OISD-RP-233 FOR RESTRICTED CIRCULATION (Draft III)

FIRE & EXPLOSION RISK ASSESSMENT AND FIRE PROTECTION SYSTEMS FOR E&P OFFSHORE INSTALLATIONS

Prepared By FUNCTIONAL COMMITTEE ON THE SUBJECT

OIL INDUSTRY SAFETY DIRECTORATE GOVERNMENT OF INDIA MINISTRY OF PETROLEUM & NATURAL GAS TH 7 FLOOR, NEW DELHI HOUSE, 27, BARAKHAMBA ROAD, CONNAUGHT PLACE, NEW DELHI 110001

1

NOTE

OISD publications are prepared for use in the oil and gas industry under Ministry of Petroleum & Natural Gas, Govt. of India. These are the property of Ministry of Petroleum & Natural Gas and shall not be reproduced or copied and loaned or exhibited to others without written consent from OISD. Though every effort has been made to assure the accuracy and reliability of the data contained in these documents, OISD hereby expressly disclaims any liability or responsibility for loss or damage resulting from their use. These documents are intended to supplement rather than replace the prevailing statutory requirements.

2

FOREWARD

The oil industry in India is nearly 100 years old. As such a variety of practices have been in vogue because of collaboration/association with different foreign companies and governments. Standardization in design philosophies and operating and maintenance practices at a national level was hardly in existence. This, coupled with feedback from some serious accidents that occurred in the recent past in India and abroad, emphasized the need for the industry to review the existing state of art in designing, operating, and maintaining oil and gas installations. With this in view, Oil Industry Safety Directorate (OISD) was established in 1986 staffed from within the industry in formulating and implementing a series of self regulatory measures aimed at removing obsolescence, standardizing and upgrading the existing standards to ensure safer operations. Accordingly, OISD constituted a number of functional committees comprising of experts nominated by the industry to draw up standards and guidelines on various subjects. The present document on Fire & Explosion Risk Assessment and Fire Protection Systems for E&P Offshore Installations is the first edition of the document prepared by the Functional Committee on Fire & Explosion Risk Assessment and Fire Protection Systems for E&P Offshore Installations". This document is prepared based on the accumulated knowledge and experience of industry members and the various national and international codes and practices. It is expected that the provision of this document will go a long way to improve the safety and reduce fire incidents in Offshore Oil and Gas Industry.

This document will be reviewed periodically for improvements based on the new experiences and better understanding. Suggestions may be addressed to:-

The Coordinator Committee on 'Fire Protection System Oil Industry Safety Directorate th 7 Floor, New Delhi House, 27, Barakhamba Road, Connaught Place, New Delhi 110001

3

FUNCTIONAL COMMITTEE (First Edition : JANUARY 2011) _______________________________________________________________________ Name Organization _______________________________________________________________________

Convenor Shri P. S. Narayanan Oil India Limited, Duliajan

Members Shri R.S.Bhutda Shri Sanjeev Kapoor Shri Maroof A. Sheikh Shri H.C.Taneja Co-coordinator Shri Arshad Hussain Oil Industry Safety Directorate, New Delhi _______________________________________________________________________ In addition to the above, several other experts from industry contributed in the preparation, review and finalization of this document. Engineers India Limited, New Delhi Oil and Natural Gas Corporation, Mumbai Oil and Natural Gas Corporation, New Delhi Oil Industry Safety Directorate, New Delhi

4

FIRE & EXPLOSION RISK ASSESSMENT AND FIRE PROTECTION SYSTEMS FOR E&P OFFSHORE INSTALLATIONS Contents Section 1.0 2.0 3.0 4.0 5.0 Description Introduction Scope Codes, Standards & Approvals Definitions Fire and explosion management 5.1 5.2 5.3 5.4 6.0 7.0 8.0 9.0 Fire and explosion management philosophy Fire and explosion risk categories Fire and explosion strategies Fire prevention approach

Fire and explosion hazard identification Fire and explosion risk management process Functional requirements for fire and explosion risk management Production Installation design (with respect to fire protection) 9.1 Safety system 9.2 Equipment arrangement 9.3 Ignition prevention devices 9.4 Hot surface protection 9.5 Fire barriers 9.6 Electrical protection 9.7 Combustible gas detection 9.8 Bulk storage 9.9 Helicopter fueling facilities 9.10 Emergency power 9.11 Control of ignition 9.12 Control of spill 9.13 Ship Collision Protection 9.14 Unmanned Platform Floating production facilities design (with respect to fire and explosion protection) Mobile Offshore Drilling Units (MODUs) design (with respect to fire and explosion protection) Fire and gas detection and control methods 12.1 Detection system 12.2 Alarm system 12.3 Control actions

10.0 11.0

12.0

5

13.0

Emergency shut-down and blow-down system 13.1 Emergency Shut-Down (ESD) system 13.2 Blow down system Active fire protection 14.1 Fire water system 14.2 Foam system 14.3 Dry chemical fixed systems 14.4 Dual agent suppression system 14.5 Clean agent system 14.6 Co2 based system 14.7 Kitchen cooking appliances and hood protection 14.8 Helideck fire protection 14.9 Portable fire extinguisher Passive Fire protection Inspection, maintenance and testing Fire prevention Emergency preparedness 18.1 Emergency action plan 18.2 Emergency communication 18.3 Emergency evacuation 18.4 Emergency lighting Training Product Service Support References

14.0

15.0 16.0 17.0 18.0

19.0 20.0 21.0 Annexure 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.

Summary of methods of controlling fire Typical Safety Critical Elements Topsides issues during conceptual design stage Recommended number and distribution of portable extinguishers on MODU Typical applications of fire/gas detectors Selection of AFP systems on typical areas Typical placement of fire extinguishers at production installation Typical fire integrity requirements for fire barriers Typical fire integrity requirements for load-bearing structures Typical protection criteria for critical equipment Typical description

6

Fire and Explosion Risk Assessment and Fire Protection Systems for E&P Offshore Installations

1.0

Introduction Offshore oil gas installations are self contained units and have compact layout. As per requirements of Petroleum and Natural Gas (Safety in Offshore Operations) Rules, 2008 (Rules 23, 24 and 27) the operator shall establish a safety management system and shall ensure that risk assessment is carried out, which will provide the necessary basis for taking decisions to give due consideration to health, safety and environment. The process of evaluation and risk management is key element of safety management system. The recommended practices are based on an approach where the selection of control & mitigation measures for fires and explosions is determined by an evaluation of hazards on the offshore installation. The methodologies used in this assessment and the resultant recommendations will differ depending on the complexity of the facility, type of facility (i.e. open or enclosed), manning levels, and the environmental conditions associated with the area of operation. Focus should be on following priority: Safety of personnel Protection of the environment Protection of assets / minimization of financial consequences of fires and explosions.

It is impractical to control catastrophic fires. These types of events should be designed out or very high integrity preventative measures should be provided to minimize the likelihood. Usual requirement of an effective fire protection system is to prevent emergencies from developing into major threat to these installations. The requirement of fire fighting facilities, described in the following sections is based on the consideration that the fire fighting services from other sources will not be immediately available. 2.0 Scope These recommended practices cover the design criteria and minimum requirements of fire protection and mitigation systems to be provided at E&P offshore installations. The recommended practices can be applied to new or existing installations: For new installations it shall start during conceptualisation and feasibility studies and be fully developed during detailed design. The results shall then be communicated to personnel operating the installation to ensure that they know the purpose and capability of all the systems; can operate them properly and that adequate maintenance schemes are in place. For an existing installation the process shall be applied to current arrangements, and during modifications. These should be assessed to determine if the high level performance standards are achieved and that risks are as low as is reasonably practicable.

