21089232 offshore qra guidelines

QRA METHODOLOGY FOR SHELL EXPRO

INSTALLATIONS

Shell U.K. Exploration and Production QRA Methodology for Shell Expro Installations

Report No: CL4172-RP-305 Rev 1 Issue Date: October 2004

Page ii

TABLE OF CONTENTS

1. INTRODUCTION ......................................................................................................1

1.1 General .......................................................................................................................1 1.2 Platform Variations .....................................................................................................2

2. INFORMATION REQUIRED TO CONDUCT THE QRA........................................4

3. HYDROCARBON HAZARD IDENTIFICATION.......................................................5

3.1 Description of Identification Process..........................................................................5 3.2 Link to Safety Case MAH............................................................................................7

4. HYDROCARBON RELEASE FREQUENCIES .......................................................8

5. HYDROCARBON OUTFLOW CALCULATIONS..................................................15

5.1 Inventory Calculations ..............................................................................................15 5.2 Hydrocarbon Outflow Rates .....................................................................................16

6. HYDROCARBON RELEASE CONSEQUENCES ................................................21

6.1 Gas Dispersion - Enclosed / Open Areas................................................................21 6.2 Gas Jet / 2-Phase Fires ...........................................................................................23 6.3 Fireballs ....................................................................................................................24 6.4 Pool Fires .................................................................................................................24 6.5 Compartment Fires ..................................................................................................27 6.6 Flash Fires................................................................................................................30 6.7 Sea Fires ..................................................................................................................30 6.8 Explosions ................................................................................................................30 6.9 Smoke Modelling ......................................................................................................33 6.10 Heat Stress Modelling...............................................................................................38

7. IGNITION MODELLING .........................................................................................40

8. FUNCTION OF SAFETY SYSTEMS.....................................................................44

8.1 Reliability of the Safety Systems..............................................................................44 8.2 Effectiveness of Safety Systems.............................................................................49

9. ESCALATION POTENTIAL ....................................................................................51

9.1 Gas Spreading To Other Areas................................................................................51 9.2 Explosion Escalation / Exceedance Methodology....................................................51 9.3 Fire Escalation..........................................................................................................69 9.4 Smoke Escalation ....................................................................................................70 9.5 Sea Surface Pool Fire Escalation ............................................................................70 9.6 Escalation From Leg Releases................................................................................70 9.7 General Rule Sets for Escalation.............................................................................71

10. IMPAIRMENT CRITERIA........................................................................................73

10.1 Impact Assessment for Personnel...........................................................................73 10.2 Safety Function Impairment Criteria.........................................................................75 10.3 Temporary Refuge Impairment Criteria ...................................................................76 10.4 TEMPSC Impairment Criteria...................................................................................77

11. HYDROCARBON FATALITY CALCULATIONS ...................................................78



Page iii

11.1 Introduction...............................................................................................................78 11.2 Event Tree Module....................................................................................................80 11.3 Frequency of Temporary Refuge and Evacuation Systems Impairment ................86 11.4 Presentation of the Risk Calculations ......................................................................86

12. NON-HYDROCARBON RISKS TO PLATFORM AND PERSONNEL................88

12.1 Occupational ............................................................................................................88 12.2 Structural Failures ....................................................................................................89 12.3 Seismic Failure.........................................................................................................89 12.4 Ship Collision............................................................................................................90 12.5 Dropped Objects ......................................................................................................93 12.6 Turbine Failure / Missile Impact................................................................................95 12.7 Transport to and From the Installation .....................................................................96

13. SENSITIVITY ASSESSMENT ................................................................................99

13.1 Introduction...............................................................................................................99 13.2 Leak Frequency Model .............................................................................................99 13.3 Platform Specific Leak Frequency.........................................................................101 13.4 Ignition Model ..........................................................................................................101 13.5 Safety System Reliability........................................................................................101 13.6 Deluge Effectiveness .............................................................................................102 13.7 Explosion Exceedance Curves ..............................................................................102

14. REFERENCES......................................................................................................103

APPENDIX A: EQUIPMENT COUNT METHODOLOGY

APPENDIX B: TOPSIDES RELEASE FREQUENCY DATABASE

APPENDIX C: RISER RELEASE FREQUENCY DATABASE

APPENDIX D: BLOWOUT RELEASE FREQUENCY DATABASE

APPENDIX E: FATAL ACCIDENT RATE DATA

APPENDIX F: EXPLOSION EXCEEDANCE PROBABILITY SAMPLE CALCULATION

Shell U.K. Exploration and Production Page 1 QRA Methodology for Shell Expro Installations


1. INTRODUCTION

1.1 General

This document describes the procedure followed in performing quantitative risk analysis of the following Shell Expro Asset’s :

− Brent – Brent Alpha, Bravo, Charlie, Delta and subsea tie-back Penguins;

− CADA/TENC – Cormorant Alpha, North Cormorant, Tern, Eider, Dunlin and subsea tie-backs Pelican, Hudson, UMC, Kestrel, Otter, Osprey and Merlin;

− Mature Assets – Fulmar, Auk, Kittiwake, Anasuria, Nelson and subsea tie-back Mallard;

− Gannet and Central Graben – Gannet, E&F, Mandarin and Shearwater.

The methodology was developed over a number of years for the safety support of Shell Expro platforms. This particular methodology primarily reflects the approach taken to QRA for the Safety Case re-submission for the Brent and CADA/TENC Assets. However, the majority of this methodology is also applicable to the Mature Assets and Central Graben. Where there are slight differences in the methodology applied to these assets then these are highlighted in this report and summarised in Section 1.2.

The purpose of this report is to record the methodology currently used which will then enable a joint Shell Expro / Atkins review to bring the approach up to date with more recent industry knowledge and consequence assessment.

The methodology itself follows a number of clearly definable stages, which are described next :

− Hydrocarbon risks :

1. Identify hydrocarbon inventories and calculate the frequency and size of outflow rates from accidental breaches;

2. calculate the probability of the release igniting and resulting in a fire or explosion;

3. consider how failure of the protective systems (e.g. fire and gas, ESD, deluge etc) may influence the severity of the consequences;

4. calculate the probability of initiating event severity and associated combinations of protective system failure;

5. consider whether events may escalate by involving other process inventories either in the incident module or beyond;

6. calculate the level of fatality resulting from the immediate effects of the incident;

7. consider whether personnel can be trapped without access to the TR;



8. consider whether TR and platform evacuation fatalities are affected by the incident (explosions, thermal radiation, unignited gas, structural failure, smoke etc);

9. considering the availability of the TR and escape routes (as a function of time) ascertain what level of fatality results, either within the TR or during the evacuation process;

10. express fatality levels as a function of incident type and employment category, considering both individual and societal risk.

− Other risks :

1. identify other risks (occupational, travel, ship collision, structural, seismic and turbine failure);

2. calculate frequency and consequence;

3. calculate fatality levels in a similar way to 10 previously.

1.2 Platform Variations

Where there are differences in the approach used for the various platforms then there are highlighted in the text and summarised in the table next. These variations occur for a number of reasons :

− The platform has not yet been updated to reflect the current methodology;

− A specific assessment has been completed for a particular platform and will therefore be used in preference to the generic data.

As the platform QRA’s are revised and updated then the only variation across the platforms will be where specific assessment have been conducted. It is unlikely that these variations will ever be removed as they ultimately provide the particular platform with a better representation of the risks.

Section Platform Variations

4.1.2.2

Blowout Frequencies

All installations use the BlowFam 2000 blowout frequencies [5] except Shearwater which uses a specific Scandpower study [6].

5.2.1

Blowdown Orifice

Where isolation between inventories fails then the Shearwater model takes account of the two potential blowdown routes, i.e. the isolated and unisolated inventory routes, when calculating depressurisation of the inventory. All other models only account for depressurisation through the relief orifice on the isolated system.

Table 1-1 – Platform Variations In The QRA Methodology



Section Platform Variations

6.1

Module HVAC Shutdown

The Brent, CADA,TENC and Nelson models account for the possible change in gas build up as a result of mechanical ventilation shutting down on gas detection, where this actually occurs on the platform. Where mechanical ventilation is provided on the other assets then it is assumed that the ventilation will continue to run on gas detection.

6.9

TR Leakage Rate

The Brent, CADA and TENC assets assume a TR leakage rate, for the assessment of smoke build up within the TR, of 0.5 ACH. The leakage rate for the TRs on other assets is based on actual leakage tests that have been carried out.

8.1.3

Isolation / Blowdown Failure

The QRA models for the Brent, CADA, TENC and Nelson assets assess the consequences of isolation and / or blowdown failure resulting in 4 possible isolation / blowdown outcomes. The other models only assess isolation / blowdown operating and then the worst case of isolation or blowdown failure resulting in fewer outcomes on the RISKMODEL event trees.

9.2.2

Severity Index Factor

Only the Goldeneye installation applies a factor of 2 to the the overpressure severity index when calculating the probability of failure from explosions. For all other assets, the severity index is not factored.

9.2.4

Extended Exceedance Curves

Where generic explosion exceedance curves are used then the Brent, CADA, TENC and Nelson assets use the extended exceedance curves. All other assets use the standard generic exceedance curves where predicted overpressures below the design overpressure are definitely not taken to result in failure.

12.1

Occupational Risks

With the exception of Goldeneye, all installations use up-to date occupational hazard data. These installations also include a proportion of risk for offshift activities whilst personnel are in the living quarters.

Table 1-1 – Platform Variations In The QRA Methodology (cont)



2. INFORMATION REQUIRED TO CONDUCT THE QRA

Before the QRA can be started an information gathering session is required. This should ensure that all the required information is available at the start of the assessment and will reduce the possibility of the assessment being held up at a later stage. A list of the main pieces of information required is given next :

− Up to date layout, elevation and plot plan drawings;

− Process and Instrumentation Drawings (P&ID’s);

− Process Flow Diagram (PFD);

− Safeguarding System Flow scheme;

− PRO II or HYSYS process simulation data reflection current offshore process;

− Cause and Effect drawings including ESD and F&G Functions;

− Escape route drawings;

− Fire and Explosion Structural consequence analysis reports;

− Offshore survey;

− Offshore workforce personnel distribution;

− Current Safety Case;

− Details of any previous explosion analysis;

− Details of other safety specific studies, modifications or projects likely to have an impact on the QRA.



3. HYDROCARBON HAZARD IDENTIFICATION

3.1 Description of Identification Process

Most of the fire hazards on board a hydrocarbon processing offshore installation arise from the process itself. Hydrocarbon releases are possible from any section of the process from the wellheads to the export pipelines. On detection of an oil or gas release, the process is automatically shut down and isolated by means of the emergency shutdown valves (ESDVs) which are located throughout the process train. For this reason, the hazard identification process treats each isolatable section of plant as a distinct hazard. Figure 3-1 below demonstrates how these isolated inventories are defined.

Mixed Phase

Gas

Gas

Liquid

OilWater

Inventory Boundary

Figure 3-1 – Definition of Hydrocarbon Isolated Inventory

It should be noted that in certain instances, particularly for mature installations, vessels may not be isolated from one another by ESDVs but the normal action of process control valves would act to isolate the vessels. The control valve may not necessarily provide complete isolation between two vessels, particularly if the release rate is small and the level in the vessel drops slowly. Even for larger release rates, the LCV may take some time to fully seal and therefore the inventory from an adjacent vessel may also be released before isolation is achieved. For this reason, LCVs are generally not taken to be points of isolation, unless the valve can be shown to have a similar performance to an actuated ESDV.

Reference to the appropriate cause and effect diagrams and P&IDs will determine the action of certain valves to different process alarms and trips.



Non-return valves (NRVs) in process lines may prevent significant backflow from downstream process vessels or pipelines if they function as designed. For leaks downtream of the NRV, however, they will not provide isolation for inventories upstream of the NRV. As for LCVs leakage past an NRV is possible, particularly for oil releases. Therefore, NRVs are not taken in the QRA as providing positive isolation unless their performance can be assured by regular testing and maintenance.

3.1.1 Definition of Hydrocarbon Events

In general, each isolated inventory is assigned an identification number, description and location. These events are generally labeled, A1, A2 etc with the description of the event identifying the equipment item or system being considered. In some cases, for example in the system shown in Figure 3-1, the event may be further defined as two separate events to model an oil or gas release i.e. A2G and A2L.

Apart from considering the release of hydrocarbon from the module that contains a particular process vessel, the potential for a major release in other modules due to the routing of process pipework should also be considered. Hence, a single isolated inventory may be located in more than one module and therefore designated as more than one hydrocarbon event. In some cases, it may not be necessary to split out the inventory into different modules, particularly if the amount of equipment in one of the modules is small and the consequences less severe than the main module location.

The event identifiers in this case would show the inventory and module location i.e. A1-M3 and A1-M4, show inventory A1 spread over modules M3 and M4.

3.1.2 Loss of Isolation

Each hydrocarbon event will have an inventory associated with it and two or more isolation valves bounding the system. Failure of any one of these valves may result in additional inventory being released from adjacent processing vessels, wells, risers etc. The QRA considers the unisolated release to include one adjacent inventory. This is typically the largest adjacent inventory, but will also consider the constraints of the process as to which inventory is actually released. For example, the largest adjacent inventory to a separator may be a coalescer vessel operating at a lower pressure in the level below the separator. Although this coalescer may have significantly higher inventory than the other adjacent inventories, the potential for back flow of the coalescer inventory will be low and in this case the inventory upstream of the separator will be considered instead.

Consideration of the process in this way from risers/wellheads through oil and gas processing trains to export risers results in the identification of all process-related fire hazards.

