05887e01

Il presente documento RISERVATO ed di propriet dell'AGIP. Esso non sar mostrato a Terzi n sar utilizzato per scopi diversi da quelli per i quali stato inviato.This document is CONFIDENTIAL and the sole property of AGIP. It shall neither be shown to third parties nor used for purposes other than those for which it has been sent.

COMPANY SPECIFICATION

OIL PRODUCTION PLATFORMS

SAFETY GENERAL CRITERIA

05887.OPF.SAF.SDS

Rev. 1

July 1997

1 EMISSION TEIM SICI TEIM 15.07.97REV. DESCRIPTION COMP. VERIF. APPR. DATE

05887.OPF.SAF.SDSRev. 1 July 1997Sheet 2


FOREWORD

Rev. 1 Total sheets 96July 1997EmissionThis specification has been issued in accordance with EU requirements and isapplicable only to the oil platforms; thus, the following modifications havebeen realised:- specific references and contents relating to gas platforms have beeneliminated;- specific parts about oil platforms have been revised and amplified;- the integrity classes of the safety systems and the file-cards of shut down and

depressurization systems have been introduced;- the normative references not quoted in this specification have been

eliminated, since the contents are already considered by the abovementioned normative references.



CONTENTS

1. GENERAL

1.1 Scope

1.2 Normative references

1.2.1 European normative references1.2.2 Normative references of ISO, IEC and national organizations1.2.3 Normative references of other organizations1.2.4 Legislation1.2.5 Internal normative references1.2.6 References

2. FUNCTIONAL NORMATIVE REQUIREMENTS

2.1 Definitions

2.2 Operative environment

2.3 Intrinsic safety and prevention strategies

2.4 Safety requirements of the layout

2.4.1 General2.4.2 Platform orientation2.4.3 Platform areas2.4.4 Landing deck2.4.5 Cellar deck2.4.6 Mezzanine2.4.7 Main deck2.4.8 Flares/Vents2.4.9 Allowed radiation levels2.4.10 Helideck2.4.11 Sealine risers and traps2.4.12 Piping2.4.13 Storage tanks2.4.14 Electric generators and sub-sea power supply cables2.4.15 Accommodations - Utilities - Helideck Module2.4.16 Escape ways2.4.17 Evacuation crafts2.4.18 Areas classification2.4.19 Areas segregation



2.5 Functional requirements of the safety systems

2.5.1 General requirements2.5.2 Basic criteria2.5.3 Integrity classes of the safety systems2.5.4 Requirements of pressurized systems2.5.5 Requirements of shut down and depressurization systems2.5.6 Requirements of platform automation systems2.5.7 Requirements of monitoring systems2.5.8 Requirements of signaling, communication and alarm systems2.5.9 Requirements of ventilating and pressurizing systems2.5.10 Requirements of drainage systems2.5.11 Requirements of safety valves2.5.12 Requirements of electric system2.5.13 Requirements for the emergency lights2.5.14 Safety requirements of the lifting systems2.5.15 Safety requirements for the chemicals injection systems

2.6 Requirements on work health and environmental protection

2.6.1 Noise and vibrations2.6.2 Environmental protection

2.7 Requirements of the passive protection systems

2.8 Requirements of the fire systems

2.9 Emergency supplies

2.9.1 General2.9.2 Life-boats and life-rafts2.9.3 Life-jackets and life buoys

2.10 Boundaries, limits and exclusions

2.11 Ergonomics

2.12 Requirements for Quality Management and Quality Assurance

2.13 Documentation



3. SUPPLEMENTARY ELEMENTS

3.1 Enclosure and informative annexes

3.1.1 AnnexesAnnex 1 Shut down and depressurization systems file cardsAnnex 2 Shut down levels of the Platform



1. GENERAL

1.1 Scope

This document has the aim to define the functional requirements, the criteriaand the indication relating to the safety to be respected in order to design andrealise the Oil platforms.

This document:

- defines the overall safety requirements for designing; - defines the requirements to which a safety system have to satisfy in order to

play its function according to the prevention, control and risks attenuationmeasures provided for a specific installation.



1.2 Normative references

1.2.1 European normative references

EU Directives already approved by European Parliament

89/392/CEE - June 14th 1989 concerning the legislation re-approach of themember States, relating to the machines (safetycodes for the cranes)Italian legislation assimilating the directiveDPR. n.459 24.7.1996

92/58/EU - June 24th 1992 carrying the minimum prescriptions for safetyand/or health signals on work places (ninthparticular normative reference according toart.16, paragraph 1 of 89/391/EU).Italian legislation assimilating the directiveD. Lgs. n. 493 14.8.1996

92/91/EU - Nov. 3rd 1992 carrying the minimum prescriptions forimprovement of the safety and health workersprotection into the mining drillingindustries(eleventh particular normativereference according to art.16, paragraph 1 of89/391/EEC)Italian legislation assimilating the directiveD. Lgs. n. 624 25.11.1996

94/9/EU - March 23rd 1994 concerning the legislation re-approach of themember States, relating to the protectionequipment and systems devoted to potentiallyexplosive atmosphere utilisation

94/26/EU - June 15th 1994 adjustment to the technical progress of the79/196/EU Requirement, concerning thelegislation re-approach of the member Statesrelating to electric material devoted topotentially explosive utilisation



1.2.2 ISO, IEC and other national organizations

ISO 10418 Recommended Practice for Analysis, Design,Installation and Testing of Basic Surface SafetySystems for Offshore Production Platforms

ISO 13702 Petroleum and natural gas industries - Controland mitigation of fires and explosions onoffshore installations - Requirements andguidelines.

CEI 64.2 Impianti elettrici nei luoghi con pericolo diesplosione

DIN V VDE 0801 Grundstze fr Rechner in Systemen mitSicherheitsaufgaben (Principles for computersin safety- related systems)

DIN V VDE 19250 Grundlegende Sicherheitsbetrachtungen frMSR - Schutzeinrichtungen (Controltechnology; Fundamental safety aspects to beconsidered for measurement and controlequipment)

HMSO - Depart. of Energy Offshore Installation: Guidance on design,construction and certification - Section 40

ICAO Aerodromi - Annesso 14 alla Convenzionesull'Aviazione Civile Internazionale

DNV TN B 306 Relief, depressuring, flare and cold vent systems

1.2.3 Normative references of other organizations

API RP 2G Production facilities on offshore structures

API RP 14C Recommended practice for analysis, design,installation and testing of basic surface safetysystem for offshore production platforms

API RP 520 Design and installation of pressure relievingsystems in Refineries, Part. I e II

API RP 521 Guide for pressure relieving and depressuringsystems



API RP 607 Fire test for soft - seated ball valves

1.2.4 Legislation

D.M. 31.7.1934 "Approvazione delle norme di sicurezza per lalavorazione, l'immagazzinamento, l'impiego e lavendita di olii minerali e per il trasporto degli olistessi"

D.P.R. 27.4.1955, n 547 "Norme per la prevenzione degli infortuni sullavoro"

D.P.R. 19.3.1956, n 303 "Norme generali per l'igiene del lavoro"

D.M. 9.8.1960 "Modalit per l'effettuazione della prova dicarico relative alla prima verifica della gru dicui al D.M. 12 settembre 1959"

D.P.R. 24.5.1979, n 886 "Integrazione e adeguamento delle norme dipolizia delle miniere e delle cave"