3.0

Codes, Standards & Approvals The latest edition of following codes & standards as applicable shall be followed: NFPA standards SOLAS, FSA CODE and IMO Resolutions NORSOK Standard Oil &Gas, UK (Fire and Explosion guidelines). IMO Code for the Construction and Equipment of Mobile Offshore Drilling Units 7

ISO 13702, Control and mitigation of fires and explosions on offshore production platforms - requirements and guidelines (ISO, 1998) UL / FM/ US MIL RP 14C - Analysis, Design, Installation and Testing of Basic Surface Safety Systems on Offshore Production Platforms RP 14G - Fire Prevention and Control on Open Type Offshore Production Platforms RP 14J - Design and Hazards Analysis for Offshore Production Facilities

The above standards outline the basic requirements of the fire protection equipment and systems. All equipment / components / engineered systems supplied shall be as far as possible UL/FM approved. The equipment / components / systems shall be suitable for marine application and should be approved by maritime administration (or third party authorized by the maritime administration) of country of origin. Third party approval agencies shall be internationally recognized in the field of Marine fire protection approvals / by the maritime administration. To ensure system integrity, system shall be tested and listed / approved by the approval agencies as a complete operating engineered system. Substitution of alternative components, where approved components are available, shall not be permitted. Where components are supplied not covered by third party approvals, the components shall be built to the recognized international standards. Pressurised containers wherever installed must have approval from PESO (Petroleum & Explosives Safety Organization) The equipment and system shall be of sustainable and proven technology. All systems shall be in place and functional for the life cycle of the installation. The equipment / systems shall be installed and commissioned by qualified person, trained and certified by the manufacturer. Technical, operational and service manuals shall be provided both in hard and soft copies by the manufacturer for all equipment / components / systems supplied.

4.0

Definitions Active fire protection: Any fire protection system or component which requires the manual or automatic detection of fire and initiation of consequential response. ALARP: As Low As Reasonably Practicable Assembly point: evacuation alarm. Area where mustering shall take place in the event of general and/or

Clean agent: Electrically non-conductive, volatile or gaseous fire extinguishing agent that does not leave a residue upon evaporation and meets the requirements given in the latest NFPA 2001 on clean agent fire extinguishing systems. Evacuation, escape and rescue (EER): Results of the process that uses information from the evaluation of events, which may require EER, to determine the measures required and the role of these measures. Fire and explosion risk assessment: Analytical study of likelihood, and severity of fire and explosion hazard scenarios. Fire and explosion strategy (FES): Results of the process that uses information from the fire and explosion risk assessment, to determine the measures required to manage these hazardous events and role of these measures 8

Means of escape: Fixed stairways, ladders, passages of non-combustible construction or portable flexible ladders, knotted manropes, or other devices of approved construction. Offshore installation: A mobile or fixed installation including any pipeline attached thereto, which is or is to be, or has been used, while standing or stationed in relevant waters with a view to explore or exploit petroleum and natural gas. Passive fire protection : Any fire protection system or component which by its inherent nature, plays an inactive role in the protection of personnel and property from damage by fire and functions independently without requirement of any human, mechanical or other intervention to initiate consequential response. Safety critical elements (SCE): Such parts of an installation, purpose of which is to prevent, or limit the effect of fire and explosion incident, and the failure of which would cause or contribute substantially to major fire and explosion incident. Temporary refuge (TR): Place provided where personnel can take refuge, for a predetermined period, at the same time as investigations, emergency response, and evacuation preplanning are undertaken. Shall: Indicates provisions that are mandatory in nature. Should: Indicates that requirement is recommendatory as per good engineering practices. 5.0 Fire and explosion risk management The fire and explosion risk management shall start very early in the design stage and shall be used as basis for hazards management during all life cycle stages of an installation. 5.1 Fire and explosion risk management philosophy The overriding requirements for the fire and explosion risk management philosophy are: Minimize injuries and fatalities from the initial event. All large off-site inventories should be isolated during all design fire and explosion events. Provide escape to temporary refuge (TR); one escape route to the TR should remain functional at all times. Protect personnel in the TR; TR and its supports should be compatible and maintain their integrity during all design fire and explosion events. TR should provide refuge on the installation for as long as required for evacuation of the installation .Provide other means of escape / evacuation; means of evacuation should be available at all times. Ability of personnel to escape from, and to shelter safely, from the effects of a fire and explosion event, and the ability to evacuate to a safe location should not be compromised. The philosophy shall ensure that: The hazard scenarios are addressed. Likely fire and explosion scenarios have been considered and corresponding accidental loads have been determined. Plant and equipment minimises escalation (personnel within the TR do not continue to be threatened by the incident, until such time as the hazard has dissipated to a safe level via shutdown, blow down or other means). Personnel are able to escape to a safe location, away from the hazard. 5.2 Fire and explosion risk categories Complexity in the fire and explosion risk management process shall be based on the risk level. Prescriptive design against the fire and explosion hazards can be an acceptable alternative, for low risk installations. This method is based on standardized guidance or requirements based on industry practices. For medium risk and high risk installations, the performance based approach presents a more specific prediction of potential fire and explosion hazards for a given system or process. This approach provides solutions, based on performance, measured against the chosen performance standards; rather than on prescriptive requirements. Solutions are supported by a fire and explosion hazard identification and risk assessment. 9

Determining installation risk category: Low risk (consequences) installation examples are; where the overpressure level is predicted to be relatively low, radiation levels are predicted to be relatively low and immediate and delayed consequences are also low. The equipment count would probably be low. A medium risk (consequences) installation would be typically a platform or compartment, where the congestion and confinement exceeds that defined for the low consequence case. Alternatively, a medium consequence installation may be a processing platform, necessitating permanent manning but with low escalation potential to quarters, utilities and control areas which are located on a separate structure. A high risk (consequences) installation would encompass remaining installations and compartments where there is significant processing on board leading to significant congestion and potential confinement with populated areas. This may typically be characterized by a bridge connected process, utilities, living quarter and well platform (with or without rig) or installation with quarters on the same structure as the process.

Where there is doubt regarding the category, into which an installation should fall, it is recommended that the category with next higher consequence / likelihood shall be used. 5.3 Fire and explosion strategies Fire and explosion strategies are developed to manage each fire and explosion hazards: To identify plant / equipment, personnel and procedures, required to manage these hazards; and For setting performance standards by identification of safety critical elements and their functional requirements. In developing the fire and explosion strategies (FES), there are a wide range of issues which should be considered to ensure that the measures selected are capable of performing their function when required to do so. For the FES, these issues include: Initiating events which may lead to fire and explosion The nature of the fires and explosions which may occur The risks of fires and explosions The marine environment The nature of the fluids to be handled The anticipated ambient conditions The temperature and pressure of fluids to be handled The quantities of flammable materials to be processed and stored The amount, complexity and layout of equipment on the installation The location of the installation with respect to external assistance/support The evacuation, escape and rescue strategy (EERS) The production and manning philosophy Human factors. Fire and explosion strategies (FES) shall be updated, whenever there is a change to the installation, which may affect the management of the fire and explosion hazardous events. The level of detail in the strategy will vary, depending on the scale of the installation and the stage in the installation life cycle when the risk management process is undertaken. The fire and explosion strategies should describe the role and functional requirements for each of the systems required to manage possible hazardous events on the installation. In developing functional requirements, the following should be considered: The functional requirements of the particular system. This should be a statement of the purpose and essential duties that the system is expected to perform. The integrity, reliability and availability of the system. The survivability of the system under the emergency conditions which may be present when it is required to operate. The dependency on other systems which may not be available in an emergency. The identification of safety critical elements (SCEs) and corresponding performance standards, 10

should demonstrate that FES fulfils the requirements of Rule 77 (main safety functions) of Petroleum and Natural Gas (Safety in Offshore Operations) Rules, 2008. The performance standard should define the items functionality, reliability or availability, survivability and measures of interaction with other safety systems. Inherently safe design approach, reduces complexity and requirement for human intervention; resulting in a simpler and robust system. 5.4 Fire prevention approach When fire hazard cannot be eliminated by inherently safer design, the steps of the fire and explosion strategy, in order of priority are: Prevent or minimise fires at source Detect fires early Control fires Mitigate against effect of fires

The following steps are typically involved 1. Prevent or minimize fires at source Methods for prevention or minimization of fires at source considered at design stage are: Minimise inventories Optimise layout Minimise the potential for loss of containment events Minimise the time to ESD and blow down Minimise ignition sources Providing an inert environment

On existing installations, it may be possible to identify ways of reducing the risks through changes in operational practices. 2. Detect fires early Fires that have not been prevented should be detected and then controlled to reduce the size, duration, and escalation potential of the fire. Methods of detection include gas detection and fire detection. 3. Control fires The control methods commonly used for offshore are tabulated in Annexure -1. 4. Mitigate against effect of fires Mitigating measures for fires are passive fire protection methods and active fire protection methods.

