of Small Bore Tubing Systems, Institute of Petroleum, June 2000.
[123]
[124] [125] [126] [127]
187
APPENDIX A ACRONYMS
ach AE AFFF AIR ALARP ALS API APOSC BDV BOP BSI CAD CAM CBA CCTV CFD CRA DAE DAF DAL DCR DIF DLB DNV DP DSHA E&P EDPV EER EN ISO EOA EPA EPCI EPDV air changes per hour Accidental Event Aqueous Film Forming Foam Average Individual Risk As Low As Reasonably Practicable Accidental Collapse Limit State American Petroleum Institute Assessment Principles for Offshore Safety Cases Blowdown Valve Blowout Preventer British Standards Institution Computer Aided Design Congestion Assessment Method Cost Benefit Analysis Closed Circuit Television Computational Fluid Dynamics Concept Risk Analysis Dimensioning Accidental Event Dynamic Amplification Factor Dimensioning Accidental Load Design and Construction Regulations Dynamic Increase Factor Ductility Level Blast Det Norske Veritas Dynamic Positioning Defined Situations of Hazard and Accident Exploration And Production Emergency Depressurisation Valve Escape, Evacuation and Rescue Euro Norm International Standards Organisation Emergency Overnight Accommodation Emergency Preparedness Analysis Engineering, Procurement, Construction and Installation Emergency De-Pressurisation Valve Issue 1, October 2003
188
ERA ESD ESD ESDV F&G FAR FEA FEED FES FMEA FPSO FRA GBS HAZID HAZOP HC HCLIP HES HIPPS HMSO HRA HS&E HSE HSMES HVAC ICAF IMO IR IRPA ISO JIP LCC LEL LIER LQ MDOF Early Risk Analysis Emergency Shutdown Emergency Shutdown Emergency Shutdown Valve Fire And Gas Fatal Accident Rate Fire and Explosion Analysis Front End Engineering Design Fire Explosion Strategy Failure Mode and Effect Analysis Floating Production Storage and Offloading Fire Risk Analysis Gravity Base Structure Hazard Identification study Hazard and Operability study Hydrocarbons Hydrocarbon Leak and Ignition Project Health, Environment and Safety High Integrity Pressure Protection System Her Majesty's Stationary Office Health Risk Assessment Health Safety & Environmental The UK Health & Safety Executive Health, Safety and Environmental Management Heating Ventilation & Air Conditioning Implied Cost of Averting a Fatality International Maritime Organisation Individual Risk Individual Risk Per Annum International Standards Organisation Joint Industry Project Life Cycle Cost Lower Explosive Limit Local Instrument and Electrical Room Living Quarters Multi-Degree Of Freedom
189
MODU NCS NFPA NLFEM NMD NNS NPD NPV NTS NUI OLF PA / GA PDO PDUQ PFD PFEER PLL POB QRA R&D RAC RBI RCM RRM RV SAR SBSD SBV SCE SCR SDOF SIL SINTEF SJA SLB SMS Mobile Offshore Drilling Unit Norwegian Continental Shelf National Fire Protection Association (Usa) Non-Linear Finite Element Method Norwegian Maritime Directorate Northern North Sea Norwegian Petroleum Directorate Net Present Value Norwegian Technology Centre Normally Unattended Installation Oljeindustriens Landsforening (The Norwegian Oil Industry Association ) Public Address / General Alarm Plan for Development and Operation Process, Drilling, Utilities, Quarters (Similarly PUQ) Process Flow Diagram Prevention of Fire and Explosion and Emergency Response Potential Loss of Life Persons On Board Quantitative Risk Analysis Research And Development Risk Acceptance Criteria Risk Based Inspection Reliability Centred Maintenance Risk Reduction Measure Relief Valve Search And Rescue Scenario Based System Design Stand-By Vessel Safety Critical Element Safety Case Regulations Single Degree Of Freedom Safety Integrity Level The Foundation For Scientific And Industrial Research At The Norwegian Institute Of Technology Safe Job Analysis Strength Level Blast Safety Management System Issue 1, October 2003
190
SNS TBL TEMPSC TR TRA TREPA UK UKCS UKOOA UPS VCE WSV Southern North Sea Federation Of Norwegian Manufacturing Industries Totally Enclosed Motor Power Survival Craft Temporary Refuge Total Risk Analysis Total Risk and Emergency Preparedness Analysis United Kingdom United Kingdom Continental Shelf UK Offshore Operators' Association Un-Interruptable Power Supply Vapour Cloud Explosion Written Scheme of Verification
191
APPENDIX B - GLOSSARY OF TERMS

