18.09.

2012
1
Seminar on
Depressurization and Safety
of Process Plants
Seminar for PETROVIETNAM 18
th
to 19
th
September 2012
Acceptance Criteria
Dr. Geir Langli
Petrell as
Olav Tryggvasonsgt. 40
Trondheim
Norway
Introduction
Legislation often requires that risk analysis shall be used
in the development of a design, in order to identify and
quantify risks, and to assess whether a design complies
with the risk acceptance criteria. This applies also to the
design of blowdown systems. Designing a system that
will provide 100% protection in all situations is desirable
but not necessarily cost-effective. This presentation will
discuss how much protection is required and why.
18.09.2012
2
Topics
Risk management
Risk analysis and acceptance criteria
Blow-down analysis and acceptance
criteria
Establishment, selection and use of
acceptance criteria
On management systems
(ISO 17776)
One key element of effective management systems is a
systematic approach to the identification of hazards and
the assessment of the associated risk in order to provide
information to aid decision-making on the need to
introduce risk-reduction measures.
ISO 17776 Guidelines on tools and techniques for hazard identification and risk assessment
18.09.2012
3
On management systems
(ISO 17776)
Risk-reduction measures should include those to prevent
incidents (i.e. reduce the probability of occurrence), to
control incidents (i.e. limit the extent and duration of a
hazardous event) and to mitigate the effects (i.e. reduce
the consequences). Preventive measures, such as using
inherently safer designs and ensuring asset integrity,
should be emphasized wherever practicable.
Risk reduction
Consequences
Frequency (or
probability) of
occurrence
UNACCEPTABLE
RISK
ACCEPTABLE
RISK
18.09.2012
4
Risk management
Indentify hazards
Risk analysis
Likelihood of occurrence, consequences
Risk evaluation
Comparison with acceptance criteria
Identify & implement risk-reducing
measures
Prevention, detection, control, mitigation,
emergency response
Source: NORSOK Z-013
18.09.2012
5
Acceptance criteria
risk analysis v blowdown analysis
HAZARD IDENTIFICATION
ANALYSIS OF INITIATING EVENTS
ANALYSIS OF POTENTIAL CONSEQUENCES
ESTABLISH RISK PICTURE
EVALUATE RISK
DESIGN ACCIDENTAL
EVENTS / LOADS
RISK
ACCEPTANCE
CRITERIA
SCENARIO DESCRIPTION
BLOWDOWN ANALYSIS
EVALUATE
CONSEQUENCES
RUPTURE
CONSEQUENCE
ACCEPTANCE
CRITERIA
Purpose of risk analysis
To identify and quantify hazards in terms
of likelihood of occurrence and possible
consequences, in order to provide input to
the design (decision-process)
Provide basis for comparing alternative
designs
Comparison with acceptance criteria
Identify and assess risk reducing measures
18.09.2012
6
Blowdown analysis
The purpose is to quantify the systems ability to
safely dispose the process segment(s) inventory
to prevent over-pressurization and possible
rupture (ensure integrity)
Input includes:
All components and pipework making up a segment
(fluid volume, dimensions, materials)
Flare system capacity/limitations
Fire scenario
Acceptance criteria
Acceptance
What is to accept?
To assent, approve or appreciate that
something is according to specifications or
requirements
The acceptance may be accompanied by a
degree of comfort/uncertainty
18.09.2012
7
Risk acceptance criteria (RAC)
NORSOK Z-013
criteria that are used to express a risk level
that is considered as the upper limit for the
activity in question to be tolerable
NOTE: RAC are used in relation to risk analysis and
express the level of risk tolerable for the activity,
and is the starting point for further risk reduction
according to the ALARP-principle. Risk acceptance
criteria may be qualitative or quantitative.