Where there are two isolation valves in series and located close to one another, such that the inventory between the valves is small, then the QRA considers concurrent failure of both of these valves as the unisolated inventory. This is particularly so for the case of risers where the riser ESDV is followed inboard by a second ESDV before the pipework enters an internal module. Failure of both these valves may result in the entire riser inventory being released within a topsides module and therefore may be considered as a large unisolated inventory with low associated probability of occurrence. Similarly, failure of concurrent valves on gas lift lines feeding gas lift annuli should also be considered.



A common mode factor of 15% should be used to calculate the likelihood of concurrent valve failure in this way.

3.1.3 Non-Process Hazards

Non-process related fire hazards are also analysed. Such fire hazards, as appropriate to the particular installation, are extracted from the following list:

− blowout;

− diesel storage;

− methanol storage;

− glycol storage;

− aviation fuel;

− helicopter crash and resulting fire;

− domestic fire within accommodation module;

− gas bottle stores, e.g. propane for "black-starts" or acetylene.

Blowouts are discussed in more detail in Section 5.2.5. Diesel, methanol and glycol are the main non-process hazards considered in the QRA. Where the equipment details are shown in the P&IDs then a detailed equipment count is conducted for inclusion in the calculation of leak frequency. Where such information is not available then the equipment is assumed to be the same as a vessel package i.e. includes tank, pumps, pipework etc.

The ignition probabilities for such hazards are taken to be the minimum values for the ignition model being used.

Aviation fuel releases may be treated in a similar manner, but are generally only included if a large inventory of fuel is present. Such hazards are most likely to occur during helicopter-refuelling operations where specific procedures are in place to minimise the potential for a release to occur.

Helicopter crash to result in fire is generally not considered as a major accident in the QRA. The approach of the helicopter to the helipad would not tend to involve the helicopter flying over the processing area of the platform. Therefore, whilst the risk to personnel from helicopter crash travelling to and from the installation is considered, the risk of a resulting fire causing impairment after the crash is not.

3.2 Link to Safety Case MAH

The Safety Case for an installation will assess the Major Accident Hazards (MAHs) associated with its operations in accordance with the Safety Case Regulations [1]. The hydrocarbon hazards are generally assessed in the Safety Case on an area by area basis and therefore one MAH may describe the consequences of several hydrocarbon events from the QRA. The definition of hazards in the Safety Case and QRA are therefore very closely linked.



4. HYDROCARBON RELEASE FREQUENCIES

4.1.1 Equipment Count Procedure

The hydrocarbon hazards are defined according to the isolatable section of plant from which a release could occur. These sections are based on the plant contained within isolation valves, as defined in the P&IDs. The potential release frequency for each isolatable section has been derived by estimating the equipment items contained within that section.

The equipment count has been based on the HSE Methodology [2] with each single item of equipment included within the count. Further details of this methodology is given in Appendix A.

The output of this equipment count is a data input sheet for each section detailing the number and dimensions of all equipment for that section, an example of which is shown in Table 4-1.

To ensure Best QRA Practice, the P&IDs should be up to date and reflect any recent modifications to the process. Where possible, an offshore survey should be conducted to validate the P&IDs or to mark up any recent changes to the process.

4.1.2 Generic Component Failure Rate Data

Generic component failure rate data for the QRAs has been taken from three main sources; riser and pipeline data has been derived from PARLOC 96 [3], topside process release data has been taken from the E&P forum database [4] and blowout data taken from Scandpower data. With the exception of Shearwater, all assets use the BLOWFAM 2000 [5]. For Shearwater, given the High Pressure High Temperature nature of the wells a reservoir specific blowout study was completed [6]. These data sources are based on operational experience and present a release frequency, together with a probable hole size distribution for all major components.



N O . O F I T E M S /E Q U I P M E N T I T E M C A T E G O R Y LENGTH OF

P I P E W O R K ( m )1 BOP STACKS S U R F A C E

S U B S E A2 W E L L H E A D S P <= 5000 ps i (345 bar)

5000 ps i < P <= 10000 ps i (690 bar)P > 10000 ps i

3 X M A S T R E E S P <= 5000 ps i (345 bar)5000 ps i < P <= 10000 ps i (690 bar)P > 10000 ps i

4 C O M P R E S S O R S C E N T R I F U G A LR E C I P R O C A T I N G

5 FILTERS -6 E X P A N D E R S -7 R E C O M P R E S S O R S -8 F IN FAN COOLERS -9 F L A N G E S D <= 3 "

3" < D <= 11"D > 11 "

10 H E A T E X C H A N G E R S H C I N S H E L LHC IN TUBEPLATE

11 I N S T R U M E N T S -12 MUD/SHALE TANKS

P U M P SS H A K E R S

13 D E G A S S E R S S U R F A C ES U B S E A

14 DIVERTERS -15 (NOT USED) -16 P I G L A U N C H E R S D <= 8 "

8" < D <= 12"12" < D <= 16"D > 16 "

17 P IG RECEIVERS D <= 8 "8" < D <= 12"12" < D <= 16"D > 16 "

18 PIPELINES (STEEL) D <= 4 "4" < D <= 8"8" < D <= 12"12" < D <= 16"D > 16 "

PIPELINES (FLEXIBLE) D <= 4 "4" < D <= 8"8" < D <= 12"12" < D <= 16"D > 16 "

19 RISERS (STEEL) D <= 4 "4" < D <= 8"8" < D <= 12"12" < D <= 16"D > 16 "

RISERS (FLEXIBLE) D <= 4 "4" < D <= 8"8" < D <= 12"12" < D <= 16"D > 16 "

20 PIPING (STEEL) D <= 3 "3" < D <= 11"D > 11 "

PIPING (FLEXIBLE) D <= 3 "3" < D <= 11"D > 11 "

Table 4-1 : Sample Parts Count Input Sheet



NO. OF ITEMS/EQUIPMENT ITEM CATEGORY LENGTH OF

PIPEWORK (m)21 PRESSURE VESSEL (VERTICAL) SEPARATOR

SCRUBBERADSORBERREBOILERK.O. DRUMSTABILISEROTHER (SPECIFY BELOW)

PRESSURE VESSEL (HORIZONTAL) SEPARATORSCRUBBERADSORBERREBOILERK.O. DRUMSTABILISEROTHER (SPECIFY BELOW)

22 PUMPS CENTRIFUGAL (SINGLE SEAL)CENTRIFUGAL (DOUBLE SEAL)RECIPROCATING (SINGLE SEAL)RECIPROCATING (DOUBLE SEAL)

23 STORAGE TANKS -24 TURBINES GAS

DUAL FUEL25 MANUAL BLOCK VALVE D <= 3"

3" < D <= 11"D > 11"

MANUAL BLEED VALVE -MANUAL CHOKE VALVE D <= 3"

3" < D <= 11"D > 11"

MANUAL CHECK VALVE D <= 3"3" < D <= 11"D > 11"

ACTUATED P/L ESDV VALVE D <= 4"4" < D <= 8"8" < D <= 12"12" < D <= 16"D > 16"

ACTUATED P/L SSIV ASSEMBLY VALVE D <= 4"4" < D <= 8"8" < D <= 12"12" < D <= 16"D > 16"

ACTUATED ESDV VALVE D <= 3"3" < D <= 11"D > 11"

ACTUATED CONTROL VALVE D <= 3"3" < D <= 11"D > 11"

ACTUATED BLOCK VALVE D <= 3"3" < D <= 11"D > 11"

ACTUATED CHOKE VALVE D <= 3"3" < D <= 11"D > 11"

ACTUATED BLOWDOWN VALVE D <= 3"3" < D <= 11"D > 11"

ACTUATED RELIEF VALVE D <= 3"3" < D <= 11"D > 11"

Table 4-1 : Sample Parts Count Input Sheet



4.1.2.1 Riser Failure Rates

The following failure rates were derived from PARLOC 96 [3]:

Leak Frequency (/yr)

STEEL RISERS Total 10 50 RuptureRiser Above Sea 4.02E-04 2.01E-04 7.73E-05 1.24E-04

Below 4.02E-04 2.01E-04 7.73E-05 1.24E-04Safety Zone Near 5.99E-04 2.99E-04 1.15E-04 1.84E-04

Far 1.71E-04 8.56E-05 3.29E-05 5.27E-05

Total 1.57E-03 7.87E-04 3.03E-04 4.84E-04

FLEXIBLE RISERS Total 10 50 RuptureRiser Above Sea 2.56E-03 1.70E-03 4.26E-04 4.26E-04


Far

Total 7.41E-03 4.94E-03 1.23E-03 1.23E-03

Table 4-2 : Base Riser Failure Rates

Further details on the derivation of the PARLOC data to these representative frequencies is given in Appendix C. For the purpose of the QRA, the “riser” should be taken as terminating at the riser ESD valve. The leak frequency for half of this valve should be included in the riser leak frequency total, with the remaining half of the valve included in the first “topsides” event leak frequency. Other valves, fittings, pipework etc outboard of the RESDV should be included in the riser leak frequency.

4.1.2.2 Blowout Frequencies

The blowout frequencies are given next for the representative platform and asset groups. Further details of the derivation of the blowout frequencies from their source references is given in Appendix D.



Table 4-3 : Base Blowout Frequencies



4.1.2.3 Topsides Process Hydrocarbon Release Frequencies

The release frequency for each isolatable section is calculated as the sum of the products of the number of components and the generic component failure rate. The output of this is a frequency of potential releases for small, medium and large hole sizes for process equipment releases.

The hole size ranges are characterised by a representative hole size within each range. These are:

small, 3mm equivalent diameter breach;

medium, 10mm equivalent diameter breach;

large, 50mm equivalent diameter breach.

If an isolatable section contains large quantities of liquid and gas, e.g. a separator, it is assumed that 50% of the release frequency is from the gaseous phase and 50% from the liquid phase.

The topsides release frequencies from E&P Forum are summarised in Table 4-4. Further details of the derivation of these frequencies from the base data to that shown in Table 4-4 is given in Appendix B.

4.1.2.4 Leg Failures

The frequency of hydrocarbon releases from storage cells into the legs of concrete gravity-based structures is calculated based on historical Shell Expro information. There have been two instances of gas being detected in platform legs of Shell Expro installations, once on Dunlin and once on Brent Charlie. By combining the operational life of the 5 platforms with concrete legs with the number of legs the total number of leg-years is calculated to be 425.

The frequency of releases from storage cells into legs is therefore calculated to be 4.71E-03 per leg-year.

In addition, the frequency of releases from risers and other hydrocarbon equipment located in the legs is included separately, based on the standard parts count methodology described in Section 4.1.1.



Frequency (/yr)

EquipmentHolesize / Location Total Small Medium Large

Reciprocating Compressors 6.60E-01 5.63E-01 8.42E-02 1.29E-02Centrifugal Compressors 1.40E-02 1.06E-02 2.65E-03 7.27E-04Reciprocating Pump 3.10E-01 1.91E-01 1.11E-01 8.48E-03Centrifugal Pump (double seal) 3.33E-03 1.51E-03 1.50E-03 3.18E-04Pressure Vessels 1.50E-04 2.32E-05 5.14E-05 7.54E-05Shell & Tube Heat Exchangers Shell 1.50E-04 2.32E-05 5.14E-05 7.54E-05Shell & Tube Heat Exchangers Tubing 1.30E-05 2.01E-06 4.45E-06 6.54E-06Shell & Tube Heat Exchangers Combined 1.63E-04 2.52E-05 5.58E-05 8.20E-05Small Process Piping ( /m ) < 3 inch 7.00E-05 4.45E-05 1.73E-05 8.26E-06Process Piping ( /m ) 4 inch 3.60E-05 1.54E-05 1.05E-05 1.01E-05Process Piping ( /m ) 6 inch 3.60E-05 1.54E-05 1.05E-05 1.01E-05Process Piping ( /m ) 8 inch 3.60E-05 1.54E-05 1.05E-05 1.01E-05Process Piping ( /m ) 10 inch 3.60E-05 1.54E-05 1.05E-05 1.01E-05Process Piping ( /m ) 11 inch 3.60E-05 1.54E-05 1.05E-05 1.01E-05Large Process Piping ( /m ) > 12 inch 2.70E-05 7.50E-06 9.71E-06 9.79E-06Flange <3 inch 8.80E-05 7.64E-05 8.75E-06 2.82E-06Flange 4 inch 8.80E-05 5.68E-05 2.78E-05 3.40E-06Flange 6 inch 8.80E-05 5.68E-05 2.78E-05 3.40E-06Flange 8 inch 8.80E-05 5.68E-05 2.78E-05 3.40E-06Flange 10 inch 8.80E-05 5.68E-05 2.78E-05 3.40E-06Flange 11 inch 8.80E-05 5.68E-05 2.78E-05 3.40E-06Flange > 12 inch 8.80E-05 5.68E-05 2.78E-05 3.40E-06Valve <3 inch 2.30E-04 1.72E-04 4.54E-05 1.22E-05Valve 4 inch 2.30E-04 1.20E-04 8.86E-05 2.15E-05Valve 6 inch 2.30E-04 1.20E-04 8.86E-05 2.15E-05Valve 8 inch 2.30E-04 1.20E-04 8.86E-05 2.15E-05Valve 10 inch 2.30E-04 1.20E-04 8.86E-05 2.15E-05Valve 11 inch 2.30E-04 1.20E-04 8.86E-05 2.15E-05Valve > 12 inch 2.30E-04 1.20E-04 8.86E-05 2.15E-05Small bore fitting 4.70E-04 2.03E-04 2.67E-04PackagesVessel Package 1.20E-02 6.37E-03 4.82E-03 8.12E-04Separator Package 2.32E-02 1.25E-02 9.53E-03 1.22E-03Heat Exchanger Package 5.17E-03 2.67E-03 2.07E-03 4.30E-04Pump (Centrifugal) Package 6.54E-03 3.07E-03 2.91E-03 5.47E-04Centrifugal Compressor Package 1.72E-02 1.25E-02 3.51E-03 1.21E-03

Table 4-4 – Topsides Process Leak Frequencies



5. HYDROCARBON OUTFLOW CALCULATIONS

5.1 Inventory Calculations

The correct calculation of hydrocarbon inventory is critical to ensure that the potential release rates, durations, fire sizes, gas cloud sizes etc are correctly found. The calculation of hydrocarbon inventories should always be based on the most recent process information for the platform which, ideally, should be in the form of PRO II or HYSYS simulation data as outlined in Section 2.