6.0

Fire and explosion hazard identification The starting point for risk assessment is the systematic identification of the hazards and effects which may arise from offshore activities. In the context of fires and explosions, the evaluation of these events may be part of an overall installation evaluation or may be treated as a separate process which provides information for the overall evaluation. Fire and explosion risk assessment includes - assess the fire risk, assess the explosion risk and manage accordingly. The fire and explosion hazards may be identified by formal processes such as: Hazard identification studies (HAZIDs) Hazard and operability reviews (HAZOPs) Layout review / hazardous area review Safety studies like FRA, EERA etc 11

Fire and explosion hazard sources can be: Reservoir hazard: direct release from the reservoir may occur due to well intervention during drilling or work-over operations. Process hazard: release from any section of process operations including production manifolds (well manifolds); water, oil and gas separators; stabilising and dewatering; oil pressurising for export; gas compression including condensing and knockout; gas drying; high pressure gas export including gas lift and gas injection; oil and gas metering etc. Import and export risers.

Fire and explosion risks include both the risks from the initiating event and subsequent escalation. Initiating events (causes of a release) may be plant and equipment failures such as exceeding design conditions / parameters, dropped objects, vessel collision, intervention, fatigue, vibration, extreme environmental conditions, and human or procedural error. The personnel from relevant disciplines, including operational personnel, should be involved in this fire and explosion hazard identification process, to acquire an extensive understanding of potential hazards. Personnel carrying out this process shall be suitably trained or experienced in the hazard identification methods to be used. The results of the hazard identification process should be used both to evaluate the consequences of hazardous events and to determine appropriate risk reduction measures. Everyone involved in the design, commissioning, operation, maintenance and modification of the installation should have sufficient knowledge of the fire and explosion hazards and their contribution to the overall risks. Safety systems shall be selected based on the hierarchy of prevention, detection, control and mitigation. Where any conflict exists between explosion and fire management it is the latter which will tend to take priority, however the optimum solution should generally be a balance between the two. Investigate the hazard with a view of: prevention, detection, control and mitigation; to reduce the frequency and severity of the hazard. Risk reduction measures should include which prevent incidents (i.e. reduction of the probability of occurrence), control incidents (i.e. limiting the extent and duration of a hazardous event) and mitigate the effects (i.e. reduction of the consequences). Preventative measures, such as using inherently safer designs and ensuring asset integrity should be emphasized, wherever practicable. Mitigation effectiveness will depend on detection, inventory isolation and deluge activation; together with the probabilities that these measures will be initiated. The process of selecting risk reduction measures, should predominantly lead to the use of sound engineering judgments. Principles of inherent safety should be applied early in the conceptualization and design stage, to eliminate or reduce hazards to the ALARP level. 7.0 Fire and explosion risk management process Fire and explosion risk management is a continuous process, rather than a series of discrete steps, with review and revision of earlier decisions, as necessary. There may be overlaps and iterations between the various stages of the design, commissioning and operational phases. Basic steps in fire and explosion risk management process are: 1. During concept selection process, fire and explosion hazards should be identified and this information should be utilised for optimising layout and hydrocarbon processing methods. Based on the selected concept, identify which codes and standards will be used (in case of new installation) to design the structure, plant and equipment; and operational regime. Re-confirm that all fire and explosion hazards have been identified. Typical fire and explosion events Pool fire (combustion of a flammable liquid pool) Jet fire (combustion of high pressure gas or liquid) Spray fire (combustion of a pressurized liquid release) 12

2.

3.

Blowout (wellhead spray or jet fire) Flash fire (combustion of a flammable gas where the flame propagates at a speed insufficient to result in damaging overpressures) Explosion (combustion of flammable gas/ vapour in which confinement and/or flame velocities are sufficient to result in damaging overpressure) BLEVE (rapid ignited release of flammable pressurized contents of a heated vessel resulting in blast overpressure, missile fragments and fireball) Cellulosic fire (fire involving material, such as wood, paper, etc.) Electrical equipment fire. Pyrogenic materials Condensate fire with invisible flame Vent fire due to lightening Metal fires or radioactive materials

Factors affecting fire behavior Emergency shutdown (ESD): Assuming the ESD operates, the volume of the isolatable volumes will affect the duration of the larger leak scenarios and result in a transient fire size, reducing with time. Blow-down: Similar to ESD operation, this could result in a transient release rate. Additionally, blow-down may reduce the consequences of the fire scenario by depressurizing a vessel or pipework onto which a fire is impacting, thereby preventing escalation. Confinement: Fires in confined areas with limited ventilation may change over time, for example, become progressively more severe as external flaming occurs, when the fire moves through the ventilation openings. Wind: The direction of wind will have significant affects on the behavior of fire and smoke generation which will affect escape, evacuation and rescue. Passive fire protection (PFP): The use of passive fire protection may not affect the nature of the fire but will affect the response of objects subjected to fire attack and delay or prevent incident escalation. Deluge: Depending on the fire type, active water deluge systems (area specific / equipment dedicated) may affect both the nature of fire and the thermal loading to engulfed objects and in most cases will be beneficial to escaping personnel.

Transition between fire scenarios Some fire scenarios may change with time, for example, a fire occurring in a confined space may lead to increasing fire severity with time and the movement of the flame through the vent may produce external flaming. Similarly, some fire scenarios may lead to incident escalation and result in a different fire event occurring as a direct consequence, for example, a jet fire impacting onto a pressurized vessel may lead to vessel failure and a BLEVE fireball event. A liquid spillage may start as a pool fire on the installation but drainage of the spill may ultimately lead to a pool fire on the sea. Therefore, it is important that a Quantitative Risk Assessment (QRA) considers the potential sequence of fire events and that a fully representative set of events is analyzed. The QRA should be supported by a thorough HAZID with input from people with experience of the existing or similar plant or processes. 4. Determine the explosion loads (including escalation analysis due to fire and explosion) to be used in design; overpressure, duration and dynamic pressures, on the structure and other safety critical elements. For typical list of safety critical elements refer Annexure-2. The likelihood of a significant fire will depend upon the likelihood of occurrence, of a large release and ignition. The following parameters will influence the potential likelihood of a fire: Hazardous inventory complexity, i.e. the number of flanges, valves, compressors and other potential leak sources. The type of flanges, valves or pipework. Some special types of flange tend to have lower leak frequencies associated with them, e.g. hub type flanges. 13

The number of ignition sources within the flammable region of a potential spray release, gas or vapour cloud. The ventilation regime. The equipment reliability and the maintenance philosophy.

The escalation analysis is an important aspect, of fire and explosion hazard identification and risk assessment. Escalation analysis should consider: The location and description of the initial event; especially its size, severity, duration and frequency. The means by which the initial event may escalate, and at each escalation stage, the corresponding probability and time to escalation. The effects of the events on the installation, including the safety systems at each stage of escalation and how these affect subsequent event progression. The contribution of safety systems in reducing the consequences and the probability of their successful operation. The effects on the key facilities or systems such as the temporary refuge (TR) and evacuation escape and rescue (EER) facilities in terms of impairment, time to impairment and impairment frequency. The fatality levels associated with each scenario.

For detailed guidance on explosion loads and fire loadings refer API RP 2FB, Recommended Practice for the Design of Offshore Facilities Against Fire and Blast Loading and Fire and Explosion Guidance: Oil and Gas, UK (2007). 5. Identify plant and equipment, which can fail due to fire and explosion. Similarly identify personnel and escape routes, which are vulnerable to fire and explosion hazards. During this process, special attention should be provided to escalation scenarios. Design the hardware to meet the requirements, and plan for future verification, by establishing performance standards. Define the role and functionality, reliability, availability and survivability for engineered (hardware) systems. Define the role, manning and competence requirements for procedural systems. 6. Verification shall be done, to ensure that design codes are suitable for severity of hazardous events. In the case of shortcomings, either design codes can be changed; or operating parameters, procedural system can be changed. If required, additional specific preventive measures should be provided. The structure and other SCEs shall be designed for the identified fire and explosion scenario design load cases. Determine the response of the structure and other SCEs to fire and explosion loads including overpressure, dynamic pressures, strong shock and missiles. Where practicable designs cannot be achieved, alternative means of fire and explosion mitigation must be sought; in order to reduce the magnitude or risk of exceeding design load scenarios (the structure and other SCEs shall be able to accommodate these design loads). There is always the potential for the systems, to be damaged in a hazardous event. Inherent safety avoids this potential, by aiming for prevention rather than protection and the preference for passive protection over active systems. It is particularly important to follow inherently safe design principles, where the consequences of process release or system failure, are high. Where it is possible to reduce the reliance on engineered (active or passive) safety systems or operational procedures, this should be done. For new installations, review layout and process design, to eliminate or reduce the hazards, to meet the performance standards. In case of existing installations, it may be possible to identify ways of reducing the risks though changes in operational practices. 7. Develop procedural safety systems at existing installations: assessment of existing procedures should be done to ensure that operation and maintenance of systems meet their functional requirements. These include establishing effective operational, 14