Features of risk acceptance criteria
Acceptable to all parties
Reflect best practise
Easy to communicate
Easy to apply
Reflect companys strategic and other objectives
Relevant to the hazards identified
Reflect the actual project and local conditions
Modification subject to strict evaluations
18.09.2012
8
ISO 17776 and criteria
Field development phase (Table C.4)
Primary codes and standards selected
Appropriate company codes and standards
Environmental limitations and requirements
Emissions and discharges
Detail engineering
Review and update as required the criteria
defined for conceptual design
ISO 17776 Petroleum and natural gas industries Offshore production installations Guidelines
on tools and techniques for hazard identification and risk assessment
Examples (I)
PSA (Norway) Facilities Regulations
Class H fire division: ....
b) it prevents the spread of flames and smoke
for at least two hours of the standardised fire test,
c) it is designed so that the average
temperature and the temperature of any single point
on the unexposed side do not rise more than 140C
and 180C, respectively, above the original
temperature within the following timeframes:
class H-120: 120 minutes,
class H-60: 60 minutes,
class H-0: 0 minutes
18.09.2012
9
Examples (II)
PSA (Norway) Facilities Regulations
Sec. 11 Loads, load effects and resistance
The loads that can affect facilities or parts of
facilities, shall be determined. Accidental loads and
natural loads with an annual probability greater
than or equal to 1x10
-4,
shall not result in loss of a
main safety function.
Examples (III)
Fatal Accident Rate (FAR)
Number of fatalities due to accidents per 10
8
exposed man-hours
Individual FAR < 10 for offshore installations
Individual FAR < 25 for exposed groups (e.g. drilling
personnel)
Potential Loss of Lives (PLL)
See for instance:
A Simplified Approach to Estimating Individual Risk Prepared by Amey VECTRA Limited for the HSE (UK)
http://www.hse.gov.uk/research/misc/vectra300-2017-r03.pdf
FAR =
Lxpcctcd numbc o] ]utuItcs pc cu (PLL)
Lxposcd hous
x 1u
8
18.09.2012
10
Examples (IV)
No. of fatalities (N)
A
n
n
u
a
l

f
r
e
q
u
e
n
c
y

(
F
)
0.1 1 10 100 1000 10000 100000
1E-1
1E-2
1E-3
1E-4
1E-5
1E-6
1E-7
1E-8
Risk to society (3rd person)
NOT ACCEPTABLE
ACCEPTABLE
(ALARP REGION)
Examples (V)
Loss of main safety functions
Safe heaven/muster area, CCR, load-bearing
structure, buoyancy & stability, escape routes
The annual probability for loss of each of
the defined main safety functions shall not
exceed 1 x 10
-4
for the following accident
categories:
Fires, explosions, blow-outs, collision/impacts,
dropped objects, environmental loads
18.09.2012
11
Examples (VI)
Depressurization (ref. API 521/ISO23251)
Industry practise is to depressurise down to
50% of operation pressure within 15 minutes
The standard says (Sec. 4.1):
Any circumstance that reasonably constitutes a
hazard under the prevailing conditions for a system
should be considered in the design. Pressure-
relieving devices are installed to ensure that a
process system or any of its components is not
subjected to pressures that exceed the maximum
allowable pressure.
Observations
Acceptance criteria relate to
Frequency or probability of occurrence
Consequences
Acceptance criteria must be established
taking into consideration
The physics
The physical properties
The local conditions/circumstances
18.09.2012
12
Adequacy of acceptance criteria
50% of operating pressure within 15
minutes (API 521)
The industry has applied this without paying
attention to the quantity of HC remaining in
the system
Possible consequences of rupture after (15 + t)
minutes
Pressure increase due to boiling off of heavier
components
Impairment of main safety functions
Escalation
Acceptance criteria for blowdown
Unacceptable consequences of ruptures
(Scandpower Guideline):
Released quantity of HC > 4 tons
Released quantity of HC gas > 1 ton
Pressure at time of rupture of vessels > 4.5 barg
Pressure at time of rupture of pipes > 20 barg
Rupture prior to 3 minutes after the onset of a fire
18.09.2012
13
Selection of acceptance criteria
Regarding amount of HC at time of
rupture
A fire fed with 2 tons of HC may cause
escalation and unacceptable consequences
A fire fed with 4 tons of HC may be no
problem due to i.e. large distances and no
critical systems adjacent to the leaking system
What about your project?