Accident Accidental event (AE) See 'incident' Event or chain of events that may cause loss of life, or damage to health, the environment or assets NOTE 1 - The events that are considered in a risk analysis are acute, unwanted and unplanned. For instance; planned operational exposure that may be hazardous to health or to the environment, are usually not included in a risk analysis. Active Fire Protection A fire protection method that requires activation switching on, directing, injection or expulsion in order to combat smoke, flames or thermal loadings. Mitigation technique in which the release of suppressant is triggered as a result of flame or gas overpressure detection. As Low As Reasonably Practicable, a concept that forms the primary basis for determining the tolerability of risks and the adequacy of arrangements for managing risks to health and safety. Duty holders (The owner or operator of an existing installation or the designer of a new one) have a responsibility to reduce risk to ALARP . To reduce a risk to a level which is 'as low as reasonably practicable' involves balancing reduction in risk against the time, trouble, difficulty and cost of achieving it. This level represents the point, objectively assessed, at which the time, trouble, difficulty and cost of further reduction measures become unreasonably disproportionate to the additional risk reduction obtained. That ventilation which is not supplied from the action of the environmental wind alone ALARP expresses that the risk level is reduced (through a documented and systematic process) so far that no further cost effective measure is identified. The requirement to establish a cost effective solution implies that risk reduction is implemented until the cost of further risk reduction is grossly disproportional to the risk reducing effect. The minimum temperature of a vapour and air mixture at which it is marginally self igniting. The proportion of the total time that a component, equipment, or system is performing in the desired manner.
Active Mitigation
ALARP
ALARP
Artificial ventilation
As low as reasonably practicable (ALARP)
Auto-Ignition Temperature
Availability
192
Availability The probability of the system being available to perform the function when required. The average chance of any individual in a defined population sustaining a given level of harm from incidents which are considered to be limited to that population. (Sometimes called Individual Risk IR) Parts of a module wall, ceiling or roof which are designed to increase the area of venting in an explosion by being opened or removed by the force of the explosion. A structural division which has been designed expressly for the purpose of resisting blast loads. A pressure pulse formed by an explosion. Boiling Liquid Expanding Vapour Explosion; the result of a catastrophic rupture of a pressurized vessel containing a liquid at a temperature above its normal boiling point. Simultaneous ignition of the vaporizing fluid gives a short duration, intense fireball. The fraction of an area which does not provide open venting or free passage for a flame. The rapid controlled or accidental depressurization of a vessel or network. A form of jet resulting from ignition of a high pressure flow of oil and/or gas issuing from an uncontrolled well, possibly with a substantial fallout of heavy fractions which may also ignite on or around the platform as pool fires. The sudden rupture due to fire impingement of a vessel system containing liquefied flammable gas under pressure. The pressure burst and the flashing of the liquid to vapour creates - a blast wave and potential missile damage, and immediate ignition of the expanding fuel-air mixture leads to intense combustion creating a fireball The rate at which the flame consumes the unburnt gas/vapour. Also the velocity of the flame relative to the unburnt gas/vapour. A vertically aligned pipe, running from the module deck to a sub sea level, forming a service line for seawater suction or sewage/drilling disposal. Verbal form used for statements of possibility and capability, whether material, physical or causal
Average Individual Risk (AIR)
Blast Relief Panel
Blast Wall
Blast Wave BLEVE
Blockage Factor
Blowdown
Blow-out (ignited)
Boiling liquid expanding vapour explosion (BLEVE)
Burning Velocity
Caisson
Can
193
Cellulosic Fire A fire with a fuel source predominantly of cellulose (e.g. timber, paper, cotton). A fire involving these materials is relatively slow growing, although its intensity may ultimately reach or exceed that of a hydrocarbon fire. The proportion by weight of constituent elements in a particular batch of steel as determined by ladle analysis. The failure of components from the same cause An organisation engaged, as principal or contractor, directly or indirectly, in the exploration for and production of oil and/or gas. For bodies or establishments with more than one site, a single site may be defined as a company. A mathematical model in which the region of the flow is subdivided by a grid into a large number of control volumes. Confinement is defined as a measure of the proportion of the boundary of the explosion region which prevents the fuel/air mixture from venting or being released to the external atmosphere. An explosion of a fuel-oxidant mixture inside a closed system (e.g. vessel or module). Congestion is a measure of the restriction of flow within the explosion region caused by the obstacles within that region. Person, company or other association that performs work for an Operator or in other ways is a supplier of products or services to the Operator. Means of intervention permitted by the design (e.g. pressure relief valves, emergency power supplies) safety hardware (e.g. dump tanks, coolant sprays), or the presence of manually or automatically initiated ESD procedures which are intended to contain a developing situation so that escalation and a major accident may be avoided. Heat transfer associated with fluid movement around a heated body; warmer, less dense fluid rises and is replaced by cooler, more dense fluid. Transfer of material (fluid or gas) from one place to another. A quantitative technique to assess the overall value of a proposal taking into account its likely benefits and detriments.
Chemical Composition
Common Mode Failure Company
Computational Fluid Dynamics (CFD) Confinement
Confined Explosion
Congestion
Contractor
Control
Convection (Heat)
Convection Cost Benefit Analysis (CBA)
194
Creep The time dependent straining of a material. It is measured under a constantly applied load and, in the context of this report, at a fixed temperature. Defined by the criticality classes 1 (highest) to 3 (lowest) with respect to the explosion hazard and the consequences of failure. In particular the impact on the TR, EER systems and associated supporting structure. The basis/bases for assessing the performance of decision options. These range from technical codes and standards based ways of assessing options to values based assessments based on company or wider societal values and stakeholder expectations and perceptions. The background or environment in which the decision needs to be made. The decision context affects the importance of the various decision bases. For the purposes of the model the context is represented as a gradual transition from a technical basis to a values basis. Aspects of performance or influencing factors that can have a bearing on the decision, either because they directly affect option performance or because they determine the context in which the decision needs to be made. The decision framework consists of the model and accompanying guidance on the decision context and means of calibration. It provides the practical tool to aid decision making. The different options or solutions which are to be considered as means to resolve the problem. Mechanism for propagation of an explosion reaction through a flammable gas mixture which is thermal in nature. It is a relatively slow process and the velocity is always less than the speed of sound in the mixture (see Detonation). The chemical reaction of a substance in which the reaction front advances into the unreacted substance at less than sonic velocity. Where a blast wave is produced which has the potential to cause damage, the term explosive deflagration may be used. An accidental event for which SCEs on the installation should perform their function as designed. Design basis checks consist of checking the basis of the existing design for the installation and determining if the methods used for the design are acceptable in the context of the explosion hazard.
Criticality (of SCEs)
Decision Basis/Bases
Decision Context
Decision Factors
Decision Framework
Decision Option(s)
Deflagration
Deflagration
Design accidental event
Design basis checks
195
Design explosion loads Explosion loads used for design. SCEs must be designed to resist these load levels within the constraints of the associated element specific performance standards. Mechanism for propagation of an explosion reaction through a flammable gas mixture which is more mechanical in nature and acts through shock pressure forces. It is a very rapid process and velocity is always greater than the speed of sound in the mixture (see Deflagration). An explosion caused by the extremely rapid chemical reaction of a substance in which the reaction front advances into the unreacted substance at greater than sonic velocity. The range of fuel-air ratios through which detonations can propagate. That component of the blast wave which propagates into the sheltered region behind the structure. An expression relating to the range of mass transmitted through a given medium to that absorbed by the medium. It has units m2 s-1. Addition of inert gas to flammable mixture. AEs that serve as the basis for layout, dimensioning and use of installations and the activity at large, in order Ito meet the defined RAC. Load (action) that is sufficient in order to meet the risk acceptance criteria. Explosion loads which are of such a magnitude that when applied to a simple elastic analysis model, the code check results in members dimensioned to resist the ductility level explosion. An empirical multiplying constant used to relate the drag load on a structure to the stagnation overpressure. The drag load on a small obstacle due to the movement of gas past a small obstacle less than 0.3 m in the direction of flow, form drag Presented Area x Pdrag. Representative peak overpressure used in design (10-4 to 10-5 p.a. frequency level) Pduct. See DLB.
Detonation
Detonation
Detonation Limits
Diffracted Wave
Diffusivity
Dilution Dimensioning accidental event (DAE)
Dimensioning accidental load (DAL) Dimensioning explosion loads
Drag Coefficient
Drag force
Ductility level blast (DLB)
Ductility level design event
196
Ductility Ratio The ratio of the peak deflection to the deflection at first effective yield. The ratio of the maximum displacement of the element to the deflection required to cause first yield at the extreme fibres. The organisation, or company responsible for the safety of the installation or its design under UK legislation. Representative peak out of balance loads over target area, includes drag, pressure difference and gas acceleration effects. Used for calculation of loads on equipment and piping Pdyn, sometimes referred to as dynamic overpressure. Analysis which documents the fulfilment of performance standards for safety and emergency preparedness. Measurable performance standard for specific key items or systems relating to systems functionality, availability and survivability. (Sometimes referred to as low level performance standard). Emergency preparedness Technical, operational and organisational measures that are planned to be implemented under the management of the emergency organisation in case hazardous or accidental situations occur, in order to protect human and environmental resources and assets. Analysis which includes establishment of OSHA, including major AEs, establishment of performance standards for emergency preparedness and their fulfilment and identification of emergency preparedness measures . A safety shutdown system comprising detection, signalling and logical control, valves and actuators, which can, in tandem with alarm and direct control mechanisms, enable the safe and effective shutdown of plant and machinery in a controlled manner. A valve mounted in a pipeline, pipe or marine riser specifically for the purpose of cutting of the supply of its normal contents in an emergency. A constant used to quantify the radiation emission characteristics of a flame. Emissivity of a perfect black body is 1. The process by which surrounding fluid is drawn into a jet to cause its dilution.
Ductility ratio
Duty Holder
Dynamic pressure
Effectiveness analysis
Emergency preparedness analysis (EPA)
Emergency Shutdown System
Emergency Shutdown Valve (ESDV)
Emissivity
Entrainment
197
Environment The surroundings and conditions in which a company operates or which it may affect, including living systems (human and other) therein. A direct or indirect impingement of the activities, products and services of the company upon the environment, whether adverse or beneficial. A documented evaluation of the environmental significance of the effects of the company's activities, products and services (existing and planned).
Environmental effect
Environmental effects evaluation
EPA Equivalent static overpressure An overpressure derived from an overpressure trace with respect to a target which gives the same peak deflection when applied as a static load as the original trace. Consequences subsequent to an explosion or other major hazard. System which has a major role in the control and mitigation of accidents and in any subsequent EER activities Systematic process which involves planning and implementation of suitable emergency preparedness measures on the basis of risk and EPA, see above A plot of the value of a variable against the plot of the probability or frequency of exceedance of that variable. The ratio of burnt to unburnt gas volumes of a given mass of gas. A release of energy which causes a pressure discontinuity or blast wave. (see gas explosion) risk from the initiating event and possible subsequent escalation. External or secondary explosions which may result as an unburnt fuel/air mixture comes into contact with the external (oxygen rich) atmosphere as it is vented from a compartment. Events for which design is not reasonably practicable may result in loss of functionality of SCEs The fraction of the net combustion energy of a flame transmitted as radiation.
Escalation
Essential safety system
Establishment of emergency preparedness
Exceedance curve
Expansion Ratio
Explosion
Explosion risk External explosion
Extreme (residual) events
F Factor
198
Fail-Safe Valve An actuated valve which automatically assumes a safe position (open or closed depending on the needs of the system) in the event of loss of power to the actuator. A process of combustion characterized by heat or smoke or flame or a combination of these. This phenomenon, which may occur as the result of a deflagration of a vapour cloud that does not result in a blast wave. Alternatively, a fire, burning sufficiently rapidly for the burning mass to rise into the air as a cloud or ball. A temperature/time curve devised for a fire tests that is intended to represent (but not necessarily reproduce) the temperature development of a real fire, either cellulosic or hydrocarbon. The length of time that an element can resist fire either up to the point of collapse or alternatively to the point when the deflection reaches a limiting value. The temperature at which a liquid fuel flashes and then marginally sustains a flame. Measures taken to prevent the outbreak of fire at a given location. Measures taken to minimize effects of damage from fire should it occur. An integrated detection, signalling and automated fire control system. A test designed to quantify the resistance to fire of elements of construction and/or materials applied thereto. Conventionally, such tests are carried out in purpose-built furnaces operating to a defined temperature/time curve. A designated partition, which by nature of its construction and certification status, is warranted to resist a standard or hydrocarbon fire test for a particular time period. The term can apply to a floor or roof panel. A submersible electric or diesel pump, mounted in or capable of being lowered into a fire water pump caisson, which feeds into the firewater ring main. The range of fuel-air ratios which can support non-detonative combustion such as laminar and turbulent flames.