D.P.R. 8.6.1982, n 524 "Attuazione della Direttiva CEE n. 77/576 per ilravvicinamento delle disposizioni legislative,regolamentari e amministrative degli StatiMembri in materia di segnaletica di sicurezzasul posto di lavoro e della Direttiva CEEn.79/640 che modifica gli allegati alla Direttivasuddetta"

D.M. 21.7.1982, n 675-727 attuativi delle Direttive CEE n. 76/117 e 79/196relative a impianti elettrici in aree a rischiod'incendio o di esplosione

D.P.R. 29.7.1982, n 577 "Approvazione del Regolamento concernentel'espletamento dei servizi di prevenzione e divigilanza antincendio"

D.M. 24.11.1984 "Norme di sicurezza antincendio per il trasporto,la distribuzione, l'accumulo e l'utilizzazione delgas naturale con densit non superiore a 0,8"

D.P.R. 4.7.1985, n 461 Recepimento di norme e raccomandazioniICAO per le caratteristiche costruttive deglieliporti



D.P.R. 24.5.1988, n 203 "Attuazione delle direttive CEE n 80/779,82/884, 84/360 e 85/203 concernenti norme inmateria di qualit dell'aria, relativamente aspecifici agenti inquinanti e di inquinamentoprodotto dagli impianti industriali, ai sensidell'art. 15 della legge 16 Giugno 1987 n 183"

D.M. 2.4.1990, n 121 "Norma provvisoria per la protezioneantincendio degli eliporti"

D.M. 12.7.1990 "Linee guida per il contenimento delle emissioniinquinanti degli impianti industriali e lafissazione dei valori minimi di emissione"

D.L. 15.8.1991, n 277 "Protezione dei lavoratori contro i rischiderivanti da esposizione ad agenti chimici,fisici, biologici durante il lavoro"

D.P.R. 18.4.1994, n 526 "Regolamento recante norme per disciplinare lavalutazione dell'impatto ambientale relativa allaprospezione, ricerca e coltivazione diidrocarburi liquidi e gassosi"

D.M. 28.7.1994 "Determinazione delle attivit istruttor ie per ilrilascio dell'autorizzazione allo scarico in maredei materiali derivanti da attivit di prospezione,ricerca e coltivazione di giacimenti idrocarburiliquidi e gassosi"

D.Lgs. 19.9.1994, n 626 "Attuazione delle direttive 89/391/CEE,89/654/CEE, 89/655/CEE, 89/656/CEE,90/269/CEE, 90/270/CEE, 90/394/CEE e90/679/CEE riguardanti il miglioramento dellasicurezza e della salute dei lavoratori sul luogodi lavoro"

Ministero degli Affari "Traduzione in lingua Italiana del testo autenticoEsteri - Disposizione in lingua inglese degli emendamenti allae comunicato n 6 Convenzione Internazionale per la salvaguardia

della vita umana in mare (SOLAS) del 1novembre 1974 adottati dal Comitato disicurezza marittima dell'IMO il 23 maggio1991" (pubblicato sul supplemento ordinarioalla Gazzetta Ufficiale n 91 del 20/4/94)



(pubblicato sul supplemento ordinario allaGazzetta Ufficiale n 91 del 20/4/94)

Ministero dell'Industria "Regolamento concernente i criteri generali perla sicurezza antincendio delle piattaforme fisse estrutture fisse assimilabili", conseguenteall'articolo 49 del D.P.R. 24 maggio 1979, n886

1.2.5 Internal normative references

20257.COO.SAF.SDS Safety location plans

06982.VAR.OFF.PRG Optimisation criteria for platform orientation

07605.VAR.OFF.SPC Offshore platform helideck design

07634.CMP.SAF.SDS Personal safety equipment

07636.MOD.SAF.PRG Safety design criteria of ventilation systems

12304.FFS.SAF.PRG Total saturation extinguishing fixed plants forclosed rooms

20028.FLO.SAF.FUN Totally enclosed lifeboats and relative davits

20029.FLO.SAF.FUN Rigid liferafts

20031.FLO.SAF.FUN Lifebuoys and lifejackets

20184.COO.GEN.SDS Noise control

20190.VOF.SAF.SDS Offhore installation - Positioning of fire and gassensing detectors

20192.VOF.SAF.FUN Offhore installation - Fire proof walls andpartitions

20193.VAR.SAF.SDS Selection of sensors and gas and fire detectioncriteria



20245.LQR.SAF.SDS Accomodations, utilities, helideck modules -Fire extinguishing systems, devices and supplies

20246.OPF.SAF.SDS Oil production platform - Mobile and fixed fireextinguishing systems

1.2.6 References

/Ref. 1/: Det Norske Veritas,Study on Ekofisk platform

/Ref. 2/: KLAASSEN (1971) in G.L. Wells, Safety in process plant designedit. 1980

/Ref. 3/: ACGIH - American Conference of Governmental IndustrialHygienist, TLVs, Threshold Limit Values for ChemicalSubstances in the Work Environment



2. FUNCTIONAL NORMATIVE REQUIREMENTS

2.1 Definitions

The following definitions are valid in this document:

Classified area:

Dangerous area classified according to the substances it can contain and theprobability of flammable mixture developing.

Dangerous area:

Three-dimensional space where there is a dangerous atmosphere, so as definedby IEC 64.2 rules.

ASD - Abandon shut down

Shut down of the whole platform in order to assess the abandon.

EDP - Emergency depressurization:

Plant depressurization owing to ESD, in order to remove fuel from a fire oronly to reduce the pressure of the plant and so the loss extent.

ESD - Emergency Shut Down:

Shut down of the plant or of one area. The causes can be determined by manualgear and/or as a consequence of automatic logic.

Safety systems integrity:

Probability, for a safety related system, to start the safety functions necessary inall the identified situations.

LSD - Local Shut Down:

Members shut down function owing to their own good running (pump shutdown owed to short circuit). The effects produced determine irreversible shutdown (manual reset is necessary for the re-starting).



PSD - Process Shut Down:

Shut down function of process members owing directly to process variables (i.e. feeding pumps shut down of a tank for over level). The effects produceddetermine irreversible shut down (manual reset is necessary for the re-starting).

Hazard:

Probability a determinate undesired event occur within a precise time or inspecific circumstances. Hazard is the product of the undesired event by thegravity of its consequences.

Fire and/or gas detection

Alarm situation, generally determined by a majority voting logic system (exceptfusible plugs systems and some applications on gas), which determines anautomatic intervention according to the provisions of specification20193.VAR.SAF.SDS.Into Units where a the simultaneous installation of two different type of sensorsis provided, for the same danger (i.e. smoke sensors and flame sensors for firedetection), it is defined as:first stage the detection which determines the only intervention of the involvedUnit (i.e. that one relating to the smoke sensors).second stage the detection which operates both on the Unit and on the wholeprocess and/or activates the fire system (i.e. that one relating to the flamesensors)Electric enclosures are an exception, in this case it is defined as:first stage the detection which determines only alarm (i.e. that one relating toonly one of the two loops of majority voting logic sensors).second stage the detection which operates on the Unit and activates the firesystem (i.e. that one relating to each loop of majority voting logic sensors)

Intrinsic safety:

Every proper and fundamental feature of a plant which, for its nature,eliminates or reduces the hazardous situations occurrence without anyunacceptable consequences as impossibility to pursue the general aim of thedesign.