maintenance and test procedures; setting maintenance and test frequencies; and identification of training and competence requirements. 8. Evaluation - analyse results of response analysis, against the appropriate performance standards to demonstrate that ALARP has been achieved. The results of the evaluation process and the decisions taken with respect to the need for, and role of, any risk reduction measures should be recorded so that they are available for those who operate the installation and for those involved in any subsequent change to the installation. 9. Verify that systems are effective and reliable, throughout lifecycle of the installation. This requires continuous maintenance and operation of the facility, so that the engineered and procedural systems continue to meet, their original intent as developed during the design and initial assessment process. This also includes carrying out periodic function testing, and ensuring that performance standards are met. Ensure that personnel are trained and competent to operate, maintain and test engineering systems: and implement procedural systems. Inherent safety practices must be maintained throughout the life of the installation, continuing through the operational phase, by adherence to effective inspection and maintenance regimes and by ensuring that management systems and related procedures are followed. Verifications should check that: The initial design of the safety critical system /element is appropriate for the hazard. The SCEs procured, installed and commissioned, still achieve their required function. The maintenance being carried out is compatible with the reliability and availability, specified in the performance standard (functional requirements). The maintenance considers the likely failure modes (especially un-revealed failures) of the components. For detailed guidance on failure modes ISO 14224 should be referred. During the life of the installation, changes may take place, for example changes in the produced fluids from the reservoir. Alternatively a safety system may deteriorate, so that it is unlikely to continue to achieve its intended functional performance, reliability and availability. All changes should be assessed to determine the effects on the performance standards and, where necessary, improvements should be considered to the systems provision. The fire and explosion risk management process should be documented and communicated to operational personnel so that they have adequate information about the hazards, hazardous events and safety systems provided to manage them. The identified fire and explosion hazards should be compiled in hazard register, listing all hazards, their causes, and how each hazard is handled. 8.0 Functional requirements for fire and explosion risk management The following goals should be considered for setting functional requirements for fire and explosion management: All fire and explosion hazards have been identified, analysed and understood by everyone, with a part to play in their management. A practical strategy to manage each of the hazards has been identified, documented and implemented. Strategy takes into account sensitivity of the installations overall risk profile to fire and explosion hazards and the mitigation and control measures accordingly. The operating limits for the whole facility have been identified and there are clear instructions for the continued operation of the facility or use of additional controls whenever operating limits are exceeded. All causes of hazards have been identified, understood and sufficient effective prevention measures have been implemented. The characteristics of those hazards which may require evacuation have been carefully analyzed to reduce the severity and potential for escalation, 15

thereby minimizing the need for evacuation. All reasonably practical steps to reduce the risks from fires and explosions have been taken, concentrating first on prevention and thereafter on control, the prevention of escalation and evacuation. Appropriate combinations of prevention, detection, control and mitigation measures have been put in place, to implement the chosen strategies; and are maintained throughout the lifecycle of the installation. All of these measures: including people, processes and engineering systems have been documented, have clear ownership and have functional requirements. Where the effects of failure could overwhelm the installation and require evacuation; these measures have been specifically identified and are of high integrity. The systems provided to detect fires, are suitable for the hazard types and the environmental conditions. Fire detection systems provide sufficient information to warn personnel and allow an assessment of the hazards to be undertaken, without personnel being exposed to hazards. Effective isolation of all major external sources of hydrocarbons, including pipelines and the reservoir is ensured. These isolations have been designed to survive all reasonably foreseeable fire and explosion hazards on the facility. Location of personnel at installation is such that their exposure to fire and explosion hazards is minimized. Areas required to shelter personnel from fire effects and their supports shall remain viable until either the incidents have been brought under control or full controlled evacuation has taken place. A minimum provision of routes, systems and arrangements to allow evacuation; shall remain viable, under the effects of every incident, which may require them. The design, operation and maintenance of the fire and explosion risk management systems are undertaken by competent personnel, who understand their responsibilities in the management of the hazards and possible hazardous events. Any changes to the installation, which may affect the likelihood or consequences of fires and explosions, are identified, assessed and the systems revised, to take the changes into account, as necessary.

For guidance on functional requirements of installation layout; emergency shutdown system and blow down; control of ignition; control of spills; emergency power system; fire and gas systems; active fire protection; passive fire protection; explosion protection and mitigation system; evacuation escape and rescue; and inspection, testing and maintenance: ISO 13702, Petroleum and natural gas industries Control and mitigation of fires and explosions on offshore production installations Requirements and guidelines and NORSOK standard S001 (edition 4, February 2008) Technical Safety should be referred. 9.0 Production installation design (with respect to fire and explosion protection) Design and layout of installation shall ensure adequate firefighting access, means of escape in case of fire, and also segregation of facilities to extent possible so as to minimize fire risk to the adjacent facilities. This section describes critical specific issues / items which should be considered during design of production installations for effective management of fire and explosion risk. 9.1 Safety systems Safety systems play an important role in preventing fires and minimizing their effect. The primary purpose of a safety system is to detect abnormal conditions and initiate appropriate action to prevent situations that could result in an accidental fire. The primary action normally initiated by 16

the safety system is to shut off process flow, thus eliminating the major fuel source on a platform. The safety system may also shut down potential ignition sources such as engines, compressors, and heaters. The amount of venting available and the degree of congestion in the process area significantly influence the severity of an explosion. In this respect, the following points should be considered: Long and narrow modules containing pressurized hydrocarbon systems should be avoided, as large distance between possible ignition points and the vent can contribute to high over pressures; Explosion pressure is dependent on blockage, so blockage should be reduced; Repeated obstacles should be avoided. If this cannot be achieved, vent openings along the wall with the repeated obstacles should be provided. The design, operation, and maintenance of these safety systems are addressed in API RP 14C and ISO 10418. 9.2 Equipment arrangement In developing the layout of the installation, consideration shall be given to maximizing so far as is reasonable the separation by distance of the temporary refuge (TR), accommodation and evacuation, escape and rescue (EER) facilities from areas containing equipment handling hydrocarbons. Guidelines for the arrangement of production equipment are presented in API RP 14J. Particular consideration should be given to the location of fired process vessels and the placement of temporary equipment during work over, completion, and construction activities. Topsides issues (mainly locations) during conceptual design stage for fire consideration in items like wells, risers/pipelines, process & piping, structures and supports, fire protection etc. are given in Annexure-3. 9.3 Ignition prevention devices Natural draft components should be equipped with spark and flame arrestors to prevent spark emission. Recommended safety systems for fired components are presented in API RP 14C. 9.4 Hot surface protection Surfaces with a temperature in excess of 400F (204C) should be protected from liquid hydrocarbon spillage and mist, and surfaces in excess of 900F (482C) should be protected from combustible/flammable gases and vapors. API RP 14C (for equipment and machinery component) and API RP 14E (for piping) should be consulted for guidance. 9.5 Fire barriers Barriers constructed from fire resistant materials are primarily meant to provide a heat shield and may be helpful in special situations to prevent the spreading of forces. Locations of fire barriers should be reviewed carefully due to the possibility that the fire barriers may impede natural ventilation to such an extent that hydrocarbon vapors and gases may accumulate. For details on ventilation refer API RP 500/ ISO 15138. Fire barriers are covered in detail in section 9.0 on passive fire protection. 9.6 Electrical protection Protection from ignition by electrical sources should be provided by designing and installing electrical equipment in accordance with API RP 14F/ API RP 14FZ considering the area classification as per API RP 500/ API RP 505.

9.7

Combustible gas detection The concentration of a combustible gas can be determined by detection devices that may initiate alarms or shutdowns. The usual practice is to activate an alarm at a low gas concentration and to initiate action to shut off the gas source and/or ignition source if the concentration reaches a 17

preset limit below the Lower Flammable Limit (LFL). Gas detection system is covered in detail in section 11.0 on fire and gas detection and control methods.