Fire
Fire Ball
Fire Curve
Fire Endurance
Fire Point
Fire Prevention
Fire Protection
Fire Protection System
Fire Test
Fire Wall
Fire Water Pump
Flammability Limits
199
Flash Fire The combustion of a flammable vapour and air mixture in which the flame passes through the mixture at less than sonic velocity, such that negligible damaging overpressure is generated. The combustion of a flammable vapour and air mixture in which flame passes through that mixture and negligible damaging overpressure is generated. The flash point of a liquid is the temperature at which the vapour and air mixture lying just above its vaporizing surface is capable of just supporting a momentary flashing propagation of a flame prompted by a quick sweep of a small gas pilot flame near the surface. The rapid evaporation of a volatile liquid when suddenly released from pressurized storage. Ventilation by mechanical means, e.g. a fan. The number of occurrences anticipated during a unit of time. A fire in which the rate of fuel consumption is controlled by the rate of supply of fuel to the fire, rather than the availability of oxygen for combustion. The capacity of a system to perform the function required of it during and after a major accidental event. The burning velocity of a laminar (non-turbulent) flame under stated conditions of composition, temperature and pressure of the unburnt gas. Gas explosions can be defined as the combustion of a premixed gas cloud containing fuel and an oxidiser that can result in a rapid rise in pressure Points defined in a CFD analysis where information on overpressure/dynamic pressure time histories are derived. A physical situation with a potential for human injury, damage to property, damage to the environment or some combination of these. The potential to cause harm, including ill health or injury; damage to property, plant, products or the environment; production losses or increased liabilities. A physical situation with a potential for human injury, damage to plant/equipment, damage to the environment or some combination of these.
Flash Fire
Flash Point
Flashing
Forced Ventilation Frequency Fuel Controlled Fire
Functionality
Fundamental Burning Velocity
Gas explosion
Gauge points
Hazard
Hazard
Hazard
200
Hazard Analysis The identification of undesired events that lead to the realisation of a hazard, the analysis of the mechanisms by which these undesired events could occur and usually the estimation of the extent, magnitude and likelihood of any harmful effects. A substance which by virtue of its chemical properties constitutes a hazard. A description of the means of achieving health, safety and environmental objectives.
Hazardous Substance
Health, safety and environmental (HSE) management plan Health, safety and environmental (HSE) management review
The formal review by senior management of the status and adequacy of the health, safety and environmental management system and its implementation, in relation to health, safety and environmental issues, policy, regulations and new objectives resulting from changing circumstances. A public statement of the intentions and principles of action of the company regarding its health, safety and environmental effects, giving rise to its strategic and detailed objectives. The broad goals, arising from the HSE policy, that a company sets itself to achieve, and which should be quantified wherever practicable. The company structure, responsibilities, practices, procedures, processes and management system (HSEMS) resources for implementing health, safety and environmental management. The rate of heat transfer per unit area normal to the direction of heat flow. A convenient unit is kW/ /m2/s (1 kW m-2 /s = 317 Btu ft-2 h-1). It is a total of heat transmitted by radiation, conduction and convection. The rate, measured in degrees C per minute, that a sample is heated. See element specific performance standard.
Health, safety and environmental (HSE) policy
Health, safety and environmental (HSE) strategic objectives Health, safety and environmental management system (HSMES) Heat Flux (heat density)
Heating Rate
High level performance standard High (Higher) risk methodology Homogeneous
Methodology of assessment appropriate for High risk installations or compartments as defined in this Guidance. In two-phase flow the vapour and liquid phases are assumed to be travelling at the same speeds and to be mixed uniformly throughout. A hydrocarbon is a molecule comprised of carbon and hydrocarbon atoms.
Hydrocarbon
201
Hydrocarbon Fire A fire fuelled by hydrocarbon compounds, having a high flame temperature achieved almost instantaneously after ignition. A hydrocarbon fire will spread rapidly, burn fiercely and produce a high heat flux. A furnace fire test using a time/ temperature curve which supposedly represents a hydrocarbon fire and which results in an H rating for successful specimens. The integral of a force or load over an interval of time. An event or chain of events which has caused or could have caused injury, illness and/or damage (loss) to assets, the environment or third parties. Note: The word 'accident' is used by some writers and organisations to denote an incident which has caused injury; illness and/or damage, but the term also has connotations of 'bad luck' in common speech, and is therefore avoided by others. In this guidance, only the term 'incident' has been used-in the above sense which embraces the concept of 'accident'. Incident Wave The blast wave as it approaches a structure just before it impacts on its surface. The frequency at which an individual may be expected to sustain a given level of harm from the realization of specified hazards. The frequency at which an individual may be expected to sustain a given level of harm from the realization of specified hazards. Substance which reduces explosion overpressures by chemically interfering with combustion. The events which initiates an explosion event. An epoxy coating, sealing compound or paint that swells up under thermal loading to produce a fire resisting covering. The quantity and type of fuel stored. A platform inventory lists the fuel types and total volumes stored on board an installation. The term inventory is also used to describe the quantity and type of fuel stored in vessels and pipe assemblies. The combustion of material emerging with significant momentum from an orifice. The length of a jet flow over which the effects of its initial momentum are dominant.
Hydrocarbon Fire Test
Impulse Incident
Individual Risk
Individual Risk (IR)
Inhibitor
Initiating events Intumescent
Inventory
Jet Fire or Jet Flame
Jetting Length
202
Laminar Flame Large Deflection Analysis A smooth surfaced flame with low burning velocity. A type of non-linear structural analysis based on the final deflected shape of the structure rather than the initial, undisplaced shape. Risk to life. High pressure release of a liquid hydrocarbon which gives rise to a suspension of the fuel in the air similar to a gas cloud which is capable of deflagration on ignition. The general term used to describe a range of activities carried out to minimize any form of accidental loss, such as damage to people, property or the environment or purely financial loss due to plant outage. A systematic approach to preventing accidents or minimizing their effects. The activities may be associated with financial loss or safety/environmental issues. The lower level of gas concentration which will result in combustion of the gas. This is the same as Lower explosive limit (LEL). See element specific performance standard.
Life Safety Risk Liquid spray release
Loss Prevention
Loss Prevention
Lower flammability limit (LFL)
Low level performance standard Low risk installation/compartment Major Hazard
An installation or compartment identified as being low risk by the risk matrix and screening method described in this Guidance. An imprecise term for a large-scale chemical hazard, especially one that may be released through an acute event. Or, a popular term for an installation that has on its premises a more than a prescribed quantity of a dangerous substance. The mass burning rate of a pool fire is the mass of fuel supplied to the flame per unit time, per unit area of the pool. Units are typically kg/m2/sec. Verbal form used to indicate a course of action permissible within the limits of a standard Means of checking or benchmarking the performance of a decision option with respect to a given decision basis. For example what is thought to be 'good practice' or sound engineering judgment can be checked by peer review and benchmarking of practices in other parts of the industry. Similarly, stakeholder consultation can be used to assess the values of the company or society at large.
Mass Burning Rate
may
Means of Calibration
203
Medium risk installation/compartment Mitigation An installation or compartment identified as being low risk by the risk matrix and screening method described in this Guidance. Means taken to minimise the consequences of a major accident to personnel and the installation after the accident has occurred. All inspection, test and monitoring work related to health, safety and environmental management. The time required for a freely vibrating structure to complete one cycle of motion. The ventilation of an enclosure by natural means, either through the action of an external wind or gravitational forces. The frequency of occurrence of a release which is ignited and results in detectable overpressure (>50 mb). This is used as the top point in the simplified generation of an exceedance curve Prexp Representative nominal overpressures and nominal dynamic pressures on equipment. ranges, outliers and sensitivity measures. Nominal overpressures are defined as peak representative overpressures by installation/module type determined on a nonstatistical basis from acquired experience or simulation for a demonstrably similar situation. Value assigned to a basic variable determined on a nonstatistical basis, typically from acquired experience or physical conditions. A type of structural analysis that allows the geometry and/or the material properties to be non-linear. The excess pressure above ambient conditions. In a pressure pulse (blast wave), the pressure developed above . atmospheric pressure at any stage or location is called the overpressure. Overpressure is also sometimes used to describe exposure of equipment to internal pressure in excess of its design pressure, but the term overpressurisation is preferred. Loading imparted to a body as a result of overpressure acting normal to the surface of the structure.
Monitoring activities
Natural Period
Natural Ventilation
Nominal explosion frequency
Nominal explosion loads
Nominal overpressures
Nominal Value
Non-Linear Analysis
Overpressure Overpressure
Overpressure Loading
204
Passive Fire Protection (PFP) A coating, cladding or free-standing system that provides thermal protection in the event of fire and which requires no manual, mechanical or other means of initiation, replenishment or sustainment. Mitigation technique that is non-triggered and generally uses the kinetic energy of an explosion to disperse an extinguishing agent or suppressant. The maximum overpressure generated at a given location. Purpose-made seals, or seals formed in situ to ensure that penetrations to firewalls do not impair fire resistance. Performance criteria describe the measurable standards set by company management to which an activity or system element is to perform. (Some companies may refer to performance criteria as 'goals' or 'targets'.) Performance standard A statement which can be expressed in qualitative or quantitative terms of the performance required of a system, item of equipment, person or procedure and which is used as the basis for managing the hazard. Requirements to the performance of safety and emergency preparedness measures which ensure that safety - objectives, RAG, authority minimum requirements and established norms are satisfied during design and operation NOTE - The term perfomance' is to be interpreted in a wide sense and Include availability, reliability, capacity, mobilisation time, functionality, vulnerability, personnel competence, expressed as far as possible in a verifiable manner. Phenomenological models Simplified physical models, which seek to represent only the essential physics of explosions. That deformation which occurs following yield. A plastic hinge is a zone of yielding due to flexure in a structural member. That region of structural behaviour dominated by plastic response rather than elastic response. It is associated with plastic strain and large plastic deformations. Strain beyond the elastic limit.
Passive Mitigation
Peak Overpressure Penetration Seal
Performance criteria
Performance standards for safety and emergency preparedness
Plastic Deformation Plastic Hinge
Plastic Regime
Plastic Strain
205
Pool Fire The combustion of material evaporating from a layer of liquid at the base of the fire. The (fractional) no of individuals predicted to become fatalities over a specified period of time usually one year. Accepted methods or means of accomplishing stated tasks. The analysis has to be traceable and will normally - though not necessarily - be quantitative. The rupture of a system under internal pressure, resulting in the formation of missiles which may have the potential to cause damage, and perhaps a blast wave. The pressure difference across an obstacle greater than 0.3m in the direction of flow, calculated from the pressure time histories at the front and back of the obstacle. - Pdiff Means intended to prevent the initiation of a sequence of events which could lead to a hazardous outcome of significance (i.e. major accident). Such means include management systems applied to the design, engineering and construction standards, the operation of the installation, its inspection and maintenance. The means of escape which was assumed during design. The structural components, whose failure would seriously endanger the safety of a significant part of the installation. A number in a scale from 0 to 1 which expresses the likelihood that one event will succeed another. A documented series of steps to be carried out in a logical order for a defined operation or in a given situation. Established and documented step by step activity which allows a specific task to be completed. The stress at which the plastic strain of a material reaches a particular value, for example 0.2 %. Proof stress, is a valuable concept in materials which do not exhibit a sharp yield point. Quantitative Risk Assessment: the quantitative evaluation of the likelihood of undesired events and the likelihood of harm or damage being caused, together with the value judgements made concerning the significance of the results. All systematic actions that are necessary to ensure that quality is planned, obtained and maintained.
Potential loss of life (PLL)
Practice Preparedness analyses
Pressure Burst
Pressure difference
Prevention
Primary means of escape Primary Structure
Probability
Procedure
Procedure
Proof Stress
QRA
Quality Assurance
206