This data should provide a simple PFD of the process with representative stream numbers relating to corresponding stream data. To enable an accurate calculation of the inventories to be conducted the stream data should include :

− Pressure;

− Temperature;

− Composition and specific details of user created components i.e. “C7+”;

− Liquid and gas densities;

− Volumetric or mass flowrates.

By combining the stream compositions of the process with the associated equipment volumes then the inventory of hydrocarbons can be found. The equipment volumes should be calculated from P&ID equipment dimensions or from layout drawings or plot plans. Where possible, offshore surveys should be conducted to validate the data obtained from such drawings.

Where the vessel contains two or three phases, i.e. separators, then the weir positions of interface levels should be obtained to ensure that the correct inventories are assessed. Where such information is not available then the vessel will be assumed to be 50% filled with gas and 50% with liquid. Pipework details should be obtained from isometric drawings where available or calculated from assumed pipework routings on layout drawings. These routings should be confirmed offshore. Where such information is not available or routings are difficult to estimate then a pipework volume equivalent to 10% of the associated vessel volume should be assumed.

A custom built spreadsheet has been developed by Atkins Process which uses the process and equipment data as inputs to calculate a mass of hydrocarbon inventory. The spreadsheet calculates the mass of gas (free gas and flashing C1-C3) and liquid (oil and water) for the isolatable sections. Each of these isolatable inventories is calculated from the individual equipment sections that contribute to the event.

The calculation of non isolated inventories is simply achieved by adding the equipment associated with the non isolated event to the isolated equipment. Where the two inventories are at different pressures i.e. a release downstream of a compressor includes the upstream inventory as the non isolated release, then an equivalent volume and temperature for the total inventory is calculated, based on the pressure of the initial isolated inventory.



5.2 Hydrocarbon Outflow Rates

The methodology adapted to calculate hydrocarbon release rates for gas, liquid and two-phase release is described next.

5.2.1 Gas Release Outflow Rates

The outflow rate methodology is typical of current industry practice [7,8] and makes use of established modelling techniques. For topsides process inventories, the methodology assumes no frictional losses and therefore provides an overestimation of the leak rate, particularly for small pipes rather than pressure vessels.

If the pressure drop at the release point is critical i.e.

1

2

1

12 −

+

≤γ

γ

γPP

(A1)

Where P1 is ambient pressure P2 is the pressure inside containment γ is the ratio of specific heats of the fluid = cp/cv (assumed to be = 1.2, although it actually varies with T, P and gas composition) cp is the specific heat of fluid, constant pressure (J/kgºC) cv is the specific heat of fluid, constant volume (J/kgºC)

then the velocity of the escaping gas will be sonic at the actual conditions at the leak point.

The sonic gas release rate at time t, Gt, may then be calculated as:

kPAG tefft = (A2)

or rearranged eff

tt kA

GP = (A2a)

Where, Effective Orifice Area, ACA Deff = (A3)

And the release area for a given breach size is simply :

4

2dA

Π= (A3a)

The flow coefficient, k, is expanded out to :

11

12 −

+

+=

γγ

γγ

RTM

k (A4)

Where: d is the orifice diameter (m) CD is the flow orifice discharge coefficient (assumed to be = 0.8 [8], but will actually vary with Reynolds number and release orifice size) M is the molecular weight (kg/kmol) T is the temperature in containment (K) R is the gas constant = 8314 (kg.m2/K.kmol.s2) Pt is the pressure inside containment at time t (N/m2)



From current industry practices [7] the decay of the leak rate with time is known to behave exponentially and can be described by the following equation:

−= t

VG

GG iit .

exp.ρ

(A6)

Where: Gi is the initial leak rate (kg/s) see equation (A2) using initial pressure Pi Gt is the leak rate as a function of time (kg/s) ρ is the density of the gas (kg/m3) (assumed to remain constant at initial conditions) V is the volume the gas occupies in the container (m3) t is the time after the onset of the leak (s)

Substituting (A2) into (A6) yields

−= t

V

PkAPP ieff

it .exp.

ρ (A7)

and substituting (A3) into (A7) yields

−= t

VAPkC

PP iDit .

exp.ρ

(A7a)

Where: t is the time after t = 0 (secs); V is the initial bulk fluid volume (m3); ρ is the density of the gas (kg/m3); (V.ρ) = W = initial mass of fluid (kg).

Equation A7a can then be used to calculate the system pressure at a given point in time and this pressure used with Equation A2 to determine the mass release rate at this time.

The activation of blowdown should effectively result in an increased rate of depressurisation. The actual platform blowdown criteria is used, i.e. API 521 half the system design pressure or 6.9 barg in 15 minutes, to allow the effective blowdown orifice area to be calculated by re-arranging A7 to form :

=

t

i

ieff P

PtkP

VA ln.

.ρ (A8)

From re-arranging (A7a), the actual blowdown area is calculated from:

=

t

i

iD PP

tPkCV

A ln..ρ

(A8a)

Where the actual system blowdown orifice is known then this can be fed directly into equation A7a to determine the depressurisation rate with time. To calculate the depressurisation of a system following an accidental release with blowdown activated, the effective breach area becomes :

( )baD AACAeff += (A9)

where Aa is the accidental release area and Ab is the blowdown orifice area. With the exception of the Shearwater QRA, the blowdown orifice used to calculate the depressurisation of an inventory is based on the isolated inventory conditions only. Where isolation fails then the adjacent inventory is also assumed to be blown down through the



isolated orifice. For Shearwater, depressurisation is assumed to occur through both blowdown lines, where they exist.

If the pressure drop at the release point is not critical ie

1

2

1

12 −

+

>γ

γ

γPP

(A10)

then the release is taken to be sub sonic. For the purposes of the QRA sub sonic releases are taken not to result in momentum driven jet fires and therefore have little or no effect in escalation or smoke impairment. The release duration is taken to be effectively over once the release rate becomes sub sonic or results in jet fire lengths less than 2m in length. The 2m flame length is considered to be insufficient to result in escalation.

5.2.2 Liquid Outflow Rate

From current industry practices [7, 8], the release of liquid from a process vessel, storage tank or other hydrocarbon containing vessel can be represented by a form of the Bernoulli equation :

( )

+

−= Zg

PPACm Dl ρ

ρ 212 (B1)

where; ml is the mass discharged (kg/s); CD is the discharge coefficient (assumed to be 0.6 [8]); A is the release area (m2); ρ is the liquid density (kg/m3); P1 is the liquid storage pressure (Pa); P2 is the ambient pressure (Pa); g is the acceleration due to gravity (9.81 m/s2); Z is the static head of liquid (m).

For simplicity, the flowrate is assumed to remain constant at the initial rate until the inventory has been discharged. It is assumed that there is constant pressure due to a combination of vapour above a liquid in a vessel (i.e. blowdown is ignored) and the vapour pressure of the liquid.

For predominantly liquid filled vessels or equipment with a low vapour content i.e. dead crude, diesel etc, the vapour pressure of the fluid is used to model the release rate. For such conditions, the liquid head of the fluid will be more influential on the release conditions and for the purposes of the QRA an average liquid head, between the vessel being full and empty, is used.

5.2.3 Two Phase Outflow Rate

An estimation of the 2-phase outflow rate is simplistically made by the following expression:

igasgas

bulkphase GG

ρρ

=2 (C1)



The calculation of gas release rate could simply make use of the equations proposed in Section 5.2.1, however the methodology must also account for gas which may flash off the liquid during the release. The modified form of Equation A7a is shown next :

Without blowdown,

−= t

W

APkCPP

itotgas

phaseiDit .

exp. 2

ρ

ρ (C2)

With blowdown,

+

−≈ tW

PW

WAkAk

PPigas

iitot

igas

gas

phaseeffbreffbd

it

brbd.

exp.

2

ρ

ρ

(C3)

Where: ρgas is the initial gas density (kg/m3) ρ2phase is the initial 2 phase fluid density (kg/m3) W igas is the initial mass of gas (kg) W itot is the initial total mass of 2-phase fluid (kg) Subscript: bd = blowdown; br = breach

The effective blowdown orifice area is calculated, for the case where blowdown is required within a certain time criteria, using :

=

t

i

i

igaseff P

PtkP

WA

bdln. (C4)

5.2.4 Riser Releases

Riser releases from gas only risers, i.e. export, gas lift or injection may be calculated using the “Blowdown” model within FRED [8]. This model takes account of frictional losses in the pipeline to produce a chart of release rate versus time.

For two-phase pipeline releases, the gas inventory of the pipeline is calculated in terms of free and dissolved gas. The dissolved gas content is calculated using process information and the HYSYS model to simulate the depressurisation of the pipeline down to atmospheric conditions. For the modelling of subsea releases, the fluid can be flashed down to the pressure at the sea bed i.e. 10 bara. This gas inventory is then used to calculate an equivalent gas pipeline volume, and thereafter pipeline length for the original pipeline diameter, which is modelled in FRED [8] at the initial pipeline conditions.

The two-phase release rates are then calculated in a similar manner to two-phase process releases with Equation C1. The initial two-phase outflow rate is calculated and divided by the initial gas outflow rate to find a two phase factor. The gas release rates calculated by FRED are then multiplied by this factor to determine the two-phase release rates with time.

For risers and pipelines conveying dead crude, classified as less than 2% gas flash fraction [9], the release will be driven by the relaxation of the pipeline as the stress in the pipeline reduces as the pressure drops. The decrease in volume as the line depressurises is dependent upon the materials of construction, the internal pressure, the size of the pipeline and the thickness of the pipe wall. In the case of a pipeline, the longitudinal forces are resisted by pipeline supports and for buried pipe, the friction of the surrounding material.



Therefore, the increase in size is restricted to an increase in diameter due to the radial component of the force.

The equation for the increase in the radius of a thin walled pipeline (wall thickness <10% of pipeline diameter) is [10] :

tErP

r.

. 2

=∆ (D1)

Where: r is the pipeline internal radius (mm) P is the internal pressure (Pa) E is the Young’s Modulus for the pipeline material (Nm -2) t is the pipeline wall thickness.

The increase in volume per unit length is proportional to the square of the radius and therefore :

])[( 22 rrrV −∆+=∆ ρ (D2)

The effect of pressure on the density of the oil is also calculated using HYSYS and any change in density is also converted to a volume released and added to that calculated above.

Where pumps are being used to assist the conveyance of fluids then the release rate is assumed to be equal to the initial release rate, or the maximum flow through the pipeline whichever is the lower, until the pumps have shut down. A time of 3 minutes shall be assumed for pump closure, unless more detailed platform specific information is available.

5.2.5 Blowouts

The hydrocarbon release rates from blowouts should be calculated using Shell Expro’s BLOCOG model. Where this is not possible then the release rates can be modelled in FRED using similar assumptions to the two-phase riser releases or treated to have a similar release rate as the production flowline or manifold events, but with an unlimited duration.



6. HYDROCARBON RELEASE CONSEQUENCES

A hydrocarbon release may result in many consequences depending on the size and duration of the release, if and when it ignites. The following sections describe the means used to assess these consequences in the QRA.

6.1 Gas Dispersion - Enclosed / Open Areas

Gas dispersion in open, unconfined areas is conducted with the dispersion models in FRED [8]. Dispersion is conducted using the mass release rates from the outflow rate calculations and the composition of the released material, so that flammability limits can be calculated in FRED. Such dispersion analysis is usually conducted to determine if flammable concentrations of gas can occur at TR HVAC ducts, machinery inlets, generator ducts etc.

The build up of gas within an enclosed area is calculated using a CSTR type approach. The release of gas with time is used along with the free volume of the module and the ventilation rate in the module to determine the change in gas concentration with time. Mechanical ventilation rates may be reported in the Safety Case or Performance Standards. Natural ventilation rates should be based the results of actual offshore tests, if they are available, otherwise the NVI Workbook [11] should be used to determine a ventilation rate.

The general form of the CSTR equation is :

VtCQtq

dtdC )(.)( −

= (E1)

Where: q is the gas inflow rate (m3/s); Q is the ventilation flowrate ((m3/s); V is the free module volume (m3); t is the time after the initial release (s).

If the gas build up is examined under discrete time intervals, say 10 seconds, then the equation can be represented in the following form :

V

VCCQQqq

tCtt

tttt ..22

)(11

11−−

−− +

+

−

+

= (E2)

The gas release rates are found from the outflow rate calculations. For two-phase releases the gas only release rate is used and for liquid releases the gas flashing off the liquid is used. The ventilation rate will be either a fixed mechanical rate, for enclosed modules, or a varying natural rate for open, well ventilated modules.

For the Brent, CADA and TENC assets account is taken for mechanical HVAC systems shutting down on gas detection, where this occurs. On the Mature Assets and Gannet, the mechanical HVAC systems are assumed to run continuously where such systems are fitted.

6.1.1 Gas Releases Subsea

Hydrocarbon releases subsea, whether from a gas, two-phase or oil riser / pipeline will result in a gas plume or oil slick forming on the sea surface. For gas and two-phase releases this gas plume will drift away from the release point on the sea surface. If this plume remains



flammable some distance from the point of release then there is the potential for the release to ignite and result in topsides escalation or the formation of a fire on the sea.

The limits of the flammable gas cloud are calculated using the passive cloud length charts (Figure 7.5.2 – 7.5.13) in the RISER manual [9]. The charts provide a horizontal and vertical limit to the cloud for a given release rate and wind speed. These results can be used to determine a factor to apply to the ignition probability for subsea releases.