Acceptable ruptures
Emptying a process segment completely
will take a long time
It is not cost-effective to design a
depressurization system that will dispose
all inventories within just a few minutes
Strategy: Control and mitigate
limit the extent and duration of a hazardous
event
reduce the consequences
18.09.2012
14
Acceptance criteria
(blowdown analysis)
The following must be considered
Onshore or offshore
Layout and arrangement segregation, safe
by distance
Geometry proximity, complexity v escalation
risk
Inventory (gas, liquid, multi-phase)
Process conditions
Applicable rules, regulations, codes
Acceptance of consequences
Selection of acceptance criteria
Acceptance criteria for blowdown analysis
should be selected based on the
consequences of rupture
Will a rupture (feeding existing or trigger new
jet fire, pool fire) threaten escape routes, fire
& blast divisions (main safety functions)?
What about the fire load profile?
How long time is needed for safe escape &
evacuation?
18.09.2012
15
0
10
20
30
40
50
60
70
80
90
100
0,0 10,0 20,0 30,0 40,0 50,0 60,0 70,0
Time [min]
S
t
r
e
s
s

[
N
/
m
m
2
]
0
200
400
600
800
1000
1200
1400
T
e
m
p
e
r
a
t
u
r
e

[

C
]
UTS Calculated
stress of shell
Max. average
steel temperature
What is the fire scenario?
Example: Fire contained within a segment
18.09.2012
16
Example: Fire spreading to another segment
Selection of acceptance criteria
It is a management responsibility to
ensure that acceptance criteria for risk
analysis and depressurisation analysis
(fire integrity analysis) are aligned
Example: If is stated that escape ways in a
process area shall remain intact for X minutes
during a fire scenario then the process piping
and vessels must not be allowed to rupture
untill the consequences (of rupture) are
acceptable w.r.t. availability of escape ways
18.09.2012
17
System and scenario information
Estimate size of depress. orifice
Calculate P(t) for segment and T(t) for the steel
Increase
orifice
Is
flare capacity
utilised?
Are
consequences
of rupture accep-
table?
Will pipe/
equipment
rupture?
Improve
design /
apply PFP
Failure
criteria
OK
No
Yes No
No
Yes
Yes
Simplified procedure for
optimizing design of the
depressuring and PFP
systems of process for
process equipment.
Fire integrity of pipes/vessels
To ensure integrity of
process systems
during a fire scenario
it is imperative to
ensure that the
system pressure does
not exceed the
capacity of material at
the given temperature
18.09.2012
18
Acceptance criteria - examples
Norsea Gas Terminal (Emden, Germany)
Snorre A (North Sea, NCS)
Norne (Norwegian Sea, NCS)
Acceptance criteria - examples
Facility Onshore TLP FPSO
L X B X H (m) 840 x 800 x 8 136 x 100 x 100 320 x 54 x 47
Capacity 101 MSm
3
/d 360000 bbl/d + 1
MSm
3
/d
220000 bbl/d +
7.5 MSm
3
/d
Fluid Dry gas Well fluid Well fluid
P
max
(barg)/T (C) 80 / 15 349 / 93 230 / 97
Distance to shore 0 200 km 200 km
Water depth 0 338 380
Manning (LQ) 95 268 120
Process area Wide and open Dense Dense, stretched
FAR (requirement) 1.5 (5) 4.6 (10) 4 (10)
18.09.2012
19
Acceptance criteria
Escalation perspective
Proximity of process segments
Duration of leakage and fire (if ignited)
Flare limitations
When and at which conditions is rupture OK?