Quality Control That part of the Quality Assurance which, through measurements, tests or inspections, ascertain whether a product, service or activity is in accordance with specified requirements. A product, service or activity's ability to fulfill specified requirements. Thermal radiation involves the transfer of heat by electromagnetic waves confined to a relatively narrow region of the electromagnetic spectrum. The performance of the same function by a number of equivalent means, which are usually independent and may be identical. The type and quantity of fuel which can possibly be ignited. The probability that an item is able to perform a required function under stated conditions for a stated period of time. The probability that an item is able to perform a required function under stated conditions for a stated period of time or for a stated demand. Time averaged over 1.5ms and space averaged over explosion affected area. Prep The estimated time for people to travel from their work stations to the TR, then to the primary or secondary means of escape, allowing for the possibility of helping injured colleagues. Initiating events which cannot be eliminated by design or operating procedures. The time taken for the overpressure to increase from zero to the peak overpressure. The product of the chance that a specified undesired event will occur and the severity of the consequences of the event. The likelihood of a specified undesired event occurring within a specified period or in specified circumstances. It may be either a frequency (the number of specified events occurring in unit time) or a probability (the probability of a specified event following a prior event), depending on the circumstances. Combination of the probability of occurrence of harm and the severity of that harm
Quality
Radiation
Redundancy
Release Reliability
Reliability
Representative peak overpressure Required endurance time
Residual events
Rise Time
Risk
Risk
Risk
207
NOTE - Risk may be expressed qualitatively as well as quantitatively. Probability may be expressed as a probability value (0-1, dimensionless) or as a frequency, with the inverse of time as dimension. The definition implies that risk aversion (i.e. an evaluation of risk which places more importance on certain accidental consequences than on others, where risk acceptance is concerned) should not be included in the quantitative expression of risk. It may be relevant to consider on a qualitative basis certain aspects of risk aversion in relation to assessment of risk and its tolerability. The implication of the definition is further that perceived risk (i.e. subjectively evaluated risk performed by individuals) should not be included in the expression of risk. Risk acceptance criteria (RAC) Criteria that are used to express a risk level that is considered tolerable for the activity in question NOTE - RAC are used in relation to risk analysis and express the level of risk which will be tolerable for the 9 activity, and is the starting point for further risk reduction according to the ALARP-principle. Risk acceptance criteria may be qualitative or quantitative. Risk Analysis The quantified calculation of probabilities and risks without making any judgements about their relevance. Use of available information to identify hazards and to estimate the risk NOTE 1 - The risk analysis term covers several types of analyses that will all assess causes for and consequences of AEs, with respect to risk to personnel, environment and assets. Examples of the simpler analyses are SJA, FMEA, preliminary hazard analysis, HAZOP, etc. NOTE 2 - Quantitative analysis may be the most relevant in many cases, involving a quantification of the probability and the consequences of AEs, in a manner which allows comparison with quantitative RAC. Risk Assessment The quantitative evaluation of the likelihood of undesired events and the likelihood of harm or damage being caused together with the value judgments made concerning the significance of the results. Overall process of risk analysis and risk evaluation The evaluation of the likelihood of undesired events and the likelihood of harm or damage being caused, together with the value judgements made concerning the significance of the results and their tolerability, including issues of risk perception where appropriate.
Risk analysis
Risk assessment Risk Evaluation
208
Risk Issues Issues that impact on the nature and perception of safety related risks and the role of risk based analysis techniques Insensitivity of response to variations of load. Any structure, plant, equipment, system (including computer software) or component part whose failure could cause or contribute substantially to a major accident is safety-critical, as is any which is intended to prevent or limit the effect of a major accident. Objective for the safety of personnel, environment and assets towards which the management of the activity will be aimed All documented policies, standards and practices which the Operator shall initiate to ensure the activity is planned, organized, executed and maintained to achieve safety and protect the environment in accordance with the acts or regulations As for SCE, those elements of the installation which are critical to safety. The values or standards against which the significance of the identified hazard or effect can be judged. They should be based on sound scientific and technical information and may be developed by the company and industry bodies, or provided by the regulators. Means of escape which should be available if the primary means of escape is not available. The ratio of heated perimeter (Hp) to cross-sectional area (A). A design limit beyond which the structure may become unserviceable, for example, a specified maximum deflection. Verbal form used to indicate requirements strictly to be followed in order to conform to the standard and from which no deviation is permitted, unless accepted by all involved parties The load imparted to a structure by a passing shock wave. A pressure pulse formed by an explosion in which a sharp discontinuity in pressure travels as a wave through a gas at a supersonic velocity.
Robustness Safety critical element (SCE)
Safety objective
Safety Plan
Safety-critical elements (SCEs) Screening criteria
Secondary means of escape
Section Factor Serviceability Limit
Shall
Shock Load Shock Wave
209
Should Verbal form used to indicate that among several possibilities one is recommended as particularly suitable, J without mentioning or excluding others, or that a certain course of action is preferred but not necessarily required An overpressure > 50m bar. This is the pressure at which pressure relief panels should operate. A flow consisting of either a liquid or gas. The frictional force caused by the passing fluid flow which acts tangentially to the surface of the body. The relationship between frequency and the number of people suffering from a specified level of ham1 in a given population from the realization of specified hazards. Overpressure trace which has been smoothed by using a moving average over a period of 1.5 milliseconds (1 millisecond or ms equals one thousandth of a second) A peak overpressure for a compartment/area or installation which is the average of all measured or simulated peak overpressures within a compartment. It is assumed in the case for measured overpressures that they have been smoothed. The amount of heat, measured in Joules, required to raise one kilogram of a substance by one degree C. Units are Joules/kg/C. The excess pressure above that in the approach flow which occurs on the front face of a surface where the gas velocity is brought to rest. A furnace fire test using a time temperature curve which simulates a standard fire and which results in an A or H rating for successful specimens. Conditions which do not change with time. Air/fuel mixture is such that it contains exactly the required amount of oxygen to completely consume the fuel. The tendency of an elastic-plastic material to exhibit increased resistance to high strains. An explosion response assessment where the SCEs including structure and supports are required to remain elastic. An elastic method is used for structural response with code/utilization checks as the performance standard.
Significant Overpressure
Single-Phase Flow Skin Friction
Societal Risk
Smoothed overpressure
Space averaged overpressure
Specific Heat
Stagnation Overpressure
Standard Fire Test
Steady State Stoichiometric mix
Strain Hardening (work hardening) Strength level analysis
210
Strength level blast (SLB) Representative peak overpressure used to test robustness of equipment and structure. Elastic structural analysis is appropriate. Substance which reduces explosion overpressures by either removing heat from the flame, chemically interfering with combustion or diluting the flammable mixture. The ability of a system to function in the conditions of an accidental event for the time required. Planned and systematic examination of systems to ensure that these have been established, followed and maintained as specified. A calculation in which the results are temperature distributions for a given heat input. The heating may be described in terms of either temperatures or radiation levels. The ability of a material to store heat. Heat transfer through a medium via random molecular motion. Peak overpressure below which explosion assessment need not be performed. A solution technique for structural dynamics in which results are obtained at regular time intervals when a time variable force or other load is applied. Rapid irregular local fluctuations in physical variables, such as velocity or concentration, that arise due to the presence of eddies within the flow. The burning velocity of the flame when turbulence is present in the flammable mixture. A flame burning in a turbulent flammable mixture. A flow in which both the liquid and vapour phases co-exist within close proximity. Peak representative overpressure resulting from a CFD simulation where it is assumed that the area is engulfed in a stoichiometric gas cloud and ignited at the worst position and time. Pult. Defined as for VCE and is an imprecise term (see below).
Suppressant
Survivability
System audit
Thermal Analysis
Thermal Capacity Thermal Conduction Threshold overpressure
Time Domain
Turbulence
Turbulent Burning Velocity
Turbulent Flame Two-Phase Flow
Ultimate overpressure
Unconfined Vapour Cloud Explosion
211
Unity Checks A summation of non-dimensional terms in an equation in structural design, each of which relate to a component of loading or structural response. A summation greater than unity indicates failure of the member. The fuel concentration above which combustion will not occur.
Upper flammability limit (UFL) Vapour Cloud Explosion (VCE)
The preferred term for an explosion of a cloud made up of a mixture of a flammable vapour or gas with air in open or semiconfined conditions. An opening through which gas escapes from a confining enclosure as a result of the expansion caused by combustion. The process by which an enclosure is supplied with fresh air. Ventilation rates are often given for an enclosure in units of air volume changes per hour. A fire in which the combustion rate is controlled by the availability of oxygen rather than the supply of fuel. The escape of gas through openings (vents) in the confining enclosure. Examination to confirm that an activity, product or service is in accordance with specified requirements. The proportion of the field of view of a receiving surface that is filled by a flame. The ratio of the volume occupied by the obstacles to the total volume. The overall rate of increase in volume caused by the combustion process. The region on the downstream side of the structure. A network of small bore pipe work nozzles connected to the firewater main which is capable of delivering the design water spray to the protected area. A series of wide angle and/or mist spray nozzles connected to the firewater main that protect a specific area in the module from the passage of heat, smoke and billowing flames. The area of the topsides structure which accommodates the wellheads.
Vent
Ventilation
Ventilation Controlled Fire
Venting
Verification:
View Factor
Volume blockage ratio
Volume Production
Wake Region Water Deluge System
Water Screen
Wellbay
212
Worst case (explosion) scenario CFD or phenomenological simulation where it is assumed that the explosion area or compartment is filled with a stoichiometric gas cloud ignited at the worst position and time. The stress at which a steel sample departs from linear elastic behaviour to plastic deformation in a standard tensile test. The apparent yield stress exhibited by metals such as steel when they are strained at a rate which is significantly faster than the normal testing rate. For materials which exhibit no clear yield point such as mild steels at elevated temperatures, the stress corresponding to a particular plastic strain, often 0.2 % (see also Proof Stress).
Yield Point
Yield, Dynamic
Yield, Effective
213
214
APPENDIX C - CHECKLISTS
This appendix contains the checklists published in Reference [22] Explosion assessment guidelines, for the HSE June 2001. A summary of the assessment checklist contents is given in the Figure below.
Key techniques Low complexity method Medium complexity method Emission modelling to estimate likelihood of mixture build-up within enclosure using CSTR-style calculations, ESD / Blowdown Effect of wind on mixture build up Special situations external explosions etc. Represent equipment, vessels and pipework down to a level appropriate for phenomenological modelling tool. Define explosion exceedence using ignition point array or other empirical method e.g. historical data. Model should be able to assess mitigation Assess basecase overpressure for iteration, based on estimate of practicable limit of protection. Consider uncertainty affects Iterate by assessing effect of layout & structural risk reduction measures High Complexity method
A. Scenario identification
Simple Identification appropriate for installation
Use CFD to analyse emission dispersion, influence of wind, local concentrations and ingress from neighbouring volumes to arrive at scenario definition.
B. Blast analysis
Simple estimate of venting and congestion is required to judge whether explosion can occur. Discourage use of venting model Use of historical comparison
Use CAD to represent module internals. Model all local turbulence and flame propagation effects using mesh model Define a distribution of leak sources, release hole sizes, wind directions to generate an overpressure exceedence curve.
C. Blast impulse selection
Assess / estimate worst case blast impulse
Assess basecase overpressure for iteration, based on an analysis and review of practicable design limits of structure Iterate by assessing all local and global explosion effects and potential risk reduction strategies Has a detailed escalation analysis been carried out that considers the effect of blastinduced SCE failure (structure + designated systems) on the emergency response functions Consider external explosions, blastfunnelling, far-field overpressures Use model to assess the effect of changes in layout and venting areas. Show that local BOPs and drag forces are not excessive. Consider external explosions and bang-box ignitions. Non-linear structural analysis to demonstrate residual strength of structure. Is the structural response coupled to the blast analysis. Piping stress analysis using selected BOP pulse to demonstrate process integrity..
D. Assessment of explosion consequences
Direct impact of Personnel Direct impact on SCEs
Has assessment of escalation potential been made? Is fatality estimation method realistic for the module type?
E. Layout optimization
Best practice e.g. EN ISO13702 etc..
Use model to assess the effect of equipment location changes. Assess the effect of changing wall location, removal of blockages and congestion reduction.
F. Structural and Equipment Optimization
Use dynamic analysis to assess Use simple quasi-static load vibration magnitudes. analysis with worst-case blast Assess overall drag forces on SCEs. impulse estimate to demonstrate Check for local plastic deformation & structural integrity. assess against redundancy.
G. ALARP assessment
Demonstrate best practice in layout, equipment selection and so on.
Use semi-quantitative arguments to demonstrate ALARP for structural & equipment protection. Use of case-by-case CBA to assess the worth of upgrading blast protection.
Use robust QRA to fully justify that no further measures can be taken to reduce explosion risks further, supported by CBA.
Figure C1 - Summary of assessment checklist contents High sophistication methods may be used where more sophisticated methods of assessment which may result in reductions in conservatism and hence cost are considered more appropriate.
215
216
Low risk methodology