The vertical and horizontal lengths of the cloud are obtained for the three wind speeds, 1, 5 & 12m/s, from the figures. The pipeline release is considered all the way to the end of the 500m safety zone (the limit of the release frequency calculated from PARLOC). The vertical height of the cloud is compared against the height to the nearest credible ignition source on the platform, i.e. the cellar deck. For conservatism, this vertical distance should be halved. The vertical factor, horizontal factor and wind speed should then be used to calculate a ignition factor.

The following example illustrates how this is achieved.

An initial gas release rate of 350 kg/s from a high pressure gas riser produces the following cloud lengths from RISER [9].

Wind Speed (m/s) Horizontal Distance (m) Vertical Distance (m)

1 19 150

5 60 40

12 70 17

The cellar deck height is 26m, but this is conservatively reduced to 13m. By comparison with the vertical distance values above, it can be seen that all of the releases may result in a flammable gas cloud at 13m.

The horizontal distances are compared with the 500m Safety Zone to calculate a fraction of releases that may potentially be flammable. These fractions are shown next.

Wind Speed (m/s) Horizontal Fraction

1 0.04

5 0.12

12 0.14

Combining the horizontal and vertical factors with the wind speed probabilities enables the subsea ignition factor to be calculated. The wind speed probabilities should be found from wind rose data and are conservatively taken to include all wind directions. The final subsea factor probability is shown next :



Wind Speed (m/s)

Horizontal Factor Vertical Factor Wind Factor Combined Factor

1 0.04 1 0.28 0.0112

5 0.12 1 0.47 0.0564

12 0.14 1 0.25 0.035

Total 0.103

The ignition probability calculated using the method described in Section 7 is then multiplied by this factor to determine a subsea ignition probability for this particular event.

6.2 Gas Jet / 2-Phase Fires

Jet fires results from ignition of jets of hydrocarbon released from high pressure sources. Gas, oil or two-phase releases can all result in jet fires.

6.2.1 Jet Flame Size

The jet flame length in an open area can be calculated using FRED [8] for a given breach size and processing conditions. However, the implementation of results from FRED into a spreadsheet package which can then be carried forward is complex and time consuming, particularly when a number of release events need to be considered for various hole sizes and time intervals.

Instead, a spreadsheet model is used which makes use of the hydrocarbon release rate and a modified form of the Wertenbach equation :

Flame Length (m) = A x QB (F1)

Where; A is a constant depending on hole size; Q is the hydrocarbon release rate (kg/s); B is a constant depending on hole size.

The constants A and B are obtained from jet flame modelling conducted by Shell Thornton Research Centre and presented as graphs of Flame Length versus Outflow Rates in [12]. From these charts the following constants are obtained.

Hole Size (mm) A B

3mm & 10mm 11 0.44

50mm 11.94 0.426

100mm/Full Bore 13.05 0.409

Table 6-1 – Constants For Jet Flame Correlations



6.2.2 Jet Fire Radiation

The radiation levels for jet fires in the open will vary depending on the fluid fuelling the fire. Typical values for well ventilated fires are available from the large scale experiments that have been conducted and also from consequence models such as CHIC and FRED. For the purposes of the QRA, the following values are used :

− Gaseous Jet Fire – 300 kW/m2;

− Two-Phase / Liquid – 200 kW/m2.

6.3 Fireballs

Larger fires or full bore riser ruptures would not tend to burn as jet fires but would be deflected by nearby walls and equipment items to form fireballs. Video footage of the Tartan riser rupture on Piper Alpha enables an estimation of the fireball size to be obtained. If the release was taken to be full bore then the release rates at the initial release conditions and 10 minutes after rupture can be used to postulate a formula for estimating fireball size. This is :

Fireball Diameter (m) = 6 x Q 0.4 (G1)

Where; Q is the hydrocarbon release rate (kg/s).

Such fire balls are taken to occur for gas releases and two phase releases, particularly where the gas content of the fluid is high. As the fire ball will not be as concentrated as a jet fire a lower thermal radiation level of 200 kW/m2 is proposed around the entire surface of the fireball.

6.4 Pool Fires

The estimation of pool fire sizes and durations is somewhat more complex than jet fires. The extent of the fire will depend on the area of release, whether it is confined by bunding or a running pool fire across the module floor, geometry of the module and the fluid released.

6.4.1 Pool Fire Burning Rate

The burning rate of the liquid will determine how quickly the fire will burn in relation to the mass released and the area it is released into. In this way, it is possible to calculate if a pool fire will build up within an enclosed area or burn quicker than it is released. The burning rates adapted for the QRA are shown in Table 6-2 and taken from [13].



Material Burning Rate (kg m-

2s-1) Regression Rate

(mm/min)

Crude Oil 0.022 – 0.045 4.0

(Heavy) Fuel Oil 0.035 2.2

Kerosene 0.039 2.9

Gasoline 0.055 4.5

Heptane 0.101 9.0

Methanol 0.017 1.4

Table 6-2 – Burning Rates For Various Liquid Releases

6.4.2 Pool Fire Diameter and Height

6.4.2.1 Bounded Fires

If the area bounded by the bunding is smaller than the resulting area of an instantaneous or continuous release when no barriers are present, the duration of the pool fire in the bund is dependent on the maximum liquid depth in the bund, d1. It is given by the total amount of fuel, VL (m3) divided by the area bounded by the bunding, AB (m2).

B

L

AV

d =1 (H1)

As the depth of the bund is usually not known it is assumed the bunds have been adequately designed and that the liquid will not fully fill it. However, if this depth is greater than the depth of the barriers forming the bunds, the depth of the bund has to be used instead. The duration of the fire, td, is given by the following expression:

''11

f

f

fd m

dvd

tρ

== (H2)

Where: vf is the fuel regression rate (m/s)

ρ f is the density of the fuel (kg/m3) m”f is the burning rate (kg/m2s)

The use of such an expression for prediction of fire duration must be used with care. It is highly probable that fuel will be removed from the pool by drainage as well as burning, thereby reducing fire durations. The activation of a deluge system or monitors will also tend to wash oil away from the pool on the surface of the applied water. The fire behaviour will be now more akin to that of a running pool fire. Consideration should be given as to whether the oil remains a hazard as it is swept into other areas. This is a particular concern for floating vessels, such as the Anasuria FPSO.



6.4.2.2 Unbounded Pool Fires

From current industry practices [7] a criterion for classification of a given unbounded spill as either instantaneous (i.e. tank rupture) or continuous (i.e. leak from a pipe connected to a reservoir) is to calculate the following expression for a non-dimensional critical time, τcr.

3/1L

fscr V

vt=τ (H3)

Where: τcr is non-dimensional critical time (-) ts is the duration of the spill (secs) vf is the fuel regression rate (m/s) VL is the total volume of spilled liquid (m3)

If τcr < 0.002, the release should be modelled as instantaneous.

If τcr > 0.002, the release should be modelled as continuous.

Instantaneous Pool Fire Diameter

The growth of the spreading diameter with the time, t, of an instantaneous release on a smooth horizontal surface is given by the following expression:

−+

=

2

13

21

23

mmme t

ttt

DD (H4)

The maximum diameter:

8/1

2

3

2

=

f

Lm v

gVD (H5)

The time to reach the maximum diameter:

4/1

267.0

=

f

Lm gv

Vt (H6)

Where: De is the pool diameter at time t (m) Dm is the maximum diameter (m) tm is the time to reach the maximum diameter (s) g is the acceleration due to gravity, 9.81m/s2 t is the elapsed time from simultaneous release & ignition (s)

Continuous Pool Fire Diameter

The equilibrium diameter of a continuous, unbounded release on a smooth surface is given by the following expression:

5.0

"2

=

feq m

QD

π (H7)



Where: Deq is the equilibrium diameter (the spill rate equals the burning rate) (m) Q is the leak rate of the liquid fuel (kg/s)

6.4.2.3 Pool Fire Flame Height

Once the diameter of the fire has been calculated, using Equation H4 and H7 above, then the height of the flames can be found using the Thomas correlation :

( )61.0''

42

=

gD

mDH

a

f

ρ (H8)

Where: H is the average visible flame height (m) "average" being as the height at which the flame height is equal to or above 50% of the time. D is the equivalent diameter (m) m''f is the burning rate per unit area (kg/m2s) ρa is the density of the ambient air (kg/m3)

For rectangular bunded areas an equivalent circular diameter may be calculated to provide a more accurate flame height for such fires. This equivalent or effective diameter is dependent on the number of walls and orientation. A wall may restrict air supply to the flame plume which can cause the flame to rise higher in order to get sufficient air supply for combustion.

6.4.3 Radiation Levels

The radiation levels for well ventilated pool fires can be taken from large scale tests that have been conducted as well as from computer models such as FRED and CHIC. For the purposes of the QRA the thermal radiation level in the impingement zone of the flame is taken to be :

− Liquid Pool Fire – 200 kW/m2.

6.5 Compartment Fires

During the initial stages of a fire in a compartment, the combustion is the same as a fire in the open with enough air present for complete combustion and the fire is fuel controlled. After a short time, a hot gas layer of combustion products builds up in the upper part of the compartment. This layer grows and descends as gases continue to flow into it. There is generally a relatively well defined interface between the hot combustion product layer and the cooler air below. When this interface descends below an opening there is a sudden outflow of smoke, combustion products or flame. If the compartment openings are small, the fire will not be able to entrain enough air for complete combustion and the fire is ventilation controlled. The hazards associated with compartment fires include all those normally associated with open fires and additional hazards due to the effect of confinement including:

− extent of external flaming;

− increased heat loading from radiation from walls and soot in flame;

− impaired visibility due to smoke obscuration;

− increased hazard from carbon monoxide;



− explosion hazard from unburned fuel if fire extinguishes due to insufficient oxygen.

The primary physical parameters affecting a compartment fire include:

− geometry and size of compartment;

− type of fire (jet or pool) and fuel involved;

− fuel release conditions;

− mass transfer through vents;

− radiation and convection heat fluxes and heat loss.

Although the processes involved are complex, experimental work has enabled a simplified model to be developed for estimating the steady state behaviour of compartment fires. This Combustion Hazards in Compartments (CHIC) model gives estimates of global smoke layer properties such as depth and temperature, radiative heat and mass transfer losses, and the extent of external flaming. The model results compare favourably with experiments to a level sufficient for comparison and ranking of hazard scenarios.

Where weather cladding is fitted to module walls then it is likely that it will burn off or be ejected from the wall by an explosion. This could have a significant effect on the compartment venting and the behaviour of a subsequent fire. Where the fire is large enough to be classed as a compartment fire then it should be assumed in the assessment that the majority of the weather cladding will fail to enable spillage of flames outside of the module.

Large scale experiments in insulated compartments have shown that heat fluxes vary with degree of ventilation, state of fuel release (gas or liquid, jet or pool) and location within the fire. The following table gives some typical values, from measurements taken several minutes after ignition when the fire is approaching steady state. More precise values can be obtained from the CHIC model for the scenario under study.



Fire type Fuel state Fire zone Fuel (F) or ventilation (V) control

Typical total flux,

kW/m2

Typical radiative

component, %

Jet fire gaseous Impingement zone

F up to 300 50

V up to 360 50 Smoke zone F 200 80 V 200 80 2-phase

/liquid Impingement zone

F 200 90

V 150 90 Smoke zone F 100 100 V 200 100 Pool fire Impingement

zone F 300 90

V 200 90 F 150 100 V 100 100

Table 6-3 – Fire Parameters for Fuel and Ventilation Controlled Fires

Carbon monoxide levels in ventilation controlled fires and external fires at compartment vents may be high and the potential for impairment should be considered for compartments close to the Temporary Refuge.

Where the use of CHIC may be limited due to time constraints then a reasonably robust rule for determining whether a flame is fuel or ventilation controlled for the purposes of risk assessment is given by the inequality [14] :

Fuel controlled if ∑(A√H) > 35 x Q for jet fires (I1)

∑(A√H) > 88 x Q for pool fires (I2)

where A is the area of a vent in m2, H is its height in m, ∑ is the sum over all vents and Q is the mass burning rate of the fire (kg/s). If the inequality is not satisfied then the fire may not necessarily be ventilation controlled because an unusual vent distribution may allow enhanced aeration of the fire i.e. "chimney effects". Calculation using more sophisticated tools such as CHIC is recommended if the fire scenario under study is critical to the overall risk.

The escalation potential for ventilation controlled fires may differ somewhat from smaller or unconfined fires as the fire will lose it’s directionality. This is considered in the development of the consequence trees for the QRA, as the escalation potential may be higher. It should also be remembered that as the release rate and fire size decay, the fire may reduce sufficiently to become a fuel controlled fire before escalation occurs.



6.6 Flash Fires

The calculation of consequences resulting from flash fires is included here for completeness, although they are rarely assessed in offshore QRA. This is because the majority of offshore modules are relatively confined and the consequences of a hydrocarbon release are assessed to result in an explosion followed by a jet, two-phase or liquid fire.

The size of a flash fire is calculated based on correlations presented by the HSE [15] and shown next :

31

8.5 MD f = (J1)

where; Df is the flash fire diameter (m); M is the mass of fuel released (kg).

Flash fires are taken to have little potential to escalate or cause major damage to equipment and structures, however, all personnel engulfed by the fire are assumed to be immediate fatalities.

6.7 Sea Fires

Subsea releases will result in the formation of a gas plume on the sea surface, with a central boil region similar in shape to a cylinder with gas dispersing away from the release. The calculation of sea fires assumes that the diameter of the fire will be similar to the diameter of this boil region.

The calculation of sea fire diameter is based on the depth at which the release occurs and information from an actual blowout on the West Vanguard [16].