TLV - TWA - Threshold Limit Value - Time Weighted Average

Concentration limit (average on time) to which one worker can be exposed for8 hours a day and 40 hours a week without any injurious consequence (Ref.ACGIH - American Conference of Governmental Industrial Hygienist)



2.2 Operative environment

The safety general criteria for the design of Oil platforms, as required by D.P.R.24/5/1979 n886, however shall consider the environmental conditions of theinstallation place, defined in the design specification.

With this aim all the environmental factors listed below shall be to consider:

- minimum and maximum temperature;- wind velocity and direction;- snow;- presence of polluting and corrosive substances;- earthquakes;- direct or indirect fulmination;- mechanical stress and vibrations due to normal running;- electromagnetic influences.

2.3 Intrinsic safety and prevention strategies

For a certain installation, during each phase of design a study shall be done inorder to identify the hazards coming from:

- location of installation;- well blow out;- collision (ships, helicopters);- earthquake;- fire and explosion type of hazard;- type of fluids on the installation (both process and utility fluid);- environmental conditions;- fluids temperature and fluids pressure;- quantity of flammable material during process and storage;- number, complexity and location of the critical equipment on the plant;- position of installation as to the support assistance systems (helicopters,

support ships, etc....);- production/maintenance strategy and protection levels.

The risks which can come from the future development of the plants during allthe life cycle of the installation shall be identified too.

On the basis of the results of this identification, required also by the laws inforce (92/91/EU Requirement Nov.-3rd-1992), the countermeasures to beadopted on the considered plant, shall be set in order to prevent or reduce theidentified risks.



The countermeasures shall include the necessary devices in order to:

- reduce the occurrence probability of identified risk situations (e.g. use ofequipment in double);

- reduce the extension of the incidents that ca n be supposed (i.e. by usingpassive barriers as fire proof walls);

- reduce the duration of the incidents that can be supposed (i.e. by usingintercepting and depressurising devices);

- reduce the consequences of the incidents that can be supposed (i.e. by usingactive barriers as fire systems).

The countermeasures are set by developing a prevention strategy for the plantbased on the intrinsic safety principles application.These principles, translated into aims and functional requirements of the layoutand the fire and safety systems, are included in this specification.

A qualitative and quantitative study of risk identification can introduceadditional requirements as an integration or partial (conservative) modificationof this specification.

2.4 Safety requirement of the layout

2.4.1 General

The safety aims of the layout are:

- dividing dangerous areas from not dangerous areas;

- dividing areas containing hydrocarbons from areas devoted to: accommodations collective safety crafts; devices necessary to the safety of installation;

- minimising the possibility of accumulation of liquid hydrocarbons andallowing their own quick removing;

- minimising the possibility of accumulation of flammable or toxic gaseskeeping on ventilation without any trouble for workers;

- allowing the control or evacuation of the flammable liquids, in case ofleakage, according to a reference volume or flow;



- locate the different areas in order that an incident into one of them does notrepresent a hazard for the personnel of the other areas;

- allowing the injurious atmospheres dilution, in the open air, till to values notrepresenting a hazard for workers;

- allowing an adequate entry for operations and maintenance;

- allowing at least one of the escape or evacuation ways is ready for use;

- allowing an easy operation of the aero-naval means of transport for healthemergency or plant emergency.

The safety requirements of the layout of the onshore installations are specifiedin the following documents:

- "Regolamento concernente i criteri generali per la sicurezza antincendiodelle piattaforme fisse e strutture fisse assimilabili", following article 49 ofD.P.R. 24/5/1979, n 886

- API RP 2G :"Production facilities on offshore structures"

- ISO 13702 Control and mitigation of fires and explosions on offshoreinstallations

- HMSO - Department of Energy "Offshore Installation: Guidance on design,construction and certification" - Section 40

- Specification 06982.VAR.OFF.PRG "Criteri di ottimizzazione perl'orientamento delle piattaforme"

- Specification 07605.VAR.OFF.SPC "Specifica generale - Progettazione diponte di volo per piattaforme offshore"

The following paragraphs contain some provisions which, although containedinto the above stated codes and specification, are not easy to deduce, except bya careful interpretation of experts into this specific field.

2.4.2 Platform orientation

The orientation of platform shall be realised according to the provisions ofspecification 06982.VAR.OFF.PRG.



The platform shall be realised in order to take advantage from the prevalentwinds and from the ventilation due to temperature gradient, in order that theventilation minimise the accumulation of flammable gas or vapours.

Thus, natural ventilation is to be preferred, although it is not always realisablefor the opposite necessity of a acceptable environment for the personnelswork.

The platform shall be oriented as to the prevalent winds in order to avoid thesmoke coming from possible liquid hydrocarbon fires can flow towards the airinlets of the living quarters and area devoted to personnels evacuation.

2.4.3 Platform areas

A safe area shall be assigned on each platform (out of the classified areas)where shall be placed:

- living quarters;- fire pumps;- emergency power supply batteries;- emergency generators;- life-boats.

Where it is not allowed, the above stated enclosures shall be pressurisedaccording to codes CEI 64-2 and air intakes shall however be outside theclassified areas.

2.4.4 Landing deck

The landing decks shall be placed neither under the decks connecting twoplatforms nor under the mooring vertical of the emergency crafts; one of thelanding decks can be on this vertical if it is considered an emergency deck too(it shall not be used for usual load/unload operation with the crane).

Landings shall supply an adequate approaching course for vessels, that iswindward and against the prevalent direction of the sea

Landings shall be placed in order to reduce the likelihood of interferencebetween vessels and sealines and sub sea cables (e.g. in order to avoid thesealines ploughing by anchors).Landings shall be placed, as far as possible, outside the external area of the 4legs where wells are placed (with the exception of 4 legs platforms).



2.4.5 Cellar deck

When the well work over is made with self contained plants, the cellar deckshall be spread out in area as much as the main deck, if possible, so as toreceive the equipment for well work over without any further fittings.

The deck layout shall be studied in order to minimise the mobilisation times ofthe plant for well work over providing the location of each necessary equipment(pumps, mud basins, electric power supply, etc.).

During operation of well work over, the plane of cellar deck shall usuallyneither be crossed by gas pipes nor contains equipment gas-involved (it isallowed to maintain equipment full of liquid hydrocarbons at atmosphericpressure); in case of simultaneous operations of production/intervention onwells, ad hoc designing and operating devices and a deep safety study are tobe arranged.

Positioning and rotation of the discharge arms shall be realised in order to avoiddispersion of significant gas quantities towards the platform.

When the tip of the discharge arm, on stand-by, is connected with the livingquarters, the arm is to be disconnected from the relevant well in order to avoid afire in well area cause a gas release under the living quarters.

Grids shall be assured one by one and so as, a removal of one of them, not toallow the adjacent ones slipping and raising.

2.4.6 Mezzanine

Mezzanines shall be used, as far as possible, either for operative necessities andfor safety reasons.They can be used particularly for:

- staggering of very high fire hazard in order to reduce their interference ( e. g.well head which shall be positioned lower than the process areas);

- segregating areas with presence of gas (upper level) from areas withpresence of liquid hydrocarbons (lower level).



Eventual equipment placed on the mezzanines shall be over the height of the100 years wave plus an air-gap; equipment that could be into the respect areashould be checked for the relevant wave charges and be considered evaluatingthe total hydrodynamic charge transmitted to the support structure.