The low risk methodology may be applied to low risk installations and medium risk installations where valid nominal overpressures less than 1 Bar are available.
Typical Application Heading Scenario Identification Limited access wellhead platforms Platforms with few SCEs, or where the SCEs vulnerability to blast is low Platforms with little or no congestion or confinement Checklist Guidance Is the scenario The Safety Case should include an account of how scenarios credible? were identified, either by formal HAZID or by judgement. The Safety Case must consider if the possibility of a flammable accumulation exists. For a simple installation, there may be no, or few credible scenarios for the following reasons:
Little or no confinement e.g. if there is no weather deck, or no process vessels or other venting obstructions; Little or no congestion e.g. pipework, cable trays and so on; There is insufficient inventory to form a cloud of sufficient size to result in damaging overpressures (it is probably impossible to dismiss an explosion scenario on this basis, given that leaks are generally at high pressure, and that anything up to a full bore pipe / valve / flange rupture is possible); It may be physically not credible for a flammable mixture to develop in an area, because the route taken by the flammable gas is so extraordinary; There are no ignition sources present (again, it is probably impossible to dismiss an explosion scenario wherever there is the potential for the human factor to result in a release, as the persons present represent an ignition source).
Blast Analysis
Is simple assessment of congestion and confinement sufficient? Is use of simple vent model sufficient? Is use of historical comparison sufficient?
There must be evidence of a structured approach to congestion and confinement, in order to show that an explosion scenario is credible. This need not be particularly complex, the Shell CAM method appears to cover these issues well, and can be applied to local areas of congestion and confinement. Venting guidelines have been used in the past for wellhead platforms, sometimes when their applicability has been questionable (in fact, for anything other than an empty box). Continued use of these models for either Design or Operational Safety Cases is not desirable. If the installation closely resembles other designs, then there seems to be little point in conducting an analysis if one has been done elsewhere for a similar installation. Some sort of comparative assessment is necessary in the Safety Case, that has considered whether the installation in question is significantly more congested or confined compared to historical precedent. Consideration may be given to databasing analysis results for installations, so that industry experience is shared.
217
Typical Application Heading Blast Impulse Selection Limited access wellhead platforms Platforms with few SCEs, or where the SCEs vulnerability to blast is low Platforms with little or no congestion or confinement Checklist Guidance Identification of It is intended that a low sophistication approach should be used Worst-case blast wherever personnel exposure is low, but nonetheless there are impulse or lower SCEs protect against. The aim should be to show that there is value for structure sufficient inherent strength in the structure and equipment to and equipment withstand worst-case conditions. Where there is explosion analysis potential, it appears that most open wellhead platforms and NUIs can only experience overpressures up to approximately 1 bar in any case. It is suggested that this should be used as a basecase for new-build designs where the provision of protection is concerned. For existing installations, this approach is more problematic given that it is more difficult to retrofit blast wall detailing and supports to withstand high overpressures, and so the optimal level of protection could be less. This would point toward the need for a medium sophistication analysis. Impact on Typically, simple QRA methodologies assume that POB in the personnel fire area containing an explosion will perish immediately. Impact on SCEs Unless the SCE is rated for the worst-case overpressure, then the analysis should conclude functional impairment results, either as a result of exposure to the pressure impulse, indirect vibration, or drag forces. These are discussed below. Adoption of best For a wellhead platform or NUI, there are typically few options practice in venting available for layout. The Case should show how layout best and congestion practice has been used to reduce overpressures e.g. by reducing management congestion, keeping vent paths open, locating SCEs distant from the explosion source, and so on. No SCEs exposed As above, the Case should seek to show that SCEs have to blast effects sufficient residual strength to withstand worst-case blast effects, or that they are located out of the vent path of the explosion. Sufficient input In order to check whether the structure and pipework is information from vulnerable to blast, some information is necessary. Typically, blast analysis these are as follows:
Overpressure pulse magnitude Pulse duration Associated drag force
Assessment of explosion consequences
Layout optimisation
Structural and Equipment Optimisation
Simple quasistatic load analysis
ALARP Assessment
Best practice in layout, equipment selection, venting and congestion management
In order to take credit for SCE survival to blast, in the associated PS it is necessary to identify the principal explosion parameters. Note that this could be done on the basis of previous analyses based on similar installations. A simple quasi-static load analysis, based on the maximum pulse magnitude, will demonstrate the integrity of the structure. It is simultaneously necessary to consider of the period of the pulse in comparison with the natural period of the structure and pipework, to show that there is no possibility of damaging resonance effects. It is envisaged that it would in fact be difficult to justify any risk reducing measures at all on cost-benefit grounds for small installations that are only periodically visited. Best practice is exhibited by demonstration e.g. that pipe routings consider blast impact / drag loadings, that grating has been used to ease overpressures where possible, that vent paths are clear, and so on.
218
Medium risk methodology