9.8

Bulk storage The inventories of flammable/combustible fluids should be consistent with operational needs and should be minimized to the extent practical. Recommended practices for permanent bulk storage (crude oil, condensate, methanol, jet fuel, diesel, etc.) include the following: Tanks should be installed, as far as practical, away from the ignition sources and should also be protected from damage (lifting operations, etc.). Tanks should be enclosed by curbs, drip pans, or deck drains, to prevent liquid accumulation. The drain system should be designed with provisions to prevent vapor return. Tanks should be adequately vented or equipped with a pressure or pressure/vacuum relief valve and should be electrically grounded.

9.9

Helicopter fueling facilities Recommended practices for helicopter fueling facilities include the following: Fire extinguishing equipment should be adequate and readily accessible to the helicopter fueling area. Helicopter landing areas with fueling facilities located above living quarters should be constructed so as not to retain flammable liquids and to preclude these liquids from spreading to, or falling on, other parts of the platform. The helicopter fuel hose should be of a type recommended for aircraft fuel service and should be equipped with a static grounding device and a deadman type nozzle. The helicopter should be bonded with self-releasing or spring-clamp bond cables (same potential as hose). Suitable storage should be provided for the fueling hose. The fuel transfer pump should be equipped so that it can be shut down from the fueling station. Provision should be made, by providing releasing mechanism, for dumping ATF storage tank into sea, in the event of fire on ATF tank.

9.10

Emergency power Emergency electrical power may be provided by one of the following systems: An emergency generator; Installation mains power generation provided it can reliably provide power under emergency conditions; Cables with suitable integrity from land or other installations; Battery systems; or some combinations of these. The design of the emergency electrical power system should consider providing automatic-start arrangements to avoid the need for manual intervention during emergency condition. The essential safety systems, which may require emergency power, include: emergency and escape lighting; vent and obstruction warning lighting; identification lights and navaids; telecommunication equipment; fire and gas detection and protection systems; ESD systems; public address equipment and intercom systems; installation of visual and audible alarms; ventilation/cooling for the equipment contained in this list; embarkation areas, sick bays and other areas necessarily manned in an emergency;

The duration of the uninterruptible power supply (UPS) to systems such as the emergency lighting, F&G system, emergency communications, ESD systems etc. should be designed to cater for the emergency conditions, which may be experienced. Where UPS systems are selected they should 18

provide power for a period considerably longer than the TR endurance time to cater for those events where immediate evacuation is unnecessary or not practical. In a major gas emergency, mains power generation may stop, resulting in the loss of the instrument air compressor(s). If the integrity of the air supplies cannot be guaranteed, the need to power an air compressor from the emergency generator should be considered. Similar requirements are to be considered for hydraulic systems also.

9.11

Control of ignition Ignition occurs when sufficient heat is present to cause combustion. Ignition sources that may be present in offshore installations are: Chemical reaction Electric sparks and arcs Mechanical sparks Lightning Static electrical sparks Flame and radiation heat Hot surfaces Heat of compression

To minimize ignition sources following points should be considered: a. All electrical equipment shall be suitable for use in the area in which it is installed. This is to cater for fugitive leaks in accordance with hazardous area design codes. However, the dispersion distances for such leaks, from which the hazardous zones are calculated, do not cater for major accident releases. b. A gas cloud from a medium or large leak can, and will, drift outside hazardous area limits. Therefore caution must be exercised in locating unclassified equipment such as generator sets, temporary pump skids, heating equipment etc in safe open locations around the installation. c. Installation should be suitably earthed and all operators trained in awareness of offshore static spark risks (a recurring cause of fires). d. Equipment, which provides an ignition source and is unacceptably close to release sources, should either be located inside an enclosure with ventilation ducts that close off automatically on detection of gas, or be provided with some alternative form of protection. e. Electrical equipment outside the TR and control station, which is required to operate during a gas emergency, should be suitable for operation in a flammable gas atmosphere. f. Diesel engines in non-hazardous areas powering essential safety systems should be provided with protection such that the diesel engine can continue to operate if gas can realistically reach the area in an emergency. This may include isolation of non-suitable electrical components, over-speed protection and, possibly, cooling of hot surfaces. g. The integrity of physical barriers between hazardous and non-hazardous areas is important to prevent gas migration to non-hazardous areas. 9.12 Control of spill Control of spills is fulfilled through the open drain system. The purpose of the open drain system is to provide measures for containment and proper disposal of liquids including handling of FW, e.g. through fire seals. The design of the open drain shall limit the spread of a spill and route the spill away to avoid escalation. Hazardous and non-hazardous open drains shall be physically separated to prevent back flow of hydrocarbons from a hazardous to a non-hazardous area. The hazardous drain collection tank shall be purged. The capacity of the drainage system should be sufficient to handle credible spill coincident with deluge and/or firefighting activities. The design of drainage systems should make allowance for possible blockage which may restrict the capacity of the system. When a drainage system is provided, it should be designed to prevent burning fuel spreading fire to other areas. 19

Separate larger drainage systems may be necessary to control major releases and any associated firewater. In areas where there is no likelihood of oil spill, it may be acceptable to provide firewater drains which discharge fire-water directly to the sea. Consideration should be given to the need to prevent fires spreading to sea level where they may affect the integrity of the installation-supporting structure and impede evacuation. Kerbs or drip-pans should be provided around vessels, pumps and other potential sources of leakage to limit the spread of small spills. Storage arrangements for movable containers of flammable liquids or gases should take account of the possibility of leaks or spills and measures for handling these should be in place. 9.13 Ship collision protection The ship collision avoidance system and protection (such as barge bumper, riser guard) shall be provided to reduce the risk for ship collision. The radar system shall be able to register the vessels course & speed including plotting facilities and have function to transmit the signal unit responsible for surveillance. The radar system shall be equipped with proximity alarm to warn the observer of an approaching vessel with time to closest point of approach. 9.14 Unmanned platform Protection against fire and explosion on unmanned platforms should be based on FES considering both scenarios when it is unmanned and when it is temporarily manned. 10.0 Floating production facilities design (with respect to fire and explosion protection) The floating production facilities can be: Floating production system (FPS) Floating production storage and offloading system (FPSO) Spar (also called Deep draft floating structures) Tension leg platform (TLP) Semi-submersible Special features having impact on fire and explosion risks, on the floating facilities, include: The geometry of the layout Methods of construction Compartmentalisation Operations Fire and explosion scenarios Response characteristics of marine construction to fires and explosions Special features associated with the motion, station keeping, marine systems and stability of the structure. Fire and explosion risk management on floating production facilities should include: Fire and explosion risks which may impact integrity of floating structure (structural integrity of hull, stability of structure, station keeping, marine systems etc.). Fire and explosion risks which may impact topside evacuation, rescue, living quarters, and temporary refuge. Fire and explosion risk management process shall be similar to section 6.0, with the following specific considerations, in addition to the applicable issues / items brought out in section 8.0: a. b. Nature of crude; less volatile will stabilize easily in comparison to more volatile (higher risk). Tie-in of satellite wells will increase the risk due to increased production throughput. 20

c.