The diameter is calculated using the following equation :

D = 2 x β x z (K1)

Where z is the release depth (m) β is a factor depending on the gas release rate (kg/s)

For a gas outflow rate of less than 10kg/s a β factor of 0.05 is used, for greater than 100kg/s a factor of 0.16 is used. For gas outflow rates between these two values the β factor is assumed to vary linearly.

The methodology described in Section 6.1.1 is used to determine if a release may initially ignite. Where the environmental conditions are suitable to enable ignition to occur then they are also assumed to be suitable for the fire to sustain burning as long as there is sufficient inventory available.

6.8 Explosions

Explosions on offshore installations have the potential to result in major damage, escalate to other hydrocarbon inventories and result in a high number of fatalities. An accurate assessment of the potential explosion overpressures that may be generated is therefore required and a description of the typical techniques used are given here.



6.8.1 Description of Typical Explosions in Offshore Modules

The levels of confinement typically found in offshore modules generally correspond to a solid/grilled roof and deck with one or two open sides. The implication of this is that explosions in offshore modules are typically semi-confined. If the released gas cloud is of sufficient quantity, then an offshore semi-confined explosion would be followed by an external explosion directly outside the module where the release occured. Confined explosions are also possible offshore but would be limited to a few areas, such as the legs of concrete platforms or enclosed modules which have little or no free venting.

6.8.2 Factors Influencing Offshore Explosion Severity

The factors which may affect the severity of the explosion overpressure on offshore modules are listed next :

[1] Geometry and Ignition Location

There is a complicated interaction between module geometry and ignition location, of particular importance is the time and location at which combustion products vent. When the ignition location allows early venting, the flame speeds and overpressures generated will be significantly lower than when the ignition location means burnt gas does not vent for some time and pressure builds up. An increased degree of equipment congestion will generally increase the explosion overpressures due to the increased turbulence generated in the flow ahead of the flame.

[2] Fuel Type and Concentration

Flame acceleration and, therefore, flame speed and overpressures are dependent on fuel type. In general, methane (natural gas) gives lower overpressures than propane, butane and ethylene. The higher the burning velocity, the higher the overpressures generated. The burning velocity of hydrocarbon mixtures is at a maximum when the concentration of the fuel is slightly above the stoichiometric concentration i.e. 5% above stoichiometry for methane and 15% above for propane.

[3] Cloud Size

Large, stoichiometric cloud sizes are more likely to result in significant damage to offshore modules than small clouds that only partially fill modules. Large clouds may also result in high external overpressures. As the internal overpressure develops within the module, unburned gas may expelled outside of the module and ignite as the flame front emerges from the vent of the module. This may result in an external overpressure which has the potential to decay away from the module to impact on an external structure.

6.8.3 Estimation of Explosion Overpressures / Models

For the purposes of explosion modelling on the Shell Installations covered by this QRA Methodology, three computer models are used. These models vary in applicability and complexity and are described next.

[1] Congestion Assessment Method (CAM2)



The CAM2 model is located within the FRED suite of programs and is the preferred means of calculating overpressure from an explosion in a simple congested, but unconfined, geometry. The model defines the congested region where the potential explosion overpressure is taken to occur and requires the congestion to be input as a series of grids with a blockage ratio represented by :

XSA

B

ME

BR = (L1)

where; BR is the blockage ratio for a particular grid; EB is the area of blockage introduced by the equipment at a particular grid (m2); MXSA is the module cross sectional area (m2).

Only one blockage ratio is entered for the length, width and height of the congested region and, therefore, where there is more than one grid in the congested region the average of all the grids is entered.

The output from CAM contains, amongst other things, an overpressure at a specified distance and a chart of overpressure versus distance. This chart can be used to calculate the overpressure at a distance from the source explosion, i.e. at the TR.

[2] Shell Code for Overpressure Prediction in gas Explosions (SCOPE)

SCOPE is a phenomenological model for predicting semi-confined, vented explosions. SCOPE calculates the progress of a flame as it develops from ignition and accelerates past obstacles. The modelling of this flame development is based on actual experimental data.

The model is similar to CAM in that it expresses equipment congestion as a series of grids with a representative blockage ratio. The difference here is that up to 10 grids can be accounted for in the direction of venting and each one can have a unique blockage ratio. This model is therefore more easily able to distinguish between congested and uncongested areas of a module.

One of the vents in the module is assigned the main vent, with the worst case ignition location taken to be located at the centre of the wall directly opposite this vent. Other vents in the module can be assigned if present. The maximum average internal overpressure is calculated together with the external explosion outside of the module and also at a chosen distance from the module. The SCOPE model predicts the direct line-of-sight element of the external explosion and the reflected element. The reflected element may be due to reflection of the explosion wave off the sea surface, tall structures etc to result in a coincident direct and reflected wave at the target location.

For conservatism, the QRA Methodology generally ignores the reflected element predicted by SCOPE and instead takes the overpressure at an external target to be equal to double the line-of-sight element. Further details on this are given in Section 9.2.3.

[3] EXplosion SIMulation Tool (EXSIM)

Computational Fluid Dynamics (CFD) can be used for explosion overpressure prediction. Such packages aim to model the explosion process through the numerical solution of the equations for the turbulent flow and combustion on a three dimensional grid. EXSIM is such a code and is ideal for the assessment of areas where the explosion overpressures predicted may have a critical impact on the risk levels.



The level of detail required to be input into EXSIM is far more complex than for CAM and SCOPE. Generally individual items of equipment, instruments, valves, pipework down to 2” etc have to be entered. The results produced from the model are also more detailed with pressure history profiles being plotted for gauges that can be placed at any location inside the area of congestion or even outside of it.

6.8.4 Explosion Modelling – Best Practice

For all the explosion models mentioned above, an accurate determination of the equipment blockage levels can only really be obtained through platform visits. For existing installations, a survey of the platform should be undertaken to ensure an accurate assessment of the blockage for each of the modules under review is obtained. The survey should also identify those sections of an area which are congested, but which are not shown in layout drawings i.e. pipework, manifolds, etc. Where possible, the visit should be augmented with photographs or video footage of the area. This should improve the auditing process and also provide additional back up to the analyst whilst conducting the explosion assessment.

For any explosion assessment that is conducted during the design of a project, then an appropriate degree of uncertainty should also be build into the models. Layout drawings produced during the early stage of a design rarely reflect the final level of congestion that may be present in an area. Generally, small equipment items, pipework etc will not be shown on the layouts until later in the design. The model must therefore take account of this additional congestion. During the early stages of a design it is likely equipment items may be moved around and therefore it may be more appropriate to use the CAM and SCOPE tools as these models are relatively quick to modify and re-run. EXSIM could then be used, if the calculation of overpressure was deemed to be critical, at a stage when the design was more rigid.

The methodology relating to how the explosions are used in the QRA process are given in Section 9.2.

6.9 Smoke Modelling

Hydrocarbon fires will release products of combustion in varying proportions depending on the composition of the burning material and the conditions surrounding it, but will generally contain:

− Carbon monoxide (CO);

− Carbon dioxide (CO2);

− Soot;

− Heat;

− Other toxic products.

CO is judged the most threatening component of hydrocarbon fire combustion products (`smoke'). It combines with the oxygen carrying component in the blood, haemoglobin, to form carboxyhaemoglobin which does not transport oxygen to human tissues thus preventing the inhalation of normal concentrations of oxygen and eventually causing asphyxia. The build-up of COHb is discussed in more detail in Section 6.9.3.



The smoke model adapted for Shell Expro installations, which is described in more details in EN/066 [17], has 4 component parts :

[1] Source Term

A comprehensive description of the physical effects occurring during the combustion of hydrocarbons and the effect on smoke efflux rates, temperature and CO concentration is given in the Physical Effects Modelling Handbook (PEMH) [18]. A summary of the latest research on the subject appears in Table 6-4 to provide background information and recommended values for the concentration of CO at the source of a compartment fire.

The methodology described in this document starts with the conditions prevailing at the outlet of a compartment and therefore concentrates on the three following aspects;

[2] Movement

This considers dilution of the plume over a distance where the plume is moving in the downwind direction in free space and is subject:

− wind effects;

− turbulence caused by obstructions.

This has been studied using wind tunnel modelling and the results analysed to give estimates of the smoke dispersion around offshore installations. The equations that are used have been kept as simple as possible for ease of use and this means that some conservatism is unavoidable.

[3] Mixing

A smoke plume that disperses towards the TR may result in the build up of CO within the TR due to leakage and ingress through openings during the mustering process.

For the purposes of the QRA, the simple form of the Constantly Stirred Tank Reactor, (CSTR), is recommended and briefly described. The CSTR model requires the TR air change rate to be determined and this is typically taken from actual offshore tests. The air change rate will vary depending on wind speed and direction, but typical values that have been used in QRAs are :

− Brent & Northern Platforms – 0.5 ACH

− Kittiwake – 0.2 ACH

− Shearwater – 0.07 to 0.33 ACH (depending on external wind speed).

It would be expected that new build or modern platforms should have higher air tightness than older platforms.

In the absence of actual tests, analysis tools such as AIDA [19] may be used. The AIDA model is a `single zone' model in which individual flow paths are defined in terms of location, flow exponent and coefficient and local pressure coefficient.

[4] Uptake



Personnel that are sheltered in a place of safety, such as the TR, may be exposed to the long term effects of CO inhalation. This may result in the build up of carboxyhaemoglobin which may result in impairment of their decision making process and, if exposure continues beyond impairment, ultimately death.

The uptake of CO and build up of carboxyhaemoglobin is discussed in more detail in Section 6.9.3.

6.9.1 Source Term

The source term depends on the fire type, fuel, compartment geometry, venting and leak position. In 1993 a series of large scale compartment fire tests were conducted which enabled some general guidance regarding CO levels, soot production, flame lengths and temperatures to be developed. This guidance has been presented in [20] and summarised next.

When a fire burns inside a compartment the combustion starts as though the fire were in the open. There is enough air already present to satisfy the burning requirement. The hot combustion products rise to the ceiling and spread out as a ceiling jet. There is a net outflow of material through the compartment openings as the gases heat up. After a short period of time a hot gas layer of combustion products builds up in the upper part of the compartment and starts to descend as combustion gases continue to flow into it. A relatively well defined interface forms between the upper hot layer and cool air below. When this interface descends below an opening there is a sudden outflow of smoke, combustion products or flame. An equilibrium is soon established between the hot gases flowing out and the air required for combustion flowing in. This bi-directional flow is separated by a neutral plane, where it is assumed that no flow occurs. If the amount of air supplied is insufficient for complete combustion the fire is ventilation controlled. Air is entrained along the plume up to the interface.

In a fully ventilated flame, hydrocarbons are almost completely oxidised to carbon dioxide and water in a complex series of reactions involving radical intermediates. The principal source of carbon dioxide is via oxidation of carbon monoxide by OH and OH2 radicals. The maximum possible CO concentration is about 15% by volume but this assumes that all carbon in the products is present as CO.

Fire Regime Location %CO by Volume

Well Ventilated Fires Jet fire flame tip 0.1%

Pool fire 0.5%

Inside the flame 6%

Ventilation Controlled Fires Smoke at the vent 5%

Flame tip external flame 0.5%

Table 6-4 – Source CO Values for Various Fire Scenarios



The methodology is known to produce a set of conservative smoke ingress times and therefore the source term is generally selected as being the value at the flame tip i.e. 0.1% or 0.5%, depending on the fire type.

6.9.2 Movement

This establishes the conditions at the opening through which the smoke emerges, the initial smoke speed, the initial smoke temperature and the combustion regime.

From the perspective of understanding smoke movement, an offshore installation is a large and irregular box, supported in space on legs. Most offshore installations in the North Sea share this similarity although they may differ in most of the detail. At the engineering level of approximation required, it is the gross similarities that matter rather than the detailed differences and the offshore installation can therefore be treated as a roughly rectangular box suspended in space. The gross flow about the installation can also be treated quite simply: the airflow separates at the windward face of the platform and does not re-attach. Thus, other than on the windward face of the platform, the smoke moves in a large, separated and highly turbulent flow. The major consideration is only when the smoke impinges on the Temporary Refuge and in particular, the worse case when the smoke engulfs the TR.

In the majority of cases the smoke from the fire will emerge through an opening in a module and be carried away by its own momentum and the wind. The turbulence in the wind and the smoke plume will draw air into the plume, dilute the smoke and spread it out as it moves downstream from the fire source. The smoke plume also meanders and can flip back and forth from one side of an obstacle to the other. In this instance the time averaged plume will broaden to surround the obstacle and show a corresponding dilution. If the meandering of the plume is fast compared to the time scale for accumulation of smoke in the temporary refuge it may be averaged without error. In practice, the build up of smoke in the temporary refuge occurs over a time scale of about one hour, while the plume meander occurs on a time scale of a seconds, so the error is small.

A wide variety of obstructions are likely to be present on offshore installations and the complexity of these obstructions makes it difficult to assess the effect on smoke plumes. For this reason historical work on smoke plumes has been based on free plumes in unobstructed space. In reality, the mixing and dilution process is more complex than this. On the one hand, increased turbulence about the installation will increase the dispersion of the smoke, while on the other hand, smoke released into the wakes of modules may be partly sheltered from the wind so the dispersion would be reduced. Detailed wind tunnel modelling was undertaken during the design of the Shearwater installation and the results from the model used in the Shearwater QRA. Comparison of these wind tunnel results with the results obtained for other platforms using the unobstructed plume model shows that this plume model generally produces conservative CO concentrations at the TR.

It is important to remember that the dimensions of the smoke layer are not necessarily the dimensions of the hole through which the smoke emerges as the smoke can be a layer at the top of the opening. The characteristic dimension of the smoke required for what follows is the square root of the smoke area at the module exit, with the smoke area taken to be half the available vent area.

The temperature has been found to be not important other than in very low wind conditions when the smoke rises steeply away from the platform. This is because of the rapid cooling that takes place when the smoke mixes with the wind.