2.4.7 Main deck

A real separation shall be done between main deck and cellar deck; it involves:

- closing the plane over the well heads by striped sheet panels provided withsuitable trap doors;

- sealing the crossing holes of the pipes which cross the main deck.

2.4.8 Flares/Vents

Positioning flares and/vents shall consider the following items:

- possible presence of personnel, as to the concentration of the gas emissionand/or to the radiation levels;

- direction of the air traffic (direction of approach to the heliport) and of theship traffic.

2.4.9 Allowed radiation levels

Radiation from the flare and from the vent tower to the main deck, shall not behigher than the following values (including sun radiation):

- 1,5 kW/m2 (500 BTU/hft2) for continuos exposure of not protected personnel(e. g. production test burner or normal operation);

- 4.8 kW/m2 (1500 BTU/hft2) for personnel temporarily on the deck (e. g.crane, helideck) in emergency situations;

- 7 kW/m2 (2200 BTU/hft2) for personnel temporarily on the deck and withshielded escape ways (e. g. entries for equipment maintenance) inemergency situations.



2.4.10 Helideck (heliport)

Heliport realisation shall be in accordance with Specification07605.VAR.OFF.SPC.

2.4.11 Sealine risers and traps

Sealine risers shall have a shut down valve divided from the process areas andshall cross on the opposite side of the living quarters, instrumentation controlroom and at least one of the power generator systems.

In order to avoid damages in case of boats collision, sealine risers shall beinstalled inside the structure of the platform (Jacket), out of the well heads andliving quarters areas.

Outer installation is allowed only for risers on platforms already existing.

If it were necessary sealine risers passing on the outer side of the structure, theyshould be protected by damper systems.If the sealine risers have to pass close to the living quarters, members passingunder the lodgings shall be entirely welded and without any point of possibleleak (flanges, instrumentation, etc.).

In order to minimise the gas volume into the pipes crossing the cellar deck, thefollowing prescriptions shall be observed:

- horizontal launching traps shall have raft-ports towa rds the sea;- traps shall be in order that hazardous gas emission does not flow towards

areas containing ignition sources.

According to the type of platform the following provisions shall be to considertoo:

a) Platforms concerned either by transit and by well: - passing sealines shall be supplied with automatic shut down valves;



- traps shall be placed at least 10 m away from the well heads and hazardous

areas; traps area shall preferably be placed on the main deck or situatedbelow the cellar deck, outside the well area and sheltered from hangingobjects;

- launching and receiving traps shall be supplied with an shut off valve placedbelow the cellar deck connected with the inspection gangway;

- if the traps cannot be placed at a safe distance (i. e. for small unmannedplatform), the above shut off valve shall operate also as an automatic lockvalve, divided from the dangerous areas and fit to maintain its functionalityeven if involved in flames.

b) Platforms concerned only by transit, without wells :

- lock valves can be placed directly on the cellar deck.

2.4.12 Piping

Piping containing flammable and/or toxic fluids shall be placed in order thatpossible leakage do not involve escape ways or ignition sources.

2.4.13 Storage tanks

Hydrocarbons storage tanks can be close to plants or lodgings, provided at least4 m, moreover tanks containing flammable liquids and placed on the cellardeck, shall not be hung up from the deck above, but shall lean on the deck andbe supplied with a control curb and with piped drainage.

The drainage storage tank can be hung below the cellar deck provided it can bereached by a service gangway.

The tanks containing flammable material (i.e. liquid fuel) shall be placed farfrom escape ways and possible leakage shall be collected and piped by suitablecontrol devices.



2.4.14 Electric generators and sub-sea power supply cables

Electric power generators shall be divided from facilities area and one fromeach other by fire walls, in order to save their integrity, so as a electric powersupply is assured to the platform.

The waste of internal combustion engines shall be placed into a safe area andoriented in order to reduce the possibility to involve areas where personnelcould be present.

The sealine risers containing power supply cables shall be placed as far aspossible from the risers containing hydrocarbons and out of the ships course.

2.4.15 Accommodations - utilities - helideck module

The main wall on the rear of the living module shall not be to the winddirection in order the natural ventilation of the hazardous areas is not limited.

Supplementary living quarters, provided on the platform during the well workover, shall fulfil all the safety requirements relevant to the living quarters.

Supplementary accommodations outside the accommodations module are notallowed on platforms that process oil containing hydrogen sulphide.

The day-area shall be completely divided form the night area of the livingmodule and, if possible, be placed on two different decks.

2.4.16 Escape ways

At least two opposite main escape ways shall be provided from each platformarea to the primary evacuation craft (these last two escape ways can becomeone in the space connecting mezzanine or platform lower deck to the landing-deck.

Main escape ways shall not be less than 1 m in width and 2.2 m in height, evenfor doors, passages and stairs.Secondary escape ways, connecting each equipment to the primary escapeways, can be at least 0.8 m in width.



The dimensions of the passages leading to the platform (doors, stairs, galleries)shall be in order to allow easy passage of the personnel supplied with self-breathing apparatus and of operating means in case of anomalous occurrence(transport of personnel by stretcher.In order to size escape ways and considering the necessities of emergencylighting, platforms temporarily or normally manned have to be considered inthe same way.

Closed enclosures, where frequent and constant presence of personnel is likelyto occur, shall be supplied with at least 2 escape ways in accordance with therequirements of Legislation 626/94 and following amendments.The doors of those enclosures shall not prevent the evacuation, all the betweendecks, stairs and passages used as escape ways shall be floored with antislipmaterial and free from any obstacle.

Maintenance manholes shall not be connected with escape ways.Escape ways shall not pass close to the open ventilation area of closed modulescontaining process equipment since, in the event of explosion, these openingcan be used for pressure outlet.

The bridge between two or more platforms is to be considered as an escapeway.

Escape ways and safe area shall be sufficiently lightened even if electric energymain power supply and emergency power supply can fail.

Instrumentation control room, if manned, shall be supplied with escape waysplaced in order that the personnel is allowed to evacuate it in the end.

2.4.17 Evacuation crafts

The primary evacuation craft can be a boat (on unmanned platforms) orlifeboats.Life-rafts shall be considered as one secondary evacuation craft.

Lifeboats shall be placed in order that, with prevalent wind and/or stream, atleast half of them can land and leave the platform without any risk of collisionwith the platform itself.

Life-rafts shall be placed close to the well head area and under the livingquarter module, each of them connected with escape ways; whole capacity ofthe life-rafts shall be 50% of the bed seats (living quarter and supplementaryaccommodations).



2.4.18 Areas classification

The classification of areas is mainly used during selection of electric equipmentin order to minimise the probability of ignition in case of accidental release.

However, into the areas not classified according to D.P.R.24/5/1979 n886(and following amendments), plants shall be fail-safe realised.

The only equipment not fail-safe are those contained into closed andpressurised modules, where gas can come only from the outside.

2.4.19 Areas segregation

2.4.19.1 General

The segregation of areas with a different level of risk can be realised by firewalls whose fire resistance shall be assessed according to the type of fire and onits expected duration.

In order to identify platform rooms according to Regolamento concernente icriteri generali per la sicurezza antincendio delle piattaforme fisse e strutturefisse assimilabili, following art.49 D.P.R. 24/5/1979 n886 (and followingamendments), the specification 20192.VOF.SAF.FUN is to be assumed as areference.

2.4.19.2 Vertical and horizontal segregation

In figure 1 and 2 is shown the reciprocal layout, vertical and horizontalrespectively, of the various platform areas as regards the wind direction.