Buoyancy, stability and station-keeping must be maintained at all times, and the systems associated with these functions must be protected from fire hazards. High consequence events with possibility of losing the facility are: Stability of the facility may be compromised during fire and/ or explosion events (escalation events should also be considered) Loss of buoyancy due to significant leakage from riser and subsea equipment underneath floating facility Flooding of a riser resulting in reduced buoyancy of hull. Potential for large fire and explosion events: Storage tanks of crude oil on the facility may present hazards in the form of either large scale storage of stabilized crude or with empty storage tanks containing potentially explosive mixtures (possibility of accumulation of gas cloud from vent pipes). Non-process hydrocarbon inventories; the floating facility requires substantial stores of diesel to maintain station, process and utilities power demands plus other life-support systems. The vessels are often located in difficult or remote places and will generally be designed to be self-sufficient for extended periods in the event that supply vessels cannot reach them. Fire and explosion in engine room. Potential of hydrocarbon releases: FPSO swivel connections are source of releases; the turret contains a large number of swivel joints in order to function. These are often at the highest process pressure and pass the reservoir fluids prior to any cleaning or conditioning and are therefore subject to most onerous process duty. FPSO storage tanks Piping due to hogging and sagging of deck structure Potential for spread of fire to multiple decks or compartments: Layouts having proximity of process area with living quarters Presence of grated decks Considerable movement of floating structure has potential of contributing to spreading of pool fires. The top decks should be designed to follow a hazard gradient from the most hazardous area (with respect to fires and explosions) to the least hazardous. This will generally be from the turret outwards. In case of turret-moored FPSO with weathervaning capability, due to the weathervaning effects (either due to wind or current and their effects on the superstructure height and hull draft) the fires can escalate downwind and at the very least, toxic products of combustion will be distributed downwind. The layout should consider these additional hazards and the design should take these into consideration to maintain levels of safety. Equipment spacing and layout variations: Spread out spacing between equipment and utilities on tanker type FPSO Closer equipment spacing on semi-submersible, TLP and Spar Segregation to avoid escalation of a fire can be achieved by separation of modules and sometimes separated by fire barriers (if required, based on risk assessment).

d.

e.

f.

g.

h.

i.

j.

Potential of confinement of gas, with increased potential for explosion event, in the areas such as: FPSO turret, process area, storage tanks and pump room Spar moon pool machinery or storage spaces inside hull The layout of surface and sub-sea facilities should be carefully considered early in the design to account for the following shipping related hazards: Passing ships and fishing boats Supply and maintenance vessels with respect to anchoring or dropped objects Anchor mooring patterns of drilling rigs during positioning and rig moving (in case drilling or well servicing is envisaged) 21

k.

Safe access (approach the production facility, moor, load their cargo, unmoor and proceed to open waters) by off take tankers, avoiding interference with other moorings, flow lines and risers as well as other field operations.

The key considerations are identified maneuvering areas and weather limits, derived by means of a risk assessment study, for the operations of tankers. l. Offloading to shuttle tankers is a regular event and poses a significant risk both on the floating production facility and the shuttle tanker. The risks comprise the breakage or leakage of the transfer hoses and the potentially flammable mixing of hydrocarbon and air in the storage holds of floating production facility and shuttle tanker. During the offloading operation, the shuttle tanker and floating production facility are in relative proximity and the risks of fire and explosion on either vessel are compounded by increased potential for escalation to another vessel. Floating production facility shall be equipped with emergency shutdown and release equipment that will allow the vessels to part in the event of an emergency on one vessel. The process decks on floating production facility are often lifted clear of the cargo storage tank roof for several design and operational reasons. The space provided also allows jet fires from the underside of the process to reach other process or utility modules without any impingement to reduce the effect of the flame. Though the gaps provide other risk reducing and operational benefits but steps should be taken to reduce the likelihood of jet fires by careful layout and orientation of the higher pressure equipment. Volatile organic compounds (VOC) return lines and their use during offloading is also an important hazard. During loading, it is required to continuously vent hydrocarbon vapors; venting system should be designed to accommodate the maximum volume of VOCs vented from storage. The adopted loading procedures should minimise VOC emissions. Also, consideration should be given for the high temperatures the vents may experience during venting at maximum production rates and / or possible process upsets. In storage tanks, the atmosphere should be maintained in a non-explosive condition. Purging should be carried out before introducing air into the tank to ensure that atmosphere will never enter the flammability zone. Escape routes and piping runs may be very long and personnel may be required to pass the origin of the incident to reach the temporary refuge. Design for escape (over long distances) during incidents and incident escalation shall take these into consideration. Fire water mains may be extensive and distant from the fire pumps in the process area. Correct fire-pump sizing and firewater-main hydraulic analyses shall be required to ensure adequate pressure at deluge points, hoses and monitors.

m.

n.

o.

p.

q.

Measures which may be taken during design phase to reduce risks from fire and explosion events associated with specific features of floating structures are controlled through various rules and regulations of certifying agencies as well as SOLAS. Specific Design issues for floating production facilities are: The design of hull against explosion overpressure shall ensure that the hull sustains only local damage, which is not detrimental to the integrity of complete facility at least for the period of evacuation. The hull compartment design shall consider potential for containing damage within the same compartment and eliminate the chain of events leading to spreading the damage to the adjacent compartments or to deck, so that significant loss of buoyancy and instability of the complete facility and failure of the mooring system is not compromised. The compartments with potential for initiating or escalating fire or explosion events shall be designed accordingly. The design of piping in hull compartments shall be suitable to eliminate potential for spreading damage to multiple compartments; design considerations may include provision 22

of pipe chamber or pipe chute to limit damage and eventual flooding of multiple damaged compartments. The upper hull design shall account for impact of fire events from topsides or moon pool with potential of deteriorating structural capacity of the hull and thereby reducing stability. Special attention shall be given to concentrated load areas such as topsides connection, or mooring chain-jack foundation. Open drain systems on floating installations shall be designed to operate satisfactorily for all sea states in which the hydrocarbon inventory is present in the process system.

11.0

Mobile Offshore Drilling Units (MODUs) design (with respect to fire and explosion protection) MODU includes both jack up drilling rigs and floating drilling rigs. Additional fire and explosion risk assessment on MODU should include hazards from the wells including well testing operations. Following fire and explosion hazards related to wells should be considered: Subsea shallow gas blow out Shallow gas blow out in cellar deck Blow out from well at drill floor Subsea well blowout HC gas release / ignition in mud processing area Fire and explosion in well testing areas Well programmes shall be designed considering the anticipated hazards out of the above mentioned hazards. MODUs have to meet the requirements of Conventions and Codes of International Maritime Organisation (IMO), which includes MODU code, FSS code. Fire and explosion risk management at MODU can be ensured by meeting the requirements of these codes.

Following issues have been taken into consideration by MODU code: Structural fire protection layout plan for decks and bulkheads Protection of accommodation spaces, service spaces and control stations Means of escape Fire pumps, fire mains, hydrants and hoses Fire extinguishing systems in machinery spaces and in spaces containing fired processes Portable fire extinguishers in accommodation, service and working spaces Arrangements in machinery and working spaces Fire detection and alarm system Gas detection and alarm system Firemans outfit Provisions for helicopter facilities Fire control plan Ensuring fit for purpose status of fire extinguishing appliances (operational readiness and maintenance is detailed in MODU Code 2009) Number and type of portable extinguishers provided on the MODU should be based on the fire hazards for the spaces protected. Requirement of portable extinguishers on MODU, as generic guidance (based on the requirements of IMO MODU code) is placed at Annexure- 4.

12.0

Fire and gas detection and control methods F&G detection systems should be designed in accordance with recognized codes and standards (such as NFPA 72 and/or EN54) applicable to the area of operation to achieve the level of performance stated in the fire and explosion strategies (FES). Parts 1 to 7 of IEC 61508 should be referred for guidance on requirements for electrical, electronic and programmable electronic system. Loss of power or key input signals should be considered in determining the reliability of the F&G system. 23

Where provided, the F&G system should be designed to perform the following functions: a) Monitoring to detect hazardous accumulations of flammable gases/oil mist; where considered necessary, to detect leaks (e.g. near pump seals); to detect fires at an early stage; to detect ingress of smoke and flammable gas into places where they may present a hazard; to permit manual initiation of alarm. b) Alarm to indicate the location of any fire or hazardous accumulation of flammable gaseous or oil mist; to immediately alert people of possible fire or gas incident. c) Control action to immediately initiate appropriate control actions. F&G System shall receive and display the status and any alarm signals from fire and gas detectors, manual call points (manual stations for initiation of ESD) and fixed fire protection systems on fire zone basis. The system shall also be capable of monitoring continuously the status of associated self contained systems such as HVAC fan and fire dampers, fire water ring main, fire water pumps, and gaseous extinguishing systems Providing the controls for the fire water distribution system, fire water pumps and gaseous extinguishing systems.

The F&G system shall operate as an independent system. F&G detection safety instrumented functions shall be functionally and physically segregated from other systems or functions. Equipment used for fire and gas detection, and control shall be listed/ approved by independent international certification agency namely UL/ FM. Where systems are supplied, such systems shall be listed / approved by the above mentioned agency as a complete operating system. Substitution of alternative components, where approved components are available shall not be permitted. Equipment, if any, which is not listed / approved by UL/ FM, shall be certified by a reputed third party who is recognized in the field of fire protection of offshore installation. New technologies, if introduced, shall have UL/FM approval before acceptance/introduction for field application and shall have proven record of service in a similar environment.