The medium risk methodology may be applied to medium risk installations. Medium risk methods are described in below which substitute for some of the tasks defined in the high risk methodology. The philosophy recommended in this Guidance is that for medium risk installations the choice of methodology for any particular task must be justified where it deviates from the high risk methodology.
Typical Application NUIs with confinement or congestion e.g. due to high equipment density, NUIs with relatively high manning e.g. > four visits per year Manned platforms with separation process, gas treatment, but with considerable segregation between TR and hydrocarbon hazard e.g. bridge-linked. Checklist Guidance Have scenarios For the low sophistication case, the scenario identification is been considered primarily concerned with the geometry of the area where an and excluded? On explosion could potentially take place. However, a medium what basis? complexity analysis will probably entail a probabilistic analysis of the likelihood of an explosion occurring. This must in turn entail a treatment of the likelihood of a flammable mixture being present in an enclosure, which should consider all the influencing factors. It is likely that some scenarios will be omitted from the analysis, and so the inspector must be satisfied that the grounds for omission are firm. Does the scenario Possibly there is insufficient inventory in the leaking system to account for build-up an explosive mixture throughout the domain being available considered. This could be the case for successful ESD / inventory? Blowdown. This scenario is therefore not credible. The analysis should consider "partial fill" situations. Does the scenario Some scenarios may be omitted from the analysis on the basis account for that the ambient wind conditions prevent the formation of an external effects explosive mixture. The analysis must consider the full range of such as wind wind speeds and directions, and account for uncertainty in order speed and to omit scenarios on this basis. direction? Are confined Does the HAZID address the possibility of explosions in vents explosion and drains e.g. due to the back flow of air into a vent drum and scenarios the subsequent formation of a flammable mixture. These should identified? be addressed in the design of vent drums, vent pipes and headers, pipe supports, FPSO cargo tanks and so on. How are Usually, the Fire and Explosion Risk Analysis will consider the unconfined potential for gas build-up and ignition. Typically ignitions are explosions characterised as immediate or delayed. Immediate ignitions arise addressed? from "near-field" ignition sources, probably associated with the cause of the initial leak e.g. hot-work. Delayed ignitions are caused by "far-field" ignition sources e.g. static or intermittent sources such as faulty electrical equipment. These are in turn variously described as explosions and flashfires, or "strong" and "weak" explosions. A flashfire or weak explosion is usually not considered in terms of overpressure damage, only as a cause of fatality for persons directly exposed to the event. Criteria for assessing a delayed ignition as either a flashfire or a strong explosion should be identified at the outset, if a blast scenario is dismissed as not credible. Are severe It is well known that enriched gases and mists result in changes explosions to known flammability limits and blast overpressures, compared identified? to single-component explosions. The inspector must ensure that the scenario identification accounts for this possibility and that this is incorporated into the uncertainty analysis as appropriate.
Heading Scenario Identification
219
Typical Application NUIs with confinement or congestion e.g. due to high equipment density, NUIs with relatively high manning e.g. > four visits per year Manned platforms with separation process, gas treatment, but with considerable segregation between TR and hydrocarbon hazard e.g. bridge-linked. Checklist Guidance General For a small, simple installation it is probably sufficient to identify worst-case overpressure scenarios and determine if the structure and facilities are able to withstand it. Small open structures should not experience severe overpressures and so it is simple and practicable to protect against worst-case or near-worst-case scenarios. Larger geometries will inevitably lead to rather more severe explosions given the increase in inventory size or an increase in the amount of equipment representing both congestion and vent blockage. For larger, more complex geometries it is likely that worst-case overpressures will be much more severe than the structure and equipment can cope with. For a given geometry, the worst-case scenario will depend on ignition source strength and location, and also on the local gas concentration. Assessment of The analysis should use a variety of ignition point locations to ignition point array show that worst-case conditions have been determined. These - random? could either be through expert judgement e.g. selection of the most confined or congested areas, or by random selection. It is likely that the use of an ignition point array is used to derive a probabilistic exceedence curve (see below). It is difficult to say how many ignition locations and overpressure calculations have to be carried out to determine an adequate curve, however the case should be convincing that a sufficient number has been carried out. Is there any effect The analysis must account for the possibility that a severe of flashing liquid / explosion can result from a mist or concentration of enriched condensate on gas. blast overpressures? Have drag forces The analysis should be capable of being used to calculate drag been quantified? forces, in order to demonstrate the survivability of vulnerable SCEs such as hydrocarbon pipework, vent pipework, cable trays and so on. Has the effect of For new-build designs, the initial analysis may only consider the design "growth" on geometry down to crude limits. Calculated overpressures are the analysis been likely to be exacerbated as more detail is introduced to the accounted for? analysis e.g. small diameter pipework, cable trays etc., however once the design overpressure is selected it is difficult to iterate the design - the blastwall has already been specified and ordered. The analysis should attempt to show the degree of increase in blast overpressure brought about by design growth or alternatively should calculate the overpressure at the end of the design to demonstrate that there has been no more than a small effect. Other factors The calculation of blast overpressure should consider the effect affecting Blast of temporary blockages such as wind-walling / tarpaulins / overpressure scaffolding or a workover MODU placed against the platform, if MODU or windthis interacts with the module being analysed e.g. the wellbay. walling Can the analysis Generally, blast models are most useful in assessing the effect of successfully model layout changes such as equipment location and venting. For any mitigating effects? level of sophisticated analysis, the model should be able to demonstrate the worth of mitigation measures e.g. deluge to mitigate explosions.
Heading Blast Analysis
220
Typical Application NUIs with confinement or congestion e.g. due to high equipment density, NUIs with relatively high manning e.g. > four visits per year Manned platforms with separation process, gas treatment, but with considerable segregation between TR and hydrocarbon hazard e.g. bridge-linked. Checklist Guidance What is the As above - it is likely that for larger more congested modules it is methodology for not practicable to stiffen structure and supports to withstand selection of lower- calculated worst-case scenarios. Thus, a methodology is needed than-worst-case to arrive at a design value that is lower than the worst-case. This blast loadings for is likely to be probabilistically based, and result in the production design? of an "exceedence curve", that shows the probability that an explosion will be greater than a given overpressure. Therefore, if an estimate of explosion frequency is available, this is combined with the exceedence curve probability to arrive at physical impairment frequencies. This approach readily lends itself to cost-benefit analysis in support of ALARP. If an exceedence curve technique is adopted, the methodology needs to be reviewed carefully. If it is constructed from the results of explosion analysis, the inspector must ensure that a sufficient number of calculations has been carried out to reduce uncertainty to a tolerable level. Work has been done to compile data relating to estimates of blast magnitude and frequency for North Sea installations of varying sizes. If statistics are used to compile or compare exceedence probabilities, then the inspector must ensure that they are applicable to the installation type under scrutiny. How has Analytical uncertainty arises as a result of inevitable modelling uncertainty been imperfections compared with actual events. Uncertainty in addressed? overpressure estimation could arise due to uncertainties regarding scenario definition, model limitations or uncertainties regarding the value of the input variables.
Scenario definition. In fact, it is impossible to know the ignition location for a gas cloud with any degree of certainty, and the concentration at the ignition location. The literature describing most models generally claims that they are just as likely to underpredict as overpredict the overpressure for a given blast scenario. Uncertainty is therefore typically reduced by carrying out many calculations for an array of ignition points and gas concentrations, and producing an exceedence curve. Model limitations. Uncertainty can arise if the model is unable to calculate overpressures at a single location e.g. riser ESDV, if within the model domain. Relatively crude phenomenological models are usually unable to meaningfully calculate anything other than a peak throughout the domain. The average overpressure may be close to the SCE survivability, producing a "cliff-edge" risk effect on the QRA results. The inspector must be satisfied that cliff-edges have been identified. Input variables. Puttock [84] explains that model uncertainties mainly affect calculated overpressure by their influence on the flammable cloud burning rate, and suggests that applying a log-normal distribution to the laminar burning velocity within the model. This is quite sophisticated and may not be possible within the confines of "black-box" models bought off-the-shelf. A crude method is to simply adopt a conservative approach and factor up the predictions according to expert judgement, alternatively it may be possible to show that that modelling uncertainties are not significant given the inherent strength of the SCE being considered.
Heading Blast Impulse Magnitude Selection
What are the practicable protection limits?
The inspector should establish that the safety case has explored the practicable limits for overpressure protection on the basis of the worst-case overpressure and any probabilistic analysis. Is it possible to design for the worst-case, even though this is a remote event? This goes a long way to removing uncertainty.
221
Typical Application NUIs with confinement or congestion e.g. due to high equipment density, NUIs with relatively high manning e.g. > four visits per year Manned platforms with separation process, gas treatment, but with considerable segregation between TR and hydrocarbon hazard e.g. bridge-linked. Checklist Guidance Has assessment It is probably valid to consider escalation effects resulting from of escalation been SCE failure, given that there could be a significant effect on risk attempted? levels. This must consider the failure modes and the likely escalation that results. Typically, in the event of failure of a blast wall, say, the QRA rule set may assume universal fatality amongst POB on the other side of the blast wall. This may be inappropriately conservative, given that "failure" of the wall is merely exceeding the buckling failure limits of the wall and supports rather than rapid and complete demolition. It is common to assume universal fatality in the area containing Is fatality estimation realistic the blast. If it is assumed that POB have no chance to escape before the blast, then the likelihood of immediate fatality may be for the module inappropriately high. As a result, the numbers of delayed type? fatalities e.g. due to escalation effects may be low, and so the benefit of risk reduction methods intended to mitigate and control escalation e.g. TR functions may be under-reported. Has published There is a lot of published guidance regarding the most guidance been advantageous layout for areas where there is an explosion used to lay out the hazard e.g. EN ISO13702 [34] and Bjerkervedt, van Bakke. The module inspector should be satisfied that the explosion analysis has equipment? considered the effect of following the guidance. Have the effect of Location of equipment can affect the degree of blockage. The equipment location inspector should be satisfied that e.g. the axis of vessels is along changes been the vent path. If the layouts are fixed, the inspector should look to addressed? see that some sensitivity work has been done, to check that the effect of relocating equipment is not significant. Have the effects of Leading on from the above, the inspector should be satisfied that changing wall the dutyholder is aware of the impact of the effect of layout locations, removal changes, and has included a process for assessing and of blockages and controlling the key factors affecting explosion risk in the design or congestion safety management process. reduction been assessed? For new-builds, For an open module, it is generally accepted that a "long & thin" layout should serve to reduce explosion likelihood and have the benefits magnitude. The layout encourages dispersion, whilst the vent changing module paths are short. On the other hand, high overpressures can shape been result if the available vent path is on the long axis of the module. assessed? The inspector should be satisfied that the advantages of this layout have been addressed within the design of the facility. Has quantification In order to assess the survivability of pipework, it is necessary to of structural analyse the deflection of primary structure arising from the deflections using design event. This must be realistically done, in order to be able dynamic analysis to show that deflection does not result in escalation to e.g. vent been carried out? header pipework. The Safety Case should include an analysis of local structural Have blast accelerations arising from severe explosions. Performance vibration / accelerations been standards should be set for SCEs to withstand blast-induced determined? accelerations where appropriate e.g. TEMPSC davits; UPS; panels.
Heading Assessment of explosion consequences
Layout optimisation
222
Typical Application NUIs with confinement or congestion e.g. due to high equipment density, NUIs with relatively high manning e.g. > four visits per year Manned platforms with separation process, gas treatment, but with considerable segregation between TR and hydrocarbon hazard e.g. bridge-linked. Checklist Guidance Do Survivability Following from the above, the inspector must ensure that SCE Performance Survivability criteria are based on the ability to withstand: Overpressure effects (direct loading); Standards Loading arising from flow effects i.e. drag forces; consider all blast Acceleration resulting from blast effect on primary structure effects? Note that SCEs located in non-hazardous or safe areas are vulnerable to blast-induced acceleration. Check for local Points to consider in the assessment are: Has the structural design accounted for heavy explosion loads giving plastic deformation rise to plastic deformation; and redundancy
Has sufficient redundancy been build into the structure; Has the effect of plastic deformation on SCEs been accounted for in the Safety Case?
Heading
ALARP Assessment
Is cost-benefit analysis used to assess risk reduction measures? Is it conservative?
For larger, more complex installations, it is envisaged that these require greater risk exposure on the part of operations POB to inspect and maintain the plant items. As exposure increases, so the use of cost-benefit analysis (CBA) becomes more meaningful. Care is needed to ensure that the analysis is conservative, and that the criteria used are valid. Conservatism in cost-benefit analysis relates to ensuring:
Costs associated with implementing remedial measures are not over-stated (some remedial measures can be implemented as part of an ongoing scope of work and so offshore mobilisation costs etc. are therefore not applicable); POB exposure is not underestimated; Gross disproportion is accounted for; Where benefits are marginal, other losses - production and so on are accounted for. These could point to a conclusive overall benefit.
The costs of risk reduction measures require careful "reality" checking, so that the benefit is accurately measured. Where the results of CBA are counter to historical experience, the dutyholder must show that the preferred way forward follows best practice.
223
High risk methodology