Where a type of equipment is mentioned more than once time (e.g. separators)it means that different layouts do exist for this equipment.

Letters into the frames show the typology of segregation to be adopted betweentwo areas; where more than one letter is reported it means that more than onealternative can be adopted.



For the interpretation of the layout symbols as above the following legend isvalid.

A = Fire proof deck (according to "Regolamento per la sicurezzaantincendio delle piattaforme fisse...." consequent to art. 49 of DPR n886 and following amendments).

B = Grid panelled deck.C = Fire proof wall (according to "Regolamento per la sicurezza

antincendio delle piattaforme fisse...." consequent to art. 49 of DPR n886 and following amendments).

D = Louvred wall or supplied with pressure outlets (o r blow out panels)whose area is equal to or more than 40% of the total area of the wall.

E = Outside the classified areas (or dangerous according to DPR n886 andfollowing amendments).

F = Safety distance (10 to 15 m) from well heads.(*) Only electric pumps(**) In the event that fire pumps have diesel engines

Main DeckMezzanineCellar Deck

= Ventilation inletsH.P. = High PressureL.P. = Low Pressure



Figure 1 Vertical segregation

Process

A

MAIN WINDDIRECTION

CSafety electriclifting devices

LivingE

Workoverplant

Well heads

A A

C

A

C - GeneratorsA

- Fire pumps- Water

treatmentE

Well

B

UtilitiesC module

- Traps

AAtmospheric

A

tanks for- ESD valves

on (to 15 m 3

1

2

3

manifold

- Traps

B

- Separatorpipe

liquids)

- LivingA

Cquarters

moduleE- Utilities

module

- Atmospherictanks

- Escape ways

quarters

A

Helideckmodule

flammable

CCompressors

A

MethanolInjection

- Gastreatmentplant

- H.P.Separators

Diathermicoilboiler

A

C- Liquid hydr.tanks

- L.P. separat.-pumps

risers

Landing-deck

Flares

Transfer



Figure 2 Horizontal segregation

Well heads

F

C

Traps

CSafety electric

Landing-deckSeparatorpipe

lifting devices

MAIN WIND DIRECTION

Flares

C(**)E

Firepumps

Firepumps

(*)

C

C

D DCompress.

F

Manifold

F

Manifold

C

Gastreatmentplant

C

Transferpumps

Liquidhydrocarbontanks

E

Diathermicoilboiler

C(**)

C(**)E

Firepumps C(**)

Safety electriclifting devices

- Atmospherictanks

- Escape ways

- Atmospherictanks

- Escape ways

Atmospherictanks forflammablesliquids(to 15 m )3

C

C

Processmodule

Landing-deckSafety electriclifting devices generators

Main

- Emergencygenerators

module- Helideck

quarters- Living/Utilities



2.5 Functional requirements of the safety systems

2.5.1 General requirements

The aims the safety systems have to pursue are to:

- locate and check hazardous situations in the smallest area as possible bystarting up shut down and sectioning action of the plants in order to preventdegeneration of anomalous conditions in an accidental event;

- isolate installation from sealines and storage tanks, in order to avoid a plentyof hydrocarbons release;

- minimise the probability of hydrocarbons ignition as a consequence of a lossof containment;

- preventing accumulation of flammable liquids which can create a fire ifprimed;

- giving a continuos automatic monitoring function in order to alert thepersonnel about the presence of a dangerous situation connected to gas orfire and to allow check actions, either manual and automatic, in order tominimise the probability of degeneration of the dangerous situation.

Besides specifications quoted by the text, the requirements of the safetysystems are listed in the following documents:

92/91/CEE Requirement89/392/CEE Requirement92/58/CEE Requirement94/9/CEE Requirement94/26/CEE RequirementISO 13702ICAOD.M. 31.7.1934D.P.R. 8.6.1982, n 524D.M. 21.7.1982, n 675-727D.P.R. 27.9.1982, n 577D.M. 24.11.1984D.P.R. 4.7.1985, n 461D.Lgs. 19.9.1994, n 626

The following paragraphs carry some provisions which, although provided bythe requirements and specifications quoted, are hardly deducible, if notcarefully explained by skilled experts.



2.5.2 Basic criteria

In order to pursue the aims defined as above, the plants design shall be basedon the following fundamental criteria:

- the main feature of the safety systems shall be its simplicity; that assureoperative easiness, awareness of the effects of the undertaken actions,maintenance simplicity and more liability;

- plants design shall be inspired by the principle not to rely completely onsafety systems automatically started up.

- philosophy of the protection systems shall be based on the happening of onlyone event at a time, with believable proportions.On the gas platforms, this event is generally determined by (in accordancewith CEI 64-2 codes): release from stuffing; release form connecting members (flanges, bell and spigot joints, etc.).

In order to limit the release entity, flanges with ring-joint tights shall beadopted in every pressurised part of the plant;

- each sectioning system shall allow, at the same time, a quick remova l of

product which feeds flames or vapours dispersion; this can be done byadopting an interception system upstream and downstream of the leak byshut down valves (SDV-Shut Down Valve) and gas removal bydepressurisation of plant (BDV-Blow Down Valve);

- primary safety of plants is represented by the integrity of all the metal

members and shut down and depressurisation valves.The first rule to be followed is designing all the equipment in a same area, ormodule, for the maximum pressure allowable in that area.

- shut down valves and depressurisation line shall be placed, as far as possible,out of hazardous areas (e.g. out of process module);

- design the installation in order that two coincident failures, reasonablyprobable, dont represent the highest hazard (i.e. the leak of oil and relevantfire dont determine the highest hazard thanks to the presence of drainagesystems and fire walls fit to the duration of release).

- when the GOR (Gas Oil Ratio in Nm 3/m3)is high enough (at least 100

relating to the minimum operating pressure) it is likely to provide a risk ofexplosion into confined enclosures. In this case, the rate between the roomdimensions and vents shall be related so as to determine explosionoverpressures below 30 kPa (300 mbar), eventually by blow out panels.



The choice of 30 kPa as maximum overpressure arise from the followingdata available from specialised literature (G.L. Wells: Safety in ProcessPlant Design): pipe stand: stand strain at 24 kPa, pipe burst and stand breakage at 41

kPa; electric engine: throwing of fragments at 35 kPa, shifting of equipment at

62 kPa; blower: damage to the shell at 35 kPa, destruction at 69 kPa; pressurised separator: shifting of equipment at 83 kPa, destruction at 97

kPa; threshold of serious people injury is 100 kPa;

- checking of safety and fire system of the installation shall be done from onlyone location, in safe and manned or permanently remote-controlled area;

- instrumentation control room, where realisable, shall be supplied with an airventilating system independent from that of accommodations;

- in the platform modules, monitoring system shall be ready to operate even ifnot power supplied.

- in the event of a general platform shut down, electric supply to the

instrumentation control room shall be sectioned lastly in order to verify ,from a remote position, the shut down operations success, before the blackout.

2.5.3 Integrity classes of safety systems

The concept of integrity class and its applicability aspects are derived from DINV VDE 0801 and DIN V VDE 19250 Codes.The integrity class of a safety system defines the type of logic to be providedfor each Plant Unit; the connection between the logic to be adopted and theintegrity class is provided in 20193. VAR.SAF.SDS specification.