12.1

Detection system F&G detection shall be accomplished by the following automatic and manual methods: Detection of flammable gas Detection of heat Detection of flame Detection of smoke Detection of toxic gases Manual alarm call point

These detection circuits shall be fault monitored continuously, and shall provide early warning of an outbreak of fire or gas release in an area. Automatic detection system whether electric or pneumatic, shall have provision to detect failure of equipment or loss of supervising air pressure or failure of power supply. Typical applications of fire/gas detectors excluding toxic gases are tabulated in Annexure - 5. Toxic gas detectors shall be provided in all areas where potentially toxic gas concentrations may be present or be formed. 24

F&G detectors shall be subject to a regular maintenance and testing programme. The design of the F&G system field devices should consider the requirements for maintenance in order to minimize the need to provide special access arrangements for calibration, cleaning or testing. Fire and gas detection system shall be designed to testing without interrupting other system onboard. Faults of detection systems should, once detected, raise an alarm at a control station. Temporary removal or isolation of the F&G system, or part of the system, is acceptable provided that adequate alternative arrangements are ensured. Placing of detectors shall be based on relevant scenarios, hazard analysis, simulations and tests. Electric automatic detection equipment and its auxiliary electric equipment in hazardous areas shall be designed and certified for use in such areas.

Fire detectors shall, except for fusible plugs, be of resettable type such that after activation they can be restored to normal surveillance without the renewal of any component. For automatic operation of system, adequate and reliable source of power supply shall be provided. The need for an alternate power supply shall be determined considering criticality of the facility to be protected. 12.2 Alarm system Where automatic operation of F&G System is provided, an alarm condition shall remain until manually reset. The detection system shall activate a local alarm as well as an alarm at a constantly attended location. The detection systems alarms shall also be actuated when the system is operated manually. An alarm system comprises: manual alarm input devices input lines from detector and shutdown systems alarm central unit receiving and evaluating input signals and creating output signals to alarm sounding devices alarm sounding devices such as bells, flashing lights and/or loudspeakers power supply. Alarms initiation from the following systems shall be provided, as applicable: general emergency (ESD) or muster fire detection hydrocarbon gas detection toxic gas (e.g. Hydrogen Sulphide) detection fire extinguishing medium release (CO2 or other gases with lethal concentrations) power-operated watertight door closing machinery fault detection. All alarms shall be indicated visually and audibly in the control room. An alarm philosophy shall be established ensuring that the alarms are simple and unambiguous. The philosophy shall define which alarms are to be broadcasted to the entire unit or installation and whether this should occur automatically or not. The unit or installation shall be equipped with a public address system. The alarm system may be combined with the public address system, provided that: alarms automatically override any other input volume controls are automatically set for alarm sounding all parts of the public address system (e.g. amplifiers, signal cables and loudspeakers) are made redundant redundant parts are located or routed separately all loudspeakers are protected with fuses against short circuits. The number of alarms during abnormal conditions shall be assessed and reduced as far as practicable by alarm processing/suppression techniques in order to have operator attention on the most critical alarms that require operator action. 25

The alarms shall be clearly audible at all locations on the unit or installation, and shall be easily distinguishable. If noise in an area prevents the audible alarm being heard a visible means of alarm shall be provided.

Alarm to areas which are not regularly manned may be covered by procedural precautions, e.g. using portable radios. Activation of the general alarm shall be possible from the main control stations, including navigation bridge and radio room. In addition to the alarm systems, a two-way communication system shall be provided for transmittal of alarm, instructions and information between those who may require them. Manual alarm call points (MCP) should be provided at convenient locations around the installation, to allow personnel to initiate an alarm of a hazardous situation and allow rapid initiation of any necessary control actions. Where-ever applicable, MCP shall be designed and certified for use in hazardous areas.

12.3

Control actions Control actions initiated by F&G system shall include isolation of the installation from the reservoir and pipeline, initiation of emergency depressurization, isolation of electrical equipment to prevent further development of electrical fires shutdown of ventilation system to minimize ingress of smoke or flammable gas; isolation of electrical equipment and other potential ignition sources upon detection of flammable gas to minimize the risk of ignition; initiation of AFP systems where these have been provided to control or mitigate hydrocarbon fires;

13.0 13.1

Emergency shut-down and blow-down system Emergency Shut-Down (ESD) system The Emergency Shut-Down (ESD) system provides the means of isolating the installation from import and export pipelines, in order to control the topsides inventory in an emergency or quickly terminate export in the case of a pipeline or riser leak. The blow down system rapidly transfers the gas or oil inventory to the vent, flare or reservoir in a controlled manner, in order to reduce the potential for further escalation in the case of a fire or leak. Pressure relief devices are provided on process systems to prevent rupture of pressure vessels and leakage of pipework joints under applied pressure arising from faults in the process control system or as a result of fire. The isolation systems enable safe and secure isolation of key inventories and components to enable draining and purging of fluids prior to maintenance or inspection.

Emergency Shutdown (ESD) systems should be designed to initiate appropriate shutdown, isolation and blow down actions to prevent escalation of abnormal conditions into a major hazardous event and to limit the extent and duration of any such events which do occur. An ESD system shall be provided, in accordance with the requirements of the FES, in order to: a. Isolate the installation from the major hydrocarbon inventories within pipelines and reservoirs which, if released on failure, would pose an intolerable risk to personnel, environment and the equipment. Where appropriate, sectionalize topside inventory to limit the quantity of material released on loss of containment. Control potential ignition sources such as fired units, engines and non-essential critical equipment. 26

b.

c.

d. e.

Control subsurface safety valve(s). Where appropriate, depressurize hydrocarbon inventory and vent it to a safe place.

Upon failure of the shutdown system, all connected systems shall default to the safest condition for the unit or installation. There shall be a provision to activate functions manually from the central control room in such a manner that the facility is brought to a safe condition in the event of failure in the programmable parts of the system. Emergency shutdown system shall be in addition to systems for management and control and other safety systems e.g. if an ESD valve is connected to the process control system, the process control function shall be performed completely separate from the ESD functions. The emergency shutdown system may have an interface with other systems if it cannot be adversely affected as a consequence of system failures, failures or single incidents in these systems. An ESD system shall provide adequate information at a control station so that personnel involved in managing an emergency have required information to effectively execute the required actions in an emergency. The design of an ESD system may be for manual or automatic initiation or both based on FES. When manual initiation is required, the systems shall be simple to operate and shall not require operators to make complex or non-routine decisions. Once initiated, all control actions required by the ESD system shall occur automatically. The ESD system may also be initiated automatically when process conditions indicate a loss of control which requires ESD, for instance low air pressure, high liquid level in a flare system. The system may include a number of independent process shutdown systems that can also be actuated separately. Activation of the ESD system should result in the termination of all production activity on the platform, including the closing of all pipeline SDVs. The ESD system should be designed to permit continued operation of electrical power generating stations and fire-fighting systems when needed in an emergency. Equipment that is critical for the effectuation of system actions shall be protected against mechanical damage and accidental loads until shut down sequence is complete. This includes ESD valves, accumulators, electrical cables, pneumatic and hydraulic tubing. ESD valves shall remain in safe position during dimensioning event. Riser ESD valves shall be located in easily accessible, open, well-ventilated areas, to avoid damage from wave impact and dimensioning accidental events such as fire, explosion and mechanical impact. Stations for manual activation of the ESD system shall be located in strategic positions, be readily accessible, well-marked and protected against unintentional activation. Manual stations for initiation of ESD for complete platform shutdown should be installed at the following locations of a platform: a. b. c. d. e. f. g. h. i. j. k. helicopter decks; exit stairway landings at each deck level; boat landings; at the centre or each end of a bridge connecting two platforms; emergency evacuation stations; near the driller's console during drilling and work over operations; near the main exits of living quarters; control room; other locations as needed to provide stations accessible to all platform areas; near well bay; near arriving/departing pipelines.

ESD stations at boat landings may utilize a loop of breakable synthetic tubing in lieu of a valve or electric switch.