The equations given below are recommended for calculating the smoke concentration as a function of distance from the smoke source when the smoke is released into a separated region of flow such as the top deck.

These equations are not applicable to smoke released out of the side of the platform and then blown up and over the top deck to the Temporary Refuge. This is the subject of continuing research but the equations given here may be used as a conservative approach. Further advice and guidance on modelling this condition is available from SRTC-Thornton.

2.1

0

.2−

=

dx

CC

, for w

o

uu

≥1 and 2.1

0

.2−

=

dx

uu

CC

w

o , for w

o

uu

≤1 (M1)

where, C is the concentration at the target (ppm); Co is the source concentration; uo is the initial smoke velocity (m/s); uw is the initial wind speed (m/s); x is the distance from the source to the target location (m); d is the smoke characteristic length (m).

It is clear from the equation above that the worst case smoke dilution will result when the resulting smoke speed is greater than or equal to the wind speed. Therefore, the analysis pessimistically assumes a smoke speed of 10m/s and a corresponding wind speed of 10m/s to produce a conservative assessment of the smoke dilution.

The smoke characteristic length is calculated by assuming that the smoke layer emerging from the module vent will not occupy the entire vent area. This is because the smoke will rise to the top half of the module, being naturally buoyant, and the level below the smoke will be relatively free of toxicants. The smoke characteristic length is calculated based on the following equation :

2

VentAread = (M2)

6.9.3 Mixing and COHb Build Up

The calculation of CO build up is achieved using a CSTR type equation as shown next:

))(1.( tVQ

eCextCi −−= (M3)

where, Cext is the exterior concentration %vol calculated outside of the TR; Ci is the interior concentration % vol within the TR, Q/V is the airchange rate in the LQ or TR measured in terms of a number of air changes per hour in which Q is the volume flow into the TR and V is the volume of the TR, and t is the duration of ingress or endurance time in hours.

Inhaled carbon monoxide passes through the alveolar capillary membrane in the lungs and combines with deoxygenated haemoglobin to form carboxyhaemoglobin, (COHb), a compound which is incapable of transferring oxygen to the tissues, thus giving rise to symptoms of breathlessness, confusion, convulsions and, ultimately, death. The rate of poisoning depends upon the frequency of ventilation, lung function, rate of diffusion of the gas into the tissues and the oxygen concentration of the inhaled gas. The rate of ventilation is



itself accelerated by exposure to CO and other gases which are likely to be present, such as CO2. COHb has a half-life in the body of 4-4.5 hours and low environmental levels of CO are therefore extremely toxic due to a cumulative effect. An additional consideration is the initial COHb concentration in the body. Smokers may start with a base concentration of up to 5%, non-smokers with 0.7%.

The capacity to perform work starts to become limited at 4% COHb. Shortness of breath may be apparent below 10% COHb with vigorous exercise and 20% with moderate exercise.

Shell Expro consider that at COHb levels of 15% impairment occurs and that death can be considered at 50% COHb.

Shell Expro has traditionally used a dynamic model developed by Coburn, Foster and Kane, (CFK), for modelling carboxyhaemoglobin build up over time. This model was developed from the study of male volunteers inhaling carbon monoxide levels between 0.4 and 20 ppm but was subsequently validated by Peterson and Stewart for much higher exposures. It is still considered valid for the range of concentrations and time likely to be encountered in an offshore incident and good correlations with actual COHb in pure carbon monoxide atmospheres have been observed. However, the CFK model is not formatted conveniently for spreadsheet applications typical of the QRA model and does not take account of the presence of other gases which may potentially be present.

There has therefore been a move towards using a static model developed by Forbes. The original form of the Forbes equation was modified by Clark to take account of the effects of CO2 which acts to increase the ventilation rate accelerating production of carboxyhaemoglobin. The equation that is used is:

%COHb = K x c x %CO inhaled x minutes of exposure (M4)

where, K is a constant which varies according to the level of exercise and should be taken as 8, corresponding to an external work load of 50W, ventilation rate of 18 l/min and pulse rate of 110 per minute; c is a constant depending on level of carbon dioxide and is given by; c = 1.0 for no ambient carbon dioxide (used in the QRA) = 1.2 for 1% carbon dioxide = 1.5 for 2% carbon dioxide = 1.8 for 3% carbon dioxide

Intermediate values can be found by calculation.

It should be noted that the output from the calculation is in the form of increased COHb above the background level.

This methodology is conservative in that the calculation of increased COHb is based on the CO level at the end of the exposure time being assumed to be constant throughout the exposure period. To some extent, this may account for a more rapid build up of CO in the early stage of a fire before the HVAC system is shutdown and whilst mustering is ongoing resulting in a higher TR leakage rate as doors are opened and closed.

6.10 Heat Stress Modelling

Impairment of personnel within the TR may occur as a result of heat stress. During the mustering process, a number of personnel will be located within their allocated muster



location. At the same time, the TR may be engulfed in a hot smoke plume or be directly impinged upon by flame. This combination of internal body heat and external hydrocarbon heat may result in heat stress impairment.

The methodology used to calculate heat stress impairment is detailed in the Shell Expro Heat Stress User Manual [21] and is not repeated in any great detail here. The spreadsheet tool HEATS was developed by Shell Expro and should be used to calculate the time to impairment of the TR from heat stress.

The user manual [21] provides details of the inputs required for the program. The inputs required include details of the external environmental conditions, external heat flux, materials of construction for the TR, internal mustering conditions, volume etc.

There are a number of outputs from the model including build up of temperature inside the facility, wall temperature distribution curve but most importantly the build up of energy stored with time. Impairment of the TR is considered to occur when this value reaches 50 W hr/m2, although fatalities are not taken to occur at this level. Instead it is assumed in the QRA that at this level of energy stored, personnel will attempt to escape the TR where they may be overcome by the effects of other hazards i.e. smoke, thermal radiation etc.

The calculation of heat stress is generally based on the TR being engulfed in a hot smoke plume, rather than from direct flame impingement which may impact only part of the TR. As such TR impairment may result from either smoke ingress or heat stress impairment in this manner, and not from both. In the QRA’s developed to date, it has generally been found that smoke impairment occurs before heat stress impairment and that the limiting factor for heat stress impairment is connected with the number of people and size of the muster area, rather than external conditions.



7. IGNITION MODELLING

Ignition of a hydrocarbon leak is influenced by several parameters. Ignition mechanisms are dependent upon:

− Phase of material being released;

− Pressure of the air/fuel mixture;

− Concentration of the air/fuel mixture;

− Cause of the leak;

− Strength of local ignition sources;

− Number and location of ignition sources;

− Duration of the contact between an air/fuel mixture and a local ignition source;

− Composition of the fuel.

There are a range of ignition sources:

− Background sources : Non-specific sources such as faulty electrical equipment and static;

− Specified sources : Welding, exhausts, engines/motors, flares, hot surfaces and humans;

− Initiating event : Sparks generated by metal impact or rupture upon failure.

There are a number of ignition models that could be applied to the QRA methodology however it has been considered, quite appropriate, to use ignition probabilities based on Shell Expro historical data. There are essentially two models that can be applied and these depend on whether the module is naturally ventilated or enclosed.

A project is currently being managed by UKOOA which may result in an updated set of ignition probability models.

7.1.1 Historical Shell Expro Ignition Data (Enclosed Modules)

The Shell Expro data of ignited events has been analysed previously [22]. Based on this analysis, a small number of ignited leaks, considered characteristic of events modelled in QRA, were identified from all reported ignited events.

If the total number of leaks are known, the ignition probability can be simply estimated as the ratio of ignited to unignited leaks. If the sizes of all the leaks are known, estimates of the ignition probability for different leak sizes can be derived.

Leak size ranges have been based on consideration of the consequences of fires resulting from ignition of the leak. Three size ranges corresponding to local effects (less than 5m flame from jet fire), module wide effects (5m to 20m flame) and external or installation wide effects (greater than 20m flame) were used. The corresponding release rate ranges were small (0.03kg/s to 0.05kg/s), medium (0.05kg/s to 3.5kg/s) and large (greater than 3.5kg/s).

Historical data on unignited leaks, up to 1987, has been characterised in five ranges, less than 0.05kg/s, 0.05kg/s to 0.5kg/s, 0.5kg/s to 1.5kg/s, 1.5kg/s to 3.0kg/s and 3.0kg/s to 7.5kg/s [23]. This report analysed 183 reported leaks but only 137 were regarded as



potentially continuous leaks for which a release rate could be estimated. The remaining, discrete leaks were only analysed in terms of the total quantity released. From the definition of continuous and discrete leaks, it is considered that only those defined as continuous are relevant for QRA predictions.

The ignited leak analysis [22] is based on a different time period to the analysis of unignited leaks referred to above. The number of reported unignited leaks during most of the same period as that of the ignited leaks is available [24]. This, however, was not presented in terms of size distribution nor classified as continuous or discrete. It is assumed that the size distribution and ratio of continuous to discrete leaks has remained the same throughout the period covered by the leak data. The report on leaks [24] identifies 294 leaks. Assuming that the proportion of continuous leaks remained constant, this represents a total of 220 continuous leaks split as 42 small, 165 medium and 13 large.

There were 8 ignited leaks characteristic of events modelled in QRA identified in the analysis [22] and the reports of these events were examined to determine the probable size of the original leak. It is difficult to estimate the leak size accurately and since the small leak in the QRA covers such a narrow range it was not considered appropriate to try to distinguish among medium, small and those below the lower limit of small. The 8 leaks were therefore only characterised as large or not large. None of the leaks remained within the large category throughout their duration but one was certainly within the large category initially and another may just have exceeded large initially. For this reason 7 events were characterised as not large and one event was large.

The total of small and medium unignited leaks is 207 and the estimated ignition probability is 7/207 = 0.034. Similarly the ignition probability for large leaks is estimated to be 1/13 = 0.077.

Therefore, based on analysis of the limited, uncertain historical data the estimated ignition probabilities are:

− “small” (0.03 - 0.05 kg/s) 0.034;

− “medium” (0.05 - 3.5 kg/s) 0.034;

− “large” (> 3.5 kg/s) 0.077;

− “very large” (say > 20 kg/s) 0.3 (assumed, no historical Expro data)

These classifications of small, medium & large releases may not necessarily correspond to the 3mm, 10mm & 50mm hole sizes modelled in the QRA. A high pressure 3mm hole size may result in a “medium” ignition probability from the values above.

It is not possible to distinguish between small and medium on the basis of the data available. As several of the ignited leaks were very small, unignited leaks of this size may not have been detected and therefore under reported in the data. The ignition probabilities for the small leaks may therefore be overestimated which will lead to conservatism in the QRA analyses.

On the basis of the limited historical data no difference can be demonstrated between different installation conditions such as open or closed modules. However, it is likely that the potential for significant gas cloud sizes to build up in naturally ventilated modules will be less then for enclosed, forced ventilation model. Therefore, the Natural Ventilation Ignition Model discussed in Section 7.1.2 should be used for such modules.



There are no data on the effect of the fluid released on ignition probability and it is considered appropriate to continue to treat liquid releases in terms of gas evolved in determining the size of release and the corresponding ignition probability. A minimum ignition probability corresponding to a small gas leak should be used even when minimal gas is evolved.

In October 1992 Shell Expro started to submit OIR/12s, as did all other Operators on the UK Continental Shelf, with details of hydrocarbon releases and ignitions to the HSE. In the period between October 1992 and December 1996, Shell Expro submitted around 60 OIR/12s which would probably come into the continuous leak category. None of these leaks ignited.

The above ignition probabilities will continue to be used for analyses based on historical data until such time as relevant updated information is made available. It is considered that such analyses will necessarily be conservative.

7.1.2 Natural Ventilation Ignition Model

The ignition probability model proposed in this section is intended for application only to naturally ventilated modules and open areas of offshore oil and gas production platforms. Modules that are predominately ventilated by mechanical means should use the historical model described previously. The NVI model has two components, a fixed minimum ignition probability that is independent of release rate and a variable ignition probability that is dependent on the size of the flammable gas cloud produced by the release. The fixed minimum ignition probability of 0.01 is proposed, with a maximum of 0.3 taken from Cox, Lees and Ang [38].

The volume of the flammable gas cloud can be shown to be proportional to the release rate raised to the power 1.59. Assuming that all background and specified ignition sources have the same characteristics and are uniformly distributed within the area of the release then it follows that the ignition probability will be proportional to the volume of the flammable gas cloud. The calculation for the volume of flammable gas cloud is based on a free field dispersion which does not take into account the effects of adjacent equipment and module walls on the dispersion.

The volume of the flammable gas cloud has also been shown to be inversely proportional to the wind speed raised to the power 1.59 and this relationship can be used to indicate the likely difference between naturally and mechanically ventilated modules.

The ignition probability Pi is therefore based on the following relationship:

Pi ∝ m1.59 + 0.01 (N1)

where m is release rate in kg/sec units.

The calibration of this model was made using blowout data on the drill floor, a naturally ventilated area. The model is shown in Figure 7-1.



0.001

0.01

0.1

1

0.01 0.1 1 10 100

Release Rate, kg/s

Ign

itio

n P

rob

abili

ty, P

i

Figure 7-1 – Probability of Ignition for Naturally Ventilated Module

The Equation N1 can be expanded to produce the following equation :

Pi = 0.00058 x m1.59 + 0.01 (N2)

7.1.3 Ratio of Fires to Explosions

Depending on the time and conditions when ignition occurs, either a fire or an explosion followed by fire may result. In this context an explosion is an event that develops a significant overpressure and excludes a flash fire. Historically the overall ratio of fires to explosions (followed by fire) is about 60:40. For small releases, as bounded by the outflow rates in Section 7.1.1, an explosion will not occur unless a sufficiently large cloud of flammable gas is formed. As the small release range is that for which a module would not be filled with flammable gas, it is assumed that only fires result from small releases. An explosion is considered more likely for large releases as extensive flammable volumes could occur. Therefore a delayed ignition probability of 0.5 is recommended for large releases.