The integrity class of safety systems to be adopted in each Unit are listed inAnnex 1 file cards.The integrity class assigned to an Unit can however be changed, whiledesigning, according to the results of the risk assessment, made ad hoc forthat design.If the risk assessment showed, for a plant Unit, a variation of the probability orgravity of event, the new integrity class of safety system, for that Unit, shouldbe immediately defined.



The integrity class, defined in relation to risk assessment of more frequentoccurrence, groups all the platform Units into 4 Categories, defined asfollowing:

Category I - includes those Units where each event causes critical consequences for platform.

Category II - includes those Units where each event causes critical consequences only for a wrong operation of the shut down system.

Category III - includes Units, not critical but connected with other Units belonging to previous categories which can transmit consequences of certain events.

Category IV - includes not critical or safe Units.

Conditions of more frequent occurrence give the following summary:

Category Unit Integrity class

I Well headGas treatment plant

4

II SealinesPassage waysOil separationOil pumpingManifoldGas compressionMethyl alcohol injectionChemicals injection

3

III Combustible gasWater treatmentHeatingCompressed airMain power generationEmergency power generationE.E. main supplyE.E. emergency supplyControl systemAir conditioning plant

2

IV Combustible gas oilHydraulic powerAccommodations ModuleSolid state U.P.S.

1



2.5.4 Requirements of pressurised systems

All the systems containing pressurised hydrocarbons shall be supplied with twoprotection barriers against high pressures.Each barrier shall have a capacity of 100% and the two barriers shall not beintercepted simultaneously.The equipment (separators, etc.) and piping connecting with the wells shall bedesigned for the following pressures:

a) well dinamic pressure: if are present at least two independent barriers againsthigh pressure;

b) well static pressure: if only one barrier against high pressure is present (i.e.,class of pressure).

2.5.5 Requirements of shut down and depressurization systems

2.5.5.1 Depressurisation

The depressurisation system shall be designed according to API RP 520 andAPI RP 521 considering the most restrictive condition, stated in DNV TN B306 Codes, as a reference parameter.

Particularly, pressurised systems containing flammable or toxic gas, shall besupplied with a EDP (automatic or manual) system. In the emergency event,this system shall be able to remove gas so reducing pressure value under 50%of the minimum operating value in 5 minutes; during the next 10 minutespressure value shall reduce to 0.7 MPa (7 bar).

Smaller depressurisation times shall be allowed by previous check of theradiation from flare, if fired.

Section of plants containing up to 100 kg of natural gas does not requiredepressurisation /Ref.1/.The vessels containing liquid hydrocarbons shall be supplied with anemergency system if operate over 0.3 MPa (3 bar) /Ref.2/.

The requirements of depressurisation systems are as follows:

- automatic depressurisation line which shall flow into a manifold ending witha blow down valve (BDV) associated to the platform general shut down;

- the depressurisation line shall be supplied with a device in order to avoid thebackfire from flare;



The cooling effect during depressurisation shall be carefully evaluated, both forautomatic emergency depressurisation and for manual depressurisationon, taking into consideration the minimum operating temperature of the gas.This allows the choice of materials and the dimensioning of the involvedequipment.

When gas and vapour continuous emission into atmosphere contain toxicsubstances, the dimensions of flare/vent shall assure, even in hard conditions, atoxic gas concentration close to the platform decks, below the tolerability limitvalue (TLV - TWA) /Ref.3/.

The flare tip shall be supplied with pilots and each of them shall have a flamedetector to signal the lack of flame.

On towers or raised structures which can not be easily left, stairs shall be placedon the opposite side of the flare in order that the structure itself can perform,although partially, the screen function.

2.5.5.2 Shut down and shut off valves

The following prescriptions shall be adopted:

- surface safety valves shall be fire safe, for example metal gasket valves orsoft tight ball valves according to API RP 607;

- shut down valves shall fail-safe, that is fail-close.

- valve feeding gas oil to emergency generator shall be outer the enclosurescontaining users;

- gas oil shut down valve shall be enslaved to flame sensors into the engineroom;

- valve as above shall be manually operated too;

- gas engines shall have a stop and by-pass manual gear placed also outdoorthe deck rooms.



2.5.5.3 Instrumentation air and pneumatic systems

Air as one operating fluid for pneumatic instrumentation is the safest and mostreliable system.

For the safety sub surface valves (SSSV) operation, a pneumatic system shallbe adopted, that can be expanded to all shut down valves when an aircompressed air system in not available (low energy platform).

2.5.6 Requirements of platform automation system

2.5.6.1 General

Platform automation system (hereinafter called system) shall determine, ifcan occur:

a cause induced by a:

- manual action;- automatic action (activation of gas, smoke, flame, explosive mixture, toxic

gas sensors and starting of a section of the process equipment). an effect of:

- visual and/or acoustic signal into the instrumentation control room and in theinvolved areas;

- control of plants (electric, equipment, ventilating, conditioning, fire-fightingand production plants).

Philosophy of the operating controls shall be defined in order to limit the shutdown actions only to the plants and/or members where cause originated, inorder to obtain a better operative treatment of the platform.

System shall be designed and realised in order that:

- control and shut down functions are independent on each others: thisindependence can concern the mechanic element (valve) or instrumentationsection (sensors, actuators, connections) or, in particular situations, both.If interfaces between control and shut down functions are provided, failuresor wrong operation of control system shall not interfere with the rightoperation of the shut down system.

- the concept of failure to safety is complied;



- the equipment redundancy is optimised either relating to the wholeavailability of the system and to the out of order possibility for failure of acomponent;

- every intervention of detection and/or shut down circuits is signalled withthe alarm dedicated to the area, by visual and acoustic alarms both on theplatform and into the onshore control room;

- manual reset is possible only after the removal of shut down cause;

- shut down sequences can not be started up accidentally;

- during the maintenance and test operations protection can be reset as soon aspossible;

- maintenance and reliability test operations can be done previous bypass ofthe automatic shut down control;

- activation of the input and output circuits bypass or the shut down sequencesshall be allowed by the instrumentation control room operator; everyexclusion shall enable inactivation of only one safety operation and shall bevisually signalled on the same instrumentation control board or eventuallyon local panels;

- a failure of the normal feeding system operates automatic switching, withoutblack-out, over a reserve power supply; wrong feeding operations shall besignalled by acoustic and visual alarms;

- it is protected against electromagnetic interference;

- equipment and cables are adequately protected; cable pathways are realisedin order to limit their involvement in possible accidental situations;

- manual actuating points of the system are clearly identified.

The system shall consist of a AUTOMATISM CONTROL BOARD andSAFETY BOARD installed into the instrumentation control room; actuatingcontrols of the system shall be remote started up, by a remote controlledsystem (RTU) too.



2.5.6.2 Shut down systems

Shut down system is designed in order to divide plant into sections; divisionfollows the priority levels determined by the importance of the situation causingshut down.

In particular, the highest priority level (ASD) is associated to the wholeplatform (process area, utilities and electric units); the next level (ESD) isassociated to process areas and utilities on the whole; other levels (PSD andLSD) are associated to plant sections.

Shut down systems to be provided as to each Unit, are stated in Annex 1 file-cards.

Hierarchy of shut down level and correlation between various plant and utilityUnits is stated in Annex 2.

2.5.6.3 Abandon shut down command (ASD)

The abandon shut down command shall determine irreversible shut downs(for the re-activation a manual reset is necessary) and shall determine thefollowing actions:

- activation of the emergency shut down (ESD);- shut down of the main power generator and emergency power generator;- feeding of the vital electric appliances by emergency batteries;- activation of AS1 signal for manned platform.