The High risk methodology may be used for medium and low risk installations where more sophisticated methods of assessment which may result in reductions in conservatism and hence cost, are considered more appropriate.
Typical Application Heading Scenario Identification PDUQ platforms, FPSOs, platforms where it is clear that the potential for escalation exists Checklist Guidance General All the points from the low and medium sophistication checklists apply here also. At this high level of sophistication, it is clear that the Dutyholder cannot always be expected to have specialist explosion expertise in-house to facilitate and advise. Nonetheless it is clear that such expertise is available in the market-place and so at this level there should evidence that the dutyholder has commissioned an appropriate level of consultancy support for scenario identification, blast analysis, response analysis and so on. Has ingress from For large, multi-module installations, the potential for gas neighbouring migration and gas build-up from remote areas must be modules been considered e.g. in the HAZID. For an FPSO, this could include accounted for? gas migration and accumulation over the tank top, if the process decks are all plated. Have local high For areas of high congestion around equipment, it may be emission appropriate to check for local high gas concentrations resulting concentrations from small leaks. CFD (design) or real-time tests (existing been identified? installations) can be used to see if there are occasions when natural ventilation is insufficient to disperse leaks and to check for mixture build-up. The inspector should be satisfied that the Safety Case accounts for the possibility of small concentrations giving rise to a local explosion hazard. Have external The hazard from external explosions is most severe for large explosions been integrated facilities, as it is likely that SCEs are located in identified? modules adjacent to the explosion location. The TR and EER facilities may be directly vulnerable to blast effects (see below). Is the philosophy All the points from the Medium Sophistication Checklist apply for blast analysis here also. It is envisaged that the explosion analysis for an clearly stated? integrated facility, FPSO etc. will be carried out using a CFDbased code, due to the inability of phenomenological models to tackle non-standard module configurations and the inability to calculate local overpressures with any degree of confidence. Use of CFD follows from the high explosion risk potential, complex layouts, increased computer power, and the expectation that blast protection can be optimised. Given the resources available to the operators of large integrated facilities, it is expected that they should respond to challenges present at the leading-edge of explosion and structural response research. Operators must be prepared to resource detailed studies and tests which seek to demonstrate the clear interaction between the calculation of blast overpressure coupled with structural response, and which aim to deal with the numerous uncertainties associated with detailed calculations.
Blast Analysis
224
Typical Application Heading PDUQ platforms, FPSOs, platforms where it is clear that the potential for escalation exists Checklist Guidance Has the effect of Explosion overpressures are exacerbated by high cloud cloud turbulence turbulence as is likely in the event of a large or catastrophic leak. been accounted It is not clear if complex, sophisticated CFD-based explosion for? modelling techniques can tackle this sort of turbulence. Full-scale trials are intended to investigate the effects of turbulence: hitherto, full-scale experiments have been based on quiescent clouds. The analysis should address this phenomenon and its potential for increasing the likelihood of SCE failure. Identification of It is envisaged that the explosion analysis for an integrated local high Blast facility, FPSO etc. will be carried out using a CFD-based code. Overpressures The degree of analysis should be sufficient to indicate areas of high local overpressure to allow suitable mitigating measures to be specified and implemented. Assessment of Blast analysis is typically carried out within a set "domain" that other blast reflects the extent of the partial confinement and effectively phenomena marks the limit of the calculation. In fact, explosion effects are not limited to domains and there are two important phenomena to account for in explosion analysis:
External explosions arise as a result of turbulent unburnt gas being pushed out of the partially confined volume and subsequently ignited. This can have a magnifying effect on the overpressure in the partially confined volume containing the initial explosion as it prevents venting. External explosions also result in areas not exposed to the initial explosions receiving unexpectedly high incident overpressures and drag forces. The analysis should account for the possibility of external explosions. Blast-funnelling. Vented gases from a module can encounter confinement in neighbouring modules which will "funnel" the gases, producing high local gas velocities. This in turn can result in potentially severe overpressure and drag force effects. Far-field overpressures. In the event of a strong explosion in an area of partial confinement, these can have an effect on items some distance from the limit of confinement as the overpressure pulse decays. The analysis should consider the effect of explosions on exposed SCEs that located outside of the explosion analysis domain.
Blast Impulse Magnitude Selection
What is the methodology for selection of lowerthan-Worst-Case blast impulse magnitude for design?
CFD codes require a lot of computing power to operate and run times are lengthy. At present this probably precludes a full probabilistic analysis arriving at an exceedence curve, as the number of runs required to build up a convincing dataset would be prohibitively time-consuming. CFD codes are of most use in determining local overpressure effects. Puttock [92] has described a technique for combining CFD results at local locations to exceedence calculation results from a phenomenological model to arrive at a "transfer function" that can be used to provide an exceedence curve for a given location - or SCE. Elsewhere, Huser et al has described a how a database of dispersion and overpressure results can be used as a basis of a probabilistic analysis. Talberg et al seems to describe a similar approach. It is clear that effort is being directed to using CFD codes to input to a probabilistic analysis; the inspector must be aware of these and assess whether the installation Safety Case under scrutiny has used such tools in the ALARP demonstration. (See Scenario Identification / General for the duty holder's requirement to ensure they obtain competent consulting support where necessary).
225
Typical Application Heading PDUQ platforms, FPSOs, platforms where it is clear that the potential for escalation exists Checklist Guidance How have It is likely that overpressures in complex multi-module practicable installations can rise to high values. SCE protection may not be protection limits practicable for the worst-case. The assessment must show that been determined? sufficient structural and piping stress analysis has been carried out to determine ultimate strength for the applied load. This will naturally lend itself to determining whether additional strength can be built into the structure and supports in line with costbenefit analysis. Has a detailed At this level, an attempt should be made to properly demonstrate escalation analysis the effect of SCE failure on the capability of the emergency been carried out? response functions of the installation and ultimately the individual and group risk levels. This is additional to the simple calculation of direct and indirect fatality referred to in the Medium Complexity checklist. It is only by fully considering the effect on SCEs that full cost-benefit analysis of explosion risk reduction measures can be carried out. Show that local The blast analysis should be of a suitable degree to identify overpressures and areas of locally high overpressures. Evidence should be drag forces are not presented that the layout has been optimised to reduce these excessive potentially damaging local overpressures to a tolerable level in order to demonstrate ALARP. Has non-linear It is likely that structure and supports have a great deal of analysis been residual strength after undergoing plastic deformation brought used to determine about by blast overpressure. Non-linear analysis of the structure the residual can determine the degree of plasticity and whether actual failure strength? of e.g. the blast wall and primary connections. Is the structural Typically, structure is assumed rigid throughout the applied blast response analysis load profile, which is assumed unaffected by any resulting coupled to the deformation. Robertson et al describe how "coupling" the blast analysis? structural response model to the blast overpressure model resulted in a more realistic representation of the effect of blast. Effectively, the structural model allows the loading to interact with the structural deformation so that both loading and deformation were considerably reduced. Uncoupled analysis is the norm, and so it is Robertson suggests that coupling the analyses effectively removes unnecessary conservatism from the response analysis. Has non-linear It is possible that the calculated structural deflections have been analysis been used in a relatively simple fashion in assessing the survivability used to check the of process pipework. This could be conservative, if the effect of structural survivability is linked to a code stress level rather than the deflection on ultimate strength of the pipe then effectively the pipe will never pipework? survive any significant deflection. Non-linear analysis can be used to demonstrate the point at which pipework loses containment. It will probably be prohibitively time-consuming to subject every pipe length to such a degree of analysis, but perhaps expert judgement can be used to identify particularly vulnerable sections that can be subject to close study. Has all vulnerable Following from the above discussion on "far-field" effects, the structure and analysis must ensure that items outside the blast model domain equipment been are also optimised for blast resistance. accounted for?
Assessment of explosion consequences
Layout optimisation
226
Typical Application Heading ALARP Demonstration PDUQ platforms, FPSOs, platforms where it is clear that the potential for escalation exists Checklist Guidance Use of robust Following on from the above, a fully integrated QRA is quantitative risk necessary. This should address risk to SCEs as well as directly analysis to to POB, because sometimes it is difficult to directly relate SCE demonstrate failure to the QRA. This will reduce uncertainty in the final risk explosion results, where uncertainty arises in the analysis of causes of management fatality. reduces risks to ALARP
227
PUBLISHED BY UK OFFSHORE OPERATORS ASSOCIATION London Office: 2nd Floor, 232-242 Vauxhall Bridge Road, London, SW1V 1AU. Tel: 020 7802 2400 Fax: 020 7802 2401 Aberdeen Office: 9, Albyn Terrace, Aberdeen, AB10 1YP Tel: 01224 626652 Fax: 01224 626503 Email: info@ukooa.co.uk Website: www.oilandgas.org.uk
228