The ratio of fires to explosion for each release range is then:

small release 100:0 fire:explosion medium release 60:40 fire:explosion

large release 50:50 fire:explosion

Again, the release classification may not match exactly with the 3mm, 10mm and 50mm hole sizes used in the QRA as the outflow rate will vary depending on the initial release pressure.

These ratios are taken to conservatively apply to both the Historical and Naturally Ventilated models discussed in Sections 7.1.1 and 7.1.2.



8. FUNCTION OF SAFETY SYSTEMS

8.1 Reliability of the Safety Systems

The QRA generally models the following safety systems :

− Fire and Gas Detection (F&G);

− Isolation (ESD);

− Depressurisation / Blowdown (BD);

− Firewater / Deluge;

− TR HVAC.

Each of these systems are discussed in more detail next.

8.1.1 Fire and Gas Detection (F&G)

The fire and gas detection system is critical for the detection of leaks from the processing equipment, ideally before flammable concentrations or ignition has occurred. If ignition does occur to result in a fire then the system may still be effective to detect the presence of the fire and initiate an appropriate action. If an explosion results that damages the fire and gas system then it is considered that the system in the initial module will no longer function but that detectors in adjacent modules may still function and be able to monitor the escalation of the fire event. An explosion is likely to alert platform personnel to the presence of a release and in such cases the fire and gas system can be considered to be redundant.

The actions initiated by the fire and gas detection are taken from the platform Cause and Effects drawings.

The reliability of the fire and gas detection systems are taken from the relevant Instrument Protection Function (IPF) for the asset group and for all installations, with the exception of Shearwater, is taken to be 90%. The reliability of the Shearwater Fire and Gas detection system is not included in the Shearwater QRA due to the high reliability of the system to function on demand.

8.1.2 Isolation System

One of the main actions of the fire and gas detection system is most likely to be to actuate the ESD valves on the platform, which will sectionalise the process into discrete inventories and reduce the potential for long duration release to occur. The reliability of the ESD system discussed here is taken to apply to topsides ESDVs, subsea wellheads tied back to platforms and riser ESDVs. Releases from topside wellheads to result in an uncontrolled release from the well are treated as blowout events, see Section 4.1.2.2

The reliability of the isolation system on all of the installations is taken to be 97% based on IPF details provided by Shell.



Where the hydrocarbon release results in an explosion of sufficient magnitude to cause process disruption, then it is also likely that the ESD valves in the module may be damaged, unless they are specifically protected against explosion events. The reliability of the ESD system should therefore take into account the potential increase in failure of the system from explosions exceeding 1 bar. Where the ESDV is located outside of the module that the release occurs in then the potential explosion from the release is unlikely to fail the valve and therefore the reliability can be assumed to be the same as for a fire event.

If the fire and gas detection system fails then it is assumed that there is an increased probability of the ESD system failing to operate. The QRA assumes that on F&G failure there is a 0.3 probability [25] that the operator will take an inappropriate action and not manually activate the system. This would result in the reliability of the system reducing from e.g. 97% to 67%.

8.1.3 Blowdown System

The blowdown system acts to depressurise the isolated inventory, within a fixed period of time, to limit the escalation potential of a release. The inventories are generally depressurised to a common header and then released through the flare.

The duration that the system takes to blowdown will depend on the criteria that it is designed against i.e. API 521 depressurise to half the initial design pressure or 6.9 barg, whichever is the lower, in 15 minutes. The methodology used to model the function of the blowdown system was discussed previously in Section 5.

The reliability of the blowdown system on all of the installations is taken to be 97% based on IPF details provided by Shell.

In a similar manner to the isolation system, the potential for explosions greater than 1 bar to damage the system and prevent correct function should also be taken into account.

The current Brent, CADA and TENC QRA’s assess the consequences of isolation and blowdown failure separately such that the following 4 failure conditions are modelled :

− Isolation OK, blowdown OK;

− Isolation OK, blowdown fail;

− Isolation fail, blowdown OK;

− Isolation fail, blowdown fail.

This enables a more detailed assessment of the safety systems to be made to determine which ones are more critical in limiting the escalation potential on the platforms.

The Mature Asset and Central Graben QRA assesses only two failure conditions, namely isolation and blowdown working OK and then failure of one or more safety systems to result in the worst case hydrocarbon event. Failure of the isolation and blowdown system concurrently will always produce the most onerous consequences, however this must be weighed against the likelihood of such an event to occur. For example, if blowdown failure results in a fire of similar consequences to isolation and blowdown failure then this single system failure should be taken forward to the QRA as the probability of such an event occurring will be higher.



8.1.4 Deluge System

The purpose of the firewater or deluge system is to limit the potential consequences of a fire or explosion event. The effectiveness of the system against such hazards is discussed in more detail in Section 8.2.1. The deluge system may be of a general area type or specific to a certain vessel or structure. In addition, the system may have the ability to inject AFFF into the firewater supply to produce foam which may be more effective against certain types of fire. In all cases, the reliability of the system to activate on demand is assumed to be the same.

The reliability of the deluge system on all of the installations is taken to be 90% based on IPF details provided by Shell. The exception to this is Shearwater where the reliability of the deluge system is set to 97% based on a review of the system during the design stage.

Again, the potential for explosions to damage the deluge system must also be taken into account in the reliability values above. The reliability values are taken to include the entire firewater system, from the firewater pumps through to the sprinklers.

8.1.5 TR HVAC

The HVAC system on the TR is likely to shut down on detection of gas at the inlets, or in some cases on the processing plant, and smoke at the inlets, or processing plant. With the fans shut down and dampers closed then the integrity of the TR will improve as the potential for the ingress of smoke or gas should have reduced.

The reliability of the TR HVAC system on all of the installations is taken to be 99.7% based on IPF details provided by Shell. The exception to this is Shearwater where the reliability of the TR HVAC system is set to 97.87% based on a review of the system during the design stage.

8.1.6 Other Systems

Other safety systems that may be considered include High Integrity Pressure Protection Systems (HIPPS), which may typically protect topsides equipment from new, higher pressure tiebacks for which the equipment was not originally designed, and SSIVs.

For these and any other safety systems fault trees should be developed by competent Shell Expro or Atkins reliability engineers. The reliability databases should include up to date information on the components of the systems being considered i.e. OREDA ’97 [26] and it should also be ensured that the correct components are being modelled. For example, shut down valves on HIPPS systems would tend to have a much higher reliability, i.e. Mokveld valves, than typical process ESD valves.

The calculation of SSIV reliability should make reference to the reliability data contained in [27].The Subsea Isolation Valve (SSIV) refers to the primary valve installed at a subsea pipeline location which closes in the event of a loss of pressure in the pipeline, loss of actuator pressure or by remote manual operation from a control point. SSIV are generally ball or gate valves fitted with an actuator which may be mechanical spring return to the closed position, gas spring return or double acting. In some cases a check valve may be used as an SSIV and credit is given for this in the QRA as long as the valve is regularly maintained and tested. Subsea Isolation System (SSIS) is the term used to denote all



components of the system required to control the SSIV. The SSIS includes the following components:

− SSIV and pipework valve assembly;

− actuator and power system;

− subsea and topside control facilities and umbilical;

− subsea support frame and protective structure.

The primary objectives of a SSIV are to isolate the pipeline and prevent flow of its inventory back to the leak point in the event of pipeline loss of containment on or near the platform. The requirement of a SSIV and its contribution to the platform safety, needs to be evaluated during the Safety Case Assessment.

8.1.6.1 Reliability and Availability

Records of 123 SSIV covering a total operating experience of 388.5 years have been analysed in [27]. The operating experience includes the following types of valves:

SSIV Type

Operating experience (years)

Check Valve 49 Ball Valve (spring return actuator) 190 Ball Valve (double acting actuator) 98.4 Gate Valve (spring return actuator) 51.1 Total for all valves 388.5

Table 8-1 – Types of SSIV Considered

The control systems associated with the SSIV were also included in the study and the operating experience for control system items ranges from 11.2 to 170.8 years. The range of operating experience reflects the different arrangements of control systems and the use of common control systems for more than one SSIV.

Control item

Operating experience (years)

Multiplexed control system 11.2 Solenoid valve 170.8 Pilot valve 170.8 Accumulator bank 94.6 Umbilical 170.8 Hydraulic power unit 119.1

Table 8-2 – SSIV Control Systems

The following events were considered to analyse the failure modes of SSIV in [27] :



− failure to close on demand;

− spurious valve closure;

− subsea intervention required;

− availability to allow product flow.

Failure rate data for each item and relevant failure modes are derived in [27] and are summarised in Table 8-3.

Nine different configurations of SSIV were identified in the study and reliability and availability parameters were determined for each configuration. The data are summarised in Table 8-4 with brief descriptions of the configurations, but [27] should be consulted for the exact details.

Item Failure Mode Failure Rate per year

Check valve Fail to close 1.2E-3 External leak 2.9E-2 Manual gate valve External leak 7.5E-3 Gate Valve Fail to close 1.3E-2 External leak 2.0E-2 Manual ball valve External leak 5.2E-3 Ball Valve Fail to close 2.9E-3 External leak 5.3E-3 Actuator Fail to close 2.5E-3 External leak 9.0E-3 Umbilical Ruptured 4.2E-3 Blocked 3.1E-3 Accumulator bank No output 9.7E-3 Pilot valve Fail to close 1.3E-2 Spurious operation 1.9E-2 External leak 2.2E-2 Internal leak 6.3E-3 Solenoid valve Fail to close 1.3E-2 Spurious operation 3.1E-3 External leak 1.3E-2 Multiplex control system Fail to close 9.2E-3 Spurious operation 4.6E-2 Hydraulic power unit No output 1.6E-2

Table 8-3 – Failure Rates for SSIV Components



Configuration Probability of failure to close on demand

Spurious closure

per year

Subsea intervention

per year

Production availability

A. Spring actuated gate valve and manual gate valve in series

2.16E-2 8.25E-2 1.1E-1 99.87

B. Check valve and manual ball valve in series

6.00E-4 - 3.4E-2 99.977

C. Spring actuated ball valve and manual ball valve in series

9.00E-3 5.55E-2 4.2E-2 99.957

D. Double acting actuated ball valve and two manual ball valves in series

1.90E-2 5.35E-2 8.1E-2 99.94

E. Two spring actuated ball valves and one manual ball valve in series

1.76E-3 9.50E-2 7.0E-2 99.92

F. Spring actuated ball valve and manual ball valve in series with bypass round actuated valve

9.00E-3 5.55E-2 4.7E-2 99.996

G. Two double acting actuated ball valves and manual ball valve in series

4.90E-3 8.68E-2 1.8E-1 99.89

H. Two double acting actuated ball valves and manual ball valve in series with bypass round actuated valves

4.90E-3 8.68E-2 1.8E-1 99.997

I. Check valve and spring actuated ball valve in series

5.40E-6 5.55E-2 6.5E-2 99.957

Table 8-4 –SSIV Reliability and Availability for Various Valve Configurations

8.2 Effectiveness of Safety Systems

8.2.1 Deluge

Theoretical and experimental work suggests that fire water deluge systems can be given some credit for cooling of equipment or structures engulfed in jet or pool fires. Deluge, activated on high gas detection, can also be a means of mitigating against potentially high explosion overpressures. The benefits of such activation should be assessed on a case by case basis using the SCOPE or ESXIM tools and therefore is not discussed further here.

For Shell Expro QRA’s the following values for effectiveness of deluge, against escalation and structural failure, are used.



Initiating Event Fire Type Percent Effectiveness

Water Only Deluge,

Percent Effectiveness AFFF Deluge

Jet Fire - small, medium, large Object in high momentum region

0 0

Jet Fire -small

Far field region

100 100

Jet Fire - large

Far field region

90 95

Pool Fire - small 100 100

Pool Fire - large 90 95

Table 8-5 – Deluge Effectiveness for Various Fire Scenarios

The classification of fire size will be judgemental to some degree, but will relate to the size of the fire compared to the area of release. In the absence of more detailed information, the following values can be used to determine an approximate fire category:

Small fire 0.1 kg/s representing 0.03 kg/s to 0.3 kg/s release rates

Medium fire

1.0 kg/s representing 0.3 kg/s to 3 kg/s release rates

Large fire 10.0 kg/s representing 3.0 kg/s to 30 kg/s release rates

Deluge is also taken to provide direct mitigation against the effects of smoke as well as against possible escalation to produce larger fires that may also result in smoke impairment. Recent tests conducted for FABIG [28] have shown that smoke attenuation is greatly reduced on deluge activation, or indeed from high water cut well releases.

Deluge is taken to have the same effectiveness properties directly against smoke as shown for the values in Table 8-5 for fires that are less than half the average dimension of the module of release. Where the fire is greater than this criteria then deluge is not taken to be effective against smoke production. Larger fires may produce external flames, for which deluge would be effective, but it is assumed that such fires would still produce sufficient smoke within the module, that deluge would not be able to control.

Under no circumstances is deluge considered to extinguish any of the fires assessed in the QRA.



9. ESCALATION POTENTIAL

The treatment of escalation from the initiating event to a final outcome, i.e. TR impairment, is critical to ensure that the risk distribution on the Installation is correctly represented. To achieve this, the Best Practice approach to escalation should include :

− Offshore Visits – to gain a true understanding of the escalation routes on the Installation,

− Escalation Review Meetings – structured meetings to postulate and record potential escalation routes and probabilities of impairment with engineers experienced with the particular Installation under review.

This section describes the general escalation rule sets applied to Shell Expro installations. The details of escalation on specific platforms is not addressed here, but such details would be found in the escalation review meeting minutes, impairment calculations and QRA reports for the particular Installation.