Also consider risk-reducing measures
TLP: weight and space limitations
FPSO: space limitations
Common: inspection and maintenance, cost
Example on application of acceptance
criteria in projects
I nl et mani f ol d
Gas t er mi nal
Pr oj ect 1 Pr oj ect 2 Pr oj ect 3
P (barg) 100 133 79
T (C) (content) 8 20 84
Volume of
segment (m
3
)
45 435
Peak heat load
(kW/m
2
)
350 (increasing
from 0 for vessel)
150 350
Background heat
load (kW/m
2
)
50 (increasing
from 0 for vessel)
100 30
Outer diameter
(inch)
44.5 30 84
Wall (mm) 40 32 73.9
Composition Gas (90% CH
4
) Gas/liquid (96%
CH
4
)
Gas/liquid (68%
CH
4
)
18.09.2012
20
Example on application of acceptance
criteria in projects
Unaccept abl e
rupt ure i f :
Pr oj ect 1 Pr oj ect 2 Pr oj ect 3
Remaining mass
> 4 tons
4.75 tons 137 tons 66 tons
Remaining mass
of gas > 1 ton
4.75 tons 86 tons 21 tons
P at time of
rupture > 4.5
barg (vessels)
Vessel did not
rupture
196 0.25
P at time of
rupture > 20
barg (piping)
111 150 77
Rupture prior to
3 min after the
onset of fire
Rupture (pipe)
after 2 min
Rupture (pipe)
after 1.9 min
Rupture (pipe)
after 21 sec.
Example Project X
Segment: Debutanizer column feed/bottom heat
exchanger
4 vessels
27 pipes
Pipe diameters: 2", 3", 4", 6", 8", 10", 12", 18", 20"
Heat loads are the same for vessels and piping
18.09.2012
21
Project X input data
Project X input data
Pipe input data (sample)
18.09.2012
22
Project X heat loads
Application of acceptance criteria
Unacceptable rupture if: Base Case Base Case + 10%
increase in pipe
volume
Released Q > 4 tons 4 vessels
5 pipes
4 vessels
6 pipes
Released Q (gas) > 1 ton 4 vessels
2 pipes
4 vessels
4 pipes
P at time of rupture > 4.5
barg (vessels)
1 vessel 1 vessel
P at time of rupture > 20
barg (piping)
No No
Rupture prior to 3 min
after the onset of fire
None None
Segment: Debutanizer column debutanizer feed/bottom heat exchanger
18.09.2012
23
Project X risk-reduction
Passive fire protection of pipes and vessels
that show unacceptable rupture
Reducing segment volume might have
resulted in less rupture, e.g.
Shorter piping runs (=> potentially more
dense layout)
Change process sectionalisation
More ESDVs, BDVs benefits and disadvantages
Project X risk-reduction
Consequences of the ruptures have not
been studied
Evaluation of escalation potential might have
suggested that some of the ruptures could
have been accepted, OR
Establishment of project specific acceptance
criteria might have resulted in a different
result
18.09.2012
24
Application of acceptance criteria
Rupture OK if the remaining quantity of
HC in the segment is < 4 tons (ref
Scandpower guideline)
Would 3.5 tons be OK? 3.9 tons?
What about 4.1 tons?
Application of acceptance criteria
If the segment is far away from other
segments, i.e. further away than a jet fire
from the segment after rupture can reach,
then 4 tons is probably OK.
What if the distance between the ruptured
segment and an adjacent segment is
10 m?
5 m?
18.09.2012
25
Application of acceptance criteria
It is necessary to assess the size and
duration of a jet fire from the ruptured
segment
What fire (size and duration) would be
necessary to threaten an adjacent segment?
What about the leak rate from the rupture while
depressurization is ongoing?
Application of acceptance criteria
Summary
Risk management: management responsibility
Depressurization is linked to risk
Acceptance criteria
Different criteria for risk and blow-down analysis
Must be aligned (for risk analysis and blowdown
analysis)
Must be assessed for adequacy; consequences of
application of a set of criteria should be analyzed
before implemented
18.09.2012
26
References
ISO 17776:2000
Petroleum and natural gas industries Offshore production installations Guidelines
on tools and techniques for hazard identification and risk assessment
NORSOK Z-013
Risk and emergency preparedness assessment
NORSOK S-001
Technical safety
Scandpower/Statoil/Hydro
Guidelines for the Protection of Pressurized Systems Exposed to Fire
lnstitute of Petroleum
Guidelines for the Design and Safe Operation of Shell and Tube Heat Exchangers to
Withstand the Impact of Tube Failure
Petrell AS Olav Tryggvasons gate 40 NO-7011 Trondheim Norway
Phone: (+47) 73805500 Fax: (+47) 73805501
post@petrell.no www.petrell.no