The abandon shut down command shall be started from manual stationswhich shall be placed at least in the following areas:

a) Head of Platforms office;b) close to life boats;c) close to the helideck.

If operated, these manual control stations shall maintain the condition assumedand be interfaced with ESD system.

A reset device and a mechanical protection devoted to prevention of accidentalstarting shall be provided.



2.5.6.4 Emergency shut down (ESD), for fire presence

The emergency shut down command, for fire presence, shall determineirreversible shut down (for the re-activation the manual reset is necessary) andactions provided in Annexes 1 and 2:

The emergency shut down shall be operated:

a) automatically, by electric appliances stated in Annex 1;

b) manually

- by local manual valves quick device (1/4 of turn) connected with airinstrumentation circuit (for heat sensors of pneumatic type);

- by electric push-buttons (for heat sensors of electric type);- from onshore control room, by remote control (with double s eparated

control, for redundancy).

Manual starting systems of platform shall be placed close to escape ways fromvarious decks and connected with landing-decks of the life boats.Manual starting systems shall thus so distributed:

- n1 near each flight of stairs of the main deck;- n1 on each flight of stairs of the cellar deck;- n1 near each life boat;- n1 on the breaker of each of the two stairs leading to landing-decks;- n1 on each of the two galleries under the helideck, near the fire fighting

groups.

All the devices, with the exception of those relevant to the two last items, shallbe installed on proper manual emergency stations.

2.5.6.5 Emergency shut down (ESD), for gas presence

The emergency shut down command, for gas presence, shall determineirreversible shut down (manual reset) and actions provided in Annexes 1 and 2:

The emergency shut down shall be operated:

a) automatically, by electric appliances stated in Annex 1;



b) manually

- from Head of Platforms office;- from onshore control room, by remote control (with double separated


2.5.6.6 Production shut down (PSD)

The production shut down command shall stop production process of theplatform, according to what provided in Annexes 1 and 2.

The production shut down shall be operated:

a) automatically

- by emergency shut down system (ESD);- by significant deviations from usual operative conditions of the physical

quantities during critic situations (lack of air instrumentation, electricsupply failure, high or low pressure into the production manifold, verylow level into the glycol storage unit).

b) manually, by dedicated push-buttons:

- from the Head of Platforms office;- from the electro-pneumatic lock panel of the process module;- from onshore control room, by remote control (with double separated


2.5.6.7 Local shut down

Deviations from usual operative conditions of the non critic quantities shallstart shut down or intervention on the only involved equipment. In particular,the positions are quoted as follows.

Heat detectors of gas oil tank/pumps

The opening of the automatic deluge pneumatic valve, with followingactivation of the fire system, is determined by:

a) automatically- by intervention of heat detectors placed to protect gas oil tank/pumps;

b) manually

- operating a device connected to the heat detection system.



Manual operated device and control of the deluge valve shall be placed on thecontrol board of the cooling water on the tank itself.

Intervention of the heat detection system shall induce the gas oil pumps lockingtoo.

If the gas oil tank is placed close to process equipment, the intervention of heatdetection systems of the gas oil area shall be associated to that one of platform.

Unsuccessful shutting of the liquids discharging valve from separators

Wrong operating shall be detected from the low level switch (LLS) into theseparator: that will cause the automatic lock of the shut down valve (SDV forliquid discharge) and lock of the separator itself.

Low pressure into the separator

Anomaly shall be detected from the low pressure switch into the separator: thatwill cause the relevant production string by driving the following valves:

- closing the well head wing valve;- closing the surface safety valve (SSV);- closing the shut down valve;- opening glycol recycling.

Flow switches

The gas flow into the system quoted above shall be detected by flow switches;their intervention cause platform alarm and signal to the heliport (flashing redbeacon):

- process automatic depressurisation;- fuel gas depressurisation;- safety valves manifolds

K.O.Drum high level

The condensation separator of the automatic depressurisation system connectedto the flare shall be supplied with at least one high level switch which, whenactivated, starts the production shut down.



2.5.6.8 Man overboard command

This command shall operated by means of manual control stations which willbe placed in each of the following areas:

- n1 near each flight of stairs of the main deck;- n1 near each flight of stairs of the cellar deck;- n1 near each life boat;- n1 on the breaker of each of the two stairs leading to landing-decks;- n1 on each of the two galleries under the helideck.

Operating every manual control station will start the AS2 signal.

2.5.6.9 Fire command

This command shall be operated by manual control stations into theaccommodations and utilities module, placed close to the exits of each deck(two for each deck).

These stations will start either general acoustic platform signals and visualsignals into noisy rooms and determine stop of the vents of theaccommodations/utilities module.

Manual control stations placed on the supplementary accommodations deck,even starting the acoustic/visual signals above stated, will not cause ventilationstop unless the conditioning plant isnt placed on the same deck.

2.5.6.10 Manned-unmanned platform condition

It shall be operated by a manual switch on the automatism control board, intothe instrumentation room and/or into the Head of Platforms office.

Switch turned on UNMANNED position shall exclude power supply toappliances not necessary for platform working.In this situation floors of the accommodation module will be completelydisconnected (with the exception of the refrigerators).

During unmanning all the monitoring systems shall be operating even ifequipment into the monitored room are disconnected.



2.5.6.11 Interventions and locks

Operations started by platform automatism local system (included those relatingto the onshore control room) will concern the following pertaining utilities:

- lock control of electric plant;- lock control of instrumentation plants;- lock and starting control of air ventilating and conditioning plant;- lock control of production plant;- starting control of fire system. Those plants shall be remote controlled too.

From the onshore control room shall be possible to:

- drive the extinguisher discharge into the enclosures protected by a floodingsystem;

- start the fire pumps.

2.5.7 Requirements of monitoring systems

2.5.7.1 General

The detection system to be provided as to each Unit requirements, is stated inAnnex 1.

Criteria for the choice of type of sensor and intervention logic to be used arespecified in 20193.VAR.SAF.SDS. Specification.

Criteria for determining number and position of sensors are specified in20190.VOF.SAF.SDS. Specification.

2.5.7.2 Heat sensors

Heat sensors shall be provided for:

- detecting oil fires presence under the equipment;- reducing the fire spreading by a shut down and depressurisation action;- shutting the sub sea safety valves (SSSV) (in this event the heat sensors shall

be pneumatic sensors).



2.5.7.3 Smoke sensors

The smoke sensors shall be installed in order to :

- detect fire into closed rooms in its early stage;- detect fire with feeble flame and heat growth (electric fires);- detect smoke at the inlets of the air ventilating recycling of the living

quarters;- disconnect circuits which feed fire and start (eventual) fire fighting plants

except for engine rooms where smoke is not a sure sign of fire.

2.5.7.4 Flame sensors

The flame sensors shall be installed in order to :

- detect fire into closed rooms when bright flame or low smoke emissionflame prevail;

- detect bright flame fires or electric fires outdoor, replacing smoke detectors;- detect electric arcs and sparks able to cause fires;- disconnect circuits feeding fire and start the (eventual) fire plants into all the

rooms where they are installed.

2.5.7.5 Flammable gas sensors

Flammable gas detection is required in order to alert and/or automaticallyintervene before gas concentration in air can reach the lower explosivity limitwhich represents, when properly fired, an hazardous situation both forpersonnel and for equipment.