Ukooa Fire and Explosion Guidance

Încărcat de

Informații document

Descriere originală:

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Ukooa Fire and Explosion Guidance

Încărcat de

Drepturi de autor:

Formate disponibile

Fire and explosion guidance Part 1: Avoidance and mitigation of explosions

ISSUE 1 October 2003

Issue 1, October 2003

Part 1:- Avoidance and mitigation of explosions

Part 2:- Avoidance and mitigation of fires

Part 3:- Design practices for fire and explosion engineering

Basis Documents for Parts 1, 2 & 3

Issue 1, October 2003

Issue 1, October 2003

Issue 1, October 2003

Issue 1, October 2003

Issue 1, October 2003

Significance to decision Making process

Decision context type

A Well understood risks Established practice

g rin is ee lys n na CBA gi da , En se R A ba g. Q sk e. Ri

Company Values Societal values

Figure 1 - The UKOOA decision making framework

Fire and Explosion Hazard Management

Issue 1, October 2003

Issue 1, October 2003

Issue 1, October 2003

Task Installation screening Scenario definition

2.3, 0, 6.5, 6.11, 6.12, 7.3

Issue 1, October 2003

Explosion hazard philosophy

Issue 1, October 2003

Issue 1, October 2003

The explosion hazard

Issue 1, October 2003

Issue 1, October 2003

Issue 1, October 2003

Goals, aims and Principles

Issue 1, October 2003

Legislation, standards and guidance

Issue 1, October 2003

Codes, standards and guidance

Issue 1, October 2003

Inherently safer design

Goals of inherently safer design

Minimisation of ignition potential

Minimisation of Personnel On Board (POB) exposure to blast effects

Minimisation of hazardous inventory

Issue 1, October 2003

Limitation of potential flame front length

Monitoring and maintenance of SCE integrity and functionality

Maintain effective hazard management

Issue 1, October 2003

Effective Management Of Residual Risk

Issue 1, October 2003

Processes for Achievement of Inherently Safer Design Goals

Means of Achievement Less maintenance burden

Phase Conceptual FEED FEED FEED Conceptual FEED

Less intrusive instrumentation Less corrosion Less vibration

FEED / Detailed Design Detailed Design

Fewer ignition sources

Conceptual FEED/Detailed Design

Reduced Severity Explosions

FEED / Detailed Design FEED FEED

Issue 1, October 2003

Means of Achievement Shorter flame path length More ventilation

Phase FEED FEED

Issue 1, October 2003