27

Because of key role of ESD system in the safety system, all ESD components used should be of high quality and be corrosion-resistant. The ESD system shall contain facilities for testing of both input/output devices and internal functions. ESD point shall have provision for self illumination. Emergency shutdown and operational shutdown of the satellite platform (associated well platforms) shall be able to be carried out locally on the satellite platform as well as from the main platform. Activation of the ESD system should result in the termination of all production activity on the platform, including the closing of all pipeline SDVs. The ESD system should be designed to permit continued operation of electrical power generating stations and fire-fighting systems when needed in an emergency. The ESD system of the satellite platform shall not be able to be taken out of service from the main platform and shall be in operation when the platform is unmanned.

13.2

Blow down system Rapid blow down or draining of topsides process inventories in order to prevent escalation of a fire situation should be provided unless there are specific good reasons for not doing so (e.g. very small topsides process). Blow down should be designed in the light of the specific escalation times for each fire scenario and generally be as fast as feasible once activated. Blow down shall be at a safe location with respect to personnel, bearing in mind the likelihood of spurious blow down events as well as real emergency events, and designed such that the heat radiation for maximum foreseeable flaring (or ignited venting) rate does not pose a hazard to escape and evacuation. While designing blow down system, following approach should be considered: For each item of equipment, define the type of fire (pool, jet, partial or total engulfment) likely to affect it. Calculate the rate of heat input appropriate to that type of fire. Calculate the rate of temperature rise of the vessel wall neglecting heat transfer to the contents. This simplification is appropriate for jet or other fires, which might affect only a small area of the vessel. More complex methods can allow for heat transfer to the contents. Estimate the time to vessel rupture. From this temperature-time profile prepare a yield stress-time profile and a corresponding rupture pressure-time profile. Compare this to the actual pressure vessel versus time for the required blow down time. If the time to rupture does not meet the established safety criteria (such as time to evacuate), then design changes may be necessary to improve the vessel protection. These may be a reduction in blow down time, or application of fire protection insulation, or changes to the plant layout to reduce the fire exposure.

In case of unmanned platforms, manual depressurization of all pressurized systems should be possible from the platform when it is manned. The consequences of ignited vent pipes should be considered. Vents on atmospheric vessels, which are not dimensioned to withstand a full inside explosion pressure, should be provided with adequate flame arrestors.

14.0

Active fire protection Fire and explosion strategies developed to manage fire and explosion hazards should ensure that the measures selected are capable of performing their function by setting performance standards (functional requirements) of safety critical elements. In developing the fire and explosion strategies (FES), there are a wide range of considerations that influence the selection of AFP systems, e.g. the size and complexity of the installation, the nature of the operations, availability of external fire-response equipment, and the fire-response strategy adopted by the operator. 28

Initiation of AFP systems may be automatic, manual or both. The means of activation will depend on the expected location, size and type of fire, and the fire-response strategy for the installation. For automatically initiated systems, a manual release station shall be provided and conveniently located outside the protected area. Objectives of active fire protection system are: To control fires and limit escalation; To reduce the effects of a fire to allow personnel to undertake emergency response activities or to evacuate; To extinguish the fire where it is considered safe to do so; To limit damage to structures and equipment.

The active fire protection system shall be provided on the offshore installation, out of the following, based on FES: Water Based System Foam Based System Dry Chemical Based System Water cum foam Spray System Dual agent suppression system ( DCP and Foam) Clean Agent System Carbon Dioxide Based System Kitchen Cooking Appliances and Hood Protection System Portable Fire Extinguishers Selection of active fire protection systems for typical areas on offshore installations is given in Annexure - 6 for initial design. Final selection of types and quantities/rates should be based on FES. Effects of the marine environment offshore shall be considered in the selection of equipment, materials, and systems. Equipment used for active fire prevention shall be listed/ approved/ certified by independent international certification agency namely UL/ FM. Where systems are supplied, such systems shall be listed / approved by the above mentioned agency as a complete operating system. Substitution of alternative components, where approved components are available shall not be permitted. Equipment, if any, which is not listed / approved/ certified by UL/ FM, shall be certified by a reputed third party who is recognized in the field of fire protection of offshore installation. The manufacturer of equipment/system shall confirm to provide after sales service support including supply of spares during life cycle of the equipment. New technologies, if introduced, shall have UL/FM listing/approval/ certification before acceptance/introduction for field application and shall have proven record of service in a similar environment. Various Active fire protection systems applicable in offshore are covered below:

14.1

Fire water system Fire water system shall comprise of fire water pumps and distribution piping network along with, deluge system, sprinkler system, hose reels, hydrants and monitors, as the main components. Sea water is used for fire extinguishments, fire control, cooling of equipment and for exposure protection of equipment/personnel from heat radiation. For these purposes, water in appropriate form should be used such as water jet, water spray, water fog, water curtain, and for foam making. The fire-water pump system should be selected to deliver the pressure and flow required for the operation of water based AFP systems (deluge water spray, monitors, hoses, etc.) sufficient to meet the role of these systems as defined in the FES. This will typically be the single largest 29

credible fire area (if deluge/ water spray systems are installed), plus any anticipated manual firefighting demand (monitors/hose streams). Where required in the FES, allowance should be made to cope with escalation of the fire to adjacent areas. For further guidance on fire water system section 5.2 of API RP 14G (4 edition, 2007) should be referred.th

14.1.1 Fire water pump selection The fire-water pumps, their prime movers and starting arrangements should be designed so as to operate for a minimum period sufficient for them to fulfill their functions. The speed of response of the fire-water pump unit should be selected so that fire-water is made available to the systems which use fire-water in time for them to fulfill their function. The FES should identify the number of fire-water pumps required and the arrangement necessary to provide a reliable supply of fire-water. This should consider situations such as when a fire-water pump unit is unavailable due to maintenance or breakdown. On normally manned installations this may require at least two independent pump units. If more than one fire-water pump is provided, fire-water pump units should be designed to minimize the risk of common mode failures occurring during emergencies. Pump inlets should be separated such that in the event of an incident rendering a pump inoperative, the other pump unit(s) will not be affected. Suitable arrangements should be provided to allow verification of fire-water pump system performance over the full range of the fire-water pump curve. Fire-water pump stop should be local only. Except during testing, any alarms from pump monitoring systems should not automatically stop the fire pump. Fire-water pumps should normally have two different means to start the pump automatically. Fire detection at the fire-water pump should not stop the pump or inhibit the start of the fire-water pump driver. If not running continuously, the system should be designed to start automatically in a fire emergency. In addition, facilities should be provided for local and remote manual start of the pumps. If the connection to the control room is lost, the fire-water pumps should start automatically. The fire-water pump system should be located, or protected, so that it is able to supply water in a fire emergency. Protection against damage of associated power cables, hydraulic/piping and control circuits should be considered. Fire-water pump units required to operate when gas is present should be designed to be suitable for such operation. Water treatment may be necessary to prevent marine growth from impairing fire-water system performance. The requirements for inlet filtration should be considered where debris may damage the pump. Sufficient instrumentation (both local and, where appropriate, remote) should be provided to enable personnel to ascertain the operational status of any pump unit. The provision of relief devices or other arrangements may be required at the pumps to prevent damage to pipe work due to high operating pressures or surge. Such devices should reset automatically once the excess pressure has been relieved.

Firewater pump systems shall be self-contained. It shall be possible to start the fire water system even if no other systems on the platform are operational. 30

Fire water pumps shall be exclusively used for firefighting purpose only. NFPA 20 Standard for the Installation of Stationary Pumps for Fire Protection should be consulted as guideline for design and installation of fire water pumps.

14.1.2

Fire water mains Fire water mains are the means by which water for fire-fighting is transmitted from the fire-water pumps to the points of use. The fire-water mains should be designed to provide an adequate amount of water to the discharge points at the required pressure. The fire water mains should be suitable for the marine environment. In developing the FES, incidents which could result in damage to the fire mains should be considered. Where necessary, fire-water mains should be routed or protected to avoid such damage. The design should consider whether arrangements are necessary to provide adequate fire protection when a section of the fire mains is isolated due to damage or maintenance. Fire-water mains should be equipped with an adequate number of shut-off valves to allow sections of the mains and branches from the mains to be isolated. Easy access for operation of these valves should be provided. Piping should be designed to be robust and should be adequately secured and supported. The effects of surge should be considered. Consideration should be given to protecting deluge pipe work against the effects of fires and explosions The fire-water mains should be provided with suitable arrangements to permit testing of the pump units and the