Flammable gas sensors shall therefore be provided to:

- monitor flammable gas accumulation into the eventual release area;- monitor flammable gas migration towards not dangerous areas;- monitor ingress of flammable gas into closed areas not dangerous but face to

dangerous areas;- reduce the gas quantity to the flammability limits by a shut down action.

Monitoring shall privilege those areas where the possibility of flammable gasaccumulation exists, situation with the highest safety hazard.



No gas monitoring is required on the combustion air duct of the enginesprovided that an overspeed protection device to start the machine shut down if agas ingestion may occur.

2.5.7.6 Toxic gas sensors

The toxic gas detection is required in order to alert and/or automaticallyintervene before gas concentration in air can exceed the toxicity limits providedfor occupants and environmental protection.

Toxic gas sensors shall therefore be provided to:

- monitor toxic gas accumulation into the eventual release area;- monitor toxic gas migration towards other areas;- monitor ingress of toxic gas into closed areas not dangerous but face to

dangerous areas;- reduce the gas quantity of the place by a shut down action.

Monitoring shall privilege those areas where the possibility of toxic gasaccumulation exists, situation with the highest safety hazard.

2.5.8 Requirements of signalling, communication and alarm systems

The signalling, communication and alarm system shall be considered as a vitalsystem for the electric supply.

Alarm signal on platform and into the connected places will be done as follows.

On the unmanned or discontinuously manned platforms or where the night shiftis not provided, every fire presence shall be signalled to a manned platform orashore, from where shall be possible to remote-control acoustic alarm on theinvolved platform.

2.5.8.1 Visual and/or acoustic signals on instrumentation control panels

a) Instrumentation control roomControl panel will receive:- manning signal;- unmanning signal;- platform abandon signal, with reset;



- man overboard signal, with reset;- gas and fire detection systems signal (failure, pre-alarm and alarm), with

reset;- failure signal of the safety panel systems, with reset.

b) Head of Platforms Office

Alarm repeating control panel will display each alarm areas (heat, smoke,flame, explosive mixture and toxic gas) and receive:- manning signal;- unmanning signal;- platform abandon signal, with reset;- man overboard signal, with reset;- intervention signals for fire (heat, smoke, flame) and/or (flammable,

toxic) gas, with reset;- failure signal of the safety panel systems, with reset.- summarising signal for unsuccessful pressurising of engine rooms or

control panels.

From the Head of Platforms Office shall be possible start the followingcontrols:

- platform abandon;ESD;- production shut down;- fire pumps turning on.

c) Platform operator stationThe station will be supplied with control board and summarise all the safetyand process signals.

d) Onshore control roomSignals of failure/pre-alarm/alarm of the detection systems will betransmitted onshore, by remote-control; signals will be underlined for eachplant area.Shutting (or opening) the shut down or depressurisation valves will beunderlined as a limit switch condition to be installed on the valves; limitswitch simultaneously open and shut will show an alarm situation.Limit switches will be installed on the shutters of the various rooms in orderto underline their opening or closing condition.

2.5.8.2 Visual and/or acoustic signals on electric boards

Local control panels shall be involved by visual/acoustic signals of the safetysystems relating to equipment.All the safety systems detection shall be however transferred on theinstrumentation control panels of the following subparagraph.



2.5.8.3 Visual signal into noisy rooms

Into the noisy rooms, stated according to D. L. 15/8/91, n277, red flashinglights shall be placed; these lights shall be turned on for:

- intervention of manual control of platform abandon, fire and man overboard;- safety plug intervention;- failure of smoke detection systems;- smoke pre-alarm;- smoke alarm;- failure of flame detection system;- flame pre-alarm;- flame alarm;- failure of explosive mixture detection system;- explosive mixture pre-alarm;- explosive mixture alarm;- failure of toxic gas detection system;- toxic gas pre-alarm;- toxic gas alarm;- flow switches intervention.

All the signals started by local control panels of the inert gas fixed fire plantsshall be added to the signals specified as above, that is:

a) into the room- red flashing signals: ABANDON ROOM, made with xenon tube high

intensity lamps.

b) out of the room- green signal lamp EXTINGUISHING SYSTEM INCLUDED;- red signal lamp EXTINGUISHING SYSTEM EXCLUDED;- red signal lamp DO NOT ENTER (this one shall flash if discharge is

imminent and be continuously light on when discharge is occurred).

2.5.8.4 Emergency signal signboard

A summarising signboard of platform alarms shall be placed in each of theseareas:

- near each flight of stairs of the main deck;- near each flight of stairs of the cellar deck;- near each life boat;



- on the breaker of each of the two stairs leading to landing-decks;- on each of the two galleries under the helideck.

On the above stated signboards shall be displayed descriptions of platformacoustic signals (operative for manned platform).

2.5.8.5 Lights for heliport alarm

The lights for alarm close to helideck shall be two, a green flashing beacon anda red flashing beacon.

Signals of lights switch on, failure of themselves or failure of lighting systemshall be transmitted to onshore control room.

In the following situations flashing green beacon (FGB) shall be switched on:

- failure of smoke sensors (single sensor or system of sensors);- alarm to smoke sensors;- failure of flame sensors (single sensor or system of sensors);- pre-alarm to flame sensors;- alarm to flame sensors;- intervention of heat sensors (safety plugs)of gas oil tank;- manual fire alarm of living quarter.

In the following situations flashing red beacon (FRB) will be switched on:

- platform abandon;- emergency shut down;- production shut down;- intervention of heat sensors (safety plugs) of well head area and of process

module;- failure to explosive mixture sensors or detection channels;- pre-alarm to explosive mixture sensors;- alarm to explosive mixture sensors;- failure to toxic gas sensors or detection channels;- pre-alarm to toxic gas sensors;- alarm to toxic gas sensors;- very high level to the liquid accumulator of the flare;- lack of flame in flare.

These beacons shall be placed on the heliport space not forbidden to obstaclesand so as to be seen by pilot from every deck-landing directions.



2.5.8.6 Acoustic alarms

The acoustic alarms shall be audible from every point of the platform.

The execution of all the outdoor loudspeakers shall be right for the type of theclassified area. Indoor loudspeakers shall be normally executed (supplementaryaccommodations deck is to be considered outdoor).

Into the noisy rooms acoustic alarms shall be replaced by visual alarms with redflashing lamps.

Standard acoustic signals are the as follows:

- AS1 (HORN)

this is the acoustic signal of platform abandon, it corresponds to a continuossound with a frequency 450 Hz;

- AS2 (YEOW)

this is the acoustic alarm signal for man overboard, it corresponds to abitonal decreasing sound with frequency 1200600 Hz, repeated every 1.5 s;

- AS3 (YELP)

this is the acoustic signal for explosive mixture detection (or operatingdepressurisation or detection of gas vent to flare), it corresponds to a quicksiren sound (6001250 Hz) repeated every 0.25 s;

- AS4 (SLOW WOOP)

this is the acoustic alarm for fire , it corresponds to a bitonal increasingsound (5001200 Hz) repeated every 4.1 s.

2.5.8.7 Telecommunications and radio equipment

Telecommunication system and radio equipment shall be realised according toD.P.R. 24/5/1979 n886 and shall include:

- n.1 aeronautic VHF;- n.1 1

05887e01

Documents

sar mostrato

terzi n sar utilizzato

normative references

scopi diversi

i quali stato inviato

european normative references1

internal normative references1

propriet dellagip