9.1 Gas Spreading To Other Areas

Gas released within a process module, migrating out of the end of a module and back into an adjacent module is not currently modelled in the QRA. For open, naturally ventilated modules the likelihood of such an occurrence would be low as the gas would tend to be vented in one direction, away from the platform, and therefore unlikely to blow back in to an adjacent module.

Non-hazardous areas are generally pressurised above ambient conditions and therefore the potential for migration into such areas is also low. However, gas dispersion from the release module to the TR is considered as failure of the TR HVAC system to shut down and could result in rapid impairment if the gas is sucked into the TR and ignites within.

Gas released from risers or underdeck pipework could disperse upwards and into the main platform area, particularly if the cellar or lower deck is grated. Such releases may increase the ignition potential for underdeck releases, as there are likely to be more ignition sources in the process modules than underdeck. However, the ignition probabilities currently used in the QRA are considered to be conservative and take account of ignition occurring in this manner.

9.2 Explosion Escalation / Exceedance Methodology

Assessing the consequences of an explosion in an offshore module can be complex. An explosion may result in the following consequences :

− Low overpressure that does not result in additional damage above the fire only event;

− Additional escalation to process equipment resulting in a fire of greater size than a fire only event;

− Boundary failure to result in escalation to adjacent modules;

− Structural failure to result in sudden and direct collapse of the TR;

− Tall structure collapse;



− Direct TR impairment from external explosions.

The explosion exceedance methodology is used to determine the probability of a specific target failing from an explosion. The methodology applied to the current Shell Expro QRA’s is defined next.

9.2.1 Calculation of Explosion Overpressure

The methods used to calculate the maximum explosion overpressures on offshore platforms were discussed previously in Section 6.8. The SCOPE model initially assumes a worst case initial condition of a module completely filled with a stoichiometric gas mixture. For small releases and/or in well ventilated modules, the possibility exists of gas explosion when the module is only partially filled with flammable gas. In the QRA an allowance is made for the lower overpressure and hence reduced risks that may result. The SCOPE explosion assessment tool can also be used to determine explosion overpressures with the module partially filled with a stoichiometric mixture of gas. Typically, in practice, the overpressure for partially filled modules approaches the overpressure for completely filled modules at a fill ratio of about 25-30%. The output from the EXSIM simulation shows a similar effect. The effect is shown in Figure 9-1 for a large module (22,000 m3).

Experiments in partially filled, semi-confined geometries confirm the reductions in overpressure that are predicted to occur. An important consequence of partial filling is that the external explosion is significantly reduced.

0.00

0.20

0.40

0.60

0.80

1.00

0 20 40 60 80 100

Percentage of Module Filled

Ove

rpre

ssu

re R

elat

ive

to F

illed

Mo

du

le

EXSIM

SCOPE

Figure 9-1 – Effect on Internal Explosion Overpressure From Partially Filling a Module

From this figure, it can be postulated that the following relationship exists between a partially filled module and the explosion overpressure :

Partially Filled Overpressure (bar) = Maximum Predicted Overpressure(bar) x Partial Fill Factor (O1)

Where;



Module Fill < 25%, Partial Fill Factor = 4 x Fraction Module Filled with Stoichiometric cloud;

Module Fill > 25%, Partial Fill Factor =1.

These partial fill factors are taken to conservatively apply to the internal overpressure and overpressure at the TR. The actual TR overpressure is likely to be lower than that predicted using the equations above. For modules where the overpressure at the TR is critical then the SCOPE model could be used to determine the overpressure at various partial fill volumes or a more detailed explosion assessment tool, such as EXSIM, could be used.

The fraction of a module filled with a stoichiometric cloud is calculated based on the gas build up methodology described in Section 6.1. The maximum gas concentration is converted to an equivalent stoichiometric fill size i.e. a gas concentration of 5% methane equates to a module fill of 50% if the stoichiometric concentration of methane is taken to be 10%. This will produce a conservative estimate of the cloud size.

9.2.2 Severity Index

In order to obtain confidence intervals to allow for uncertainty in the SCOPE model predictions, the use of a 'severity index' factor has been introduced. The severity index is equal to the overpressure in bar at low pressure but is defined to increase by the same ratio for a similar perturbation (an increase in laminar burning velocity) whether at high or low pressure. Thus the severity index eventually increases much faster than the overpressure. This is fully explained in [29]. The severity index S is directly related to the overpressure P by the following expression:

S P PP P

=−

−

−

*exp . * *

.*

..

69151

78881

22593109

(O2)

(validity range: P < 7 bars, or S < 210)

The curve showing the relationship between P and S is shown in Figure 9-2. The severity index is used by translating the predicted SCOPE prediction to an equivalent severity index and applying a factor to take into account the uncertainty relating to the prediction. The factored severity index can then be translated back to an equivalent value of overpressure. The factor applied to the severity index generally relates to the version of SCOPE used to determine the explosion overpressures. For the current Shell Expro QRAs, no factors are applied to the severity indices except for Goldeneye where a factor of 2 was applied during the design phase of the installation.



Figure 9-2 – Relationship Between Severity and Overpressure

9.2.3 Explosion Overpressure At TR

The explosion overpressure generated at the TR, or other far field critical objects, is an important parameter in the calculation of risk. During the explosion process, unignited gas may be expelled out of the end of a module by the expanding, burning gas within the module. If this gas cloud ignites then there is the potential for an external explosion to be generated. Overpressure generated by this explosion may decay towards the TR where it may still be high enough to result in damage to the TR structure or cladding.

These external overpressures can be generated by the SCOPE, CAM or EXSIM models described in Section 6.8. The EXSIM model is able to include the external areas outside of a module as part of the mesh being analysed and therefore some confidence can be placed in the results predicted by this model. The SCOPE and CAM models calculate the external overpressure at a distance based on the pressure decay being inversely proportional to the distance from the source overpressure.

The external explosion overpressures at the TR are factored to account for the potential reflection element of the propagating wave reflecting off other structural elements or the sea



to arrive coincidentally with the line of sight wave. All installations apply a factor of 2 to the SCOPE line of sight element to account for reflection.

The EXSIM external explosions are not factored in this way as the calculated overpressure at a distance will already include any reflection element.

9.2.4 Exceedance Curves

Two parameters whose variation may give rise to reductions in the overpressure are the gas concentration at the time of ignition and the location of the ignition.

The effect of ignition location on peak explosion overpressure can be established from the curves in Figure 9-3. Each curve represents a particular module type which are classified in Figure 9-4.

The variation of the overpressure with stoichiometry is shown in Figure 9-5 and Figure 9-6 for methane and propane respectively. The distributions take into account the difficulty in igniting the gases at a certain range within the flammability limits.

Finally, the distributions for ignition location and gas concentration have been used to generate generic exceedance curves as shown in Figure 9-7. These curves provide the probability of exceeding a specified design overpressure given a predicted overpressure within a module. The curves presented are for methane but due to the similarity between the methane and propane curves the methane curves can be used for all assessments. A detailed account of the derivation of the various curves is given in [30].

The generic exceedance curves are used on the Mature Asset and Central Gaben Assets, although some of the modules on the Shearwater platform have had area specific curves developed, which are discussed later.

The generic curves do not account for the situation where the predicted overpressure lies just below the design overpressure. In such cases, uncertainty in the design or explosion prediction may result in failure occurring. To account for this, extended exceedance curves have been developed from the generic curves discussed above. These extended curves are shown in Figure 9-8 and used on the Brent, CADA and TENC assets. All generic curves are used to calculate exceedance probabilities within modules as well as at the TR. Again, this is likely to result in a conservative assessment of TR probabilities.

Again, some of these asset groups also have area specific curves, discussed next, which are always preferentially used over the generic curves.

Area specific exceedance curves have been developed for a number of modules within Shell Expro platforms. These curves are generally developed for critical, high risk modules where the use of the generic or extended exceedance curves may over (or under) estimate the risks associated with explosions in these areas. No details are given here detailing how these curves are developed, but care should be taken when implementing these curves into this methodology. The specific curves are generally similar to the generic curves, but are usually based on overpressure rather than severity, i.e. there is some uncertainty already built into the curve.



Where a new area specific curve is to be developed then the author of the curve should be approached to discuss the factors involved in the development of the curve and the methodology described here modified as appropriate.



0

0.2

0.4

0.6

0.8

1

0 0.2 0.4 0.6 0.8 1

Ignition Location

S /

Sm

ax

Type A

Type C

Type D

Figure 9-3 – Variation of Overpressure With Ignition Location



Plan of Module Type Description

A Enclosed module, no obstacles.

A Enclosed module with obstacles.

C Empty module, one wall available for venting.

D Module with obstacles and single wall available for venting.

A Empty module, two venting directions, one at each end.

A Module with obstacles and venting at each end.

A Empty module venting through two walls and floor or ceiling.

C Module with obstacles venting through two walls and floor or ceiling

Figure 9-4 – Description of Module Types



0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0.5 0.7 0.9 1.1 1.3 1.5 1.7

Fraction of Stoichiometric Concentration of Methane

S/S

max

Figure 9-5 – Effect of Stoichiometry on Severity Index For Methane



0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0.5 0.7 0.9 1.1 1.3 1.5 1.7

Fraction of Stoichiometric Concentration of Propane

S/S

max

Figure 9-6 - Effect of Stoichiometry on Severity Index For Propane



Figure 9-7 – Generic Exceedance Curves



0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0 0.5 1 1.5 2 2.5

Type A

Type C

Type D

Pro

bab

ility

of E

xcee

din

g S

des

ign

S Design / S Predicted

Figure 9-8 – Extended Generic Exceedance Curves



9.2.5 Design Capacity

The methodology used for the calculation of module boundary, TR or equipment failure is discussed next. To determine the probability of failure the capacities of walls, floors, TR cladding etc is required. Such details can be found in the platform Explosion JIP reports, Structural Consequence Analysis (SCA) reports, Performance Standards or other reports detailing specific boundary capacities.

In this assessment method a simplified approach is also adopted with respect to the uncertainty relating to the resistance of the module boundaries. A lower bound and upper bound value of resistance is calculated which is then used in determining the probability of boundary failure. The calculation of the resistance assumes that for this type of accidental event plastic deformation of the structure is acceptable and that enhancements to the strength due to strain rate effects for example, which are not normally included in design, can be considered.

The calculation of resistance is briefly described below for non-load bearing walls, floors and ceilings and load bearing walls. Where platform specific data on the upper and lower capacities is known, i.e. from SCA, then this information should always be used. Otherwise, the assumptions detailed next can be applied.

9.2.5.1 Non-load Bearing Walls

The lower bound value of the resistance of a non-load bearing wall is based upon the ultimate static capacity using a simple rigid plastic method such as yield line theory. This must take into account all possible failure modes. In the use of this method it should be assumed, irrespective of the walls boundary conditions, that it is fully fixed on all edges. The upper bound value of resistance is then calculated by applying the following enhancements:

a) Use may be made of the fact that the actual yield strength of the material (under static loading) is higher than the specified minimum yield strength. In the absence of more detailed information it may be assumed that for normal structural steels the actual yield strength is 1.1 times the specified minimum yield strength.

b) Use may be made of the increased strength due to strain hardening of the material. For typical offshore steels, strain hardening may give a 25% increase in ultimate strength compared to the yield strength.

c) Use may be made of the enhanced material strength due to high strain rates occurring during an explosion. Typically it may be assumed that the steel strength increases by a factor of 1.25.

d) Use may be made of the dynamic response of the wall. For the case where the structure responds elasto-plastically, the allowable ductility ratio (maximum allowable plastic deformation divided by the elastic limit deflection) is typically about 10. The ratio of the explosion load duration to the natural period of the wall is usually less than 2.0. This indicates, that in general, a typical wall can withstand an overpressure which is at least 1.5 times higher than the static resistance of the wall.

The combined effect of the above factors is that the blast wall may be capable of withstanding an overpressure considerably higher than the ultimate static resistance.



For QRA purposes, a non-load bearing wall may be assumed to have a minimum resistance of 1.0 times the ultimate static capacity and a maximum value of 2.5 times the ultimate static capacity.

9.2.5.2 Floors and Ceilings

The lower and upper bound values of the resistance for floors and ceilings can be determined in a similar way as those for non-load bearing walls. However, the mass of equipment on the boundaries should be accounted for in the calculation because of the significant effect this can have on increasing the natural period.

For QRA purposes, where a detailed assessment of the floor or ceiling has not been conducted, the boundaries may be assumed to have a minimum resistance of 1.0 times the ultimate static capacity and a maximum value of 2.5 times the ultimate static capacity.

9.2.5.3 Load Bearing Walls

For walls where the structural load bearing function and the explosion resistance function have been combined it is more difficult with simple analysis techniques to reliably predict the failure load. However, using a rigid plastic method to estimate the lower bound resistance, the upper bound value is then calculated by applying the following enhancements to the lower bound value:

a) Use may be made of the fact that the actual yield strength of the material (under static loading) is likely to be higher than the specified minimum yield strength. It may be assumed that for normal structural steels the actual yield strength is 1.1 times the specified minimum yield strength.

b) Use may be made of the increased strength due to strain hardening of the material. Strain hardening will need to be limited because of the need to limit the ductility ratio in order to avoid unstable behaviour. A 10% increase in ultimate strength compared to the yield strength may be assumed.

c) Use may be made of the enhanced material strength due to high strain rates occurring during an explosion. Typically it may be assumed that the steel strength increases by a factor of 1.25.

d) The effect of dynamics on the wall is likely to be small because of the need to limit the ductility ratio. For a simple assessment, no dynamic enhancement should be considered.

The combined effect of the above factors is that the blast wall may be capable of withstanding an overpressure 1.5 times the ultimate static resistance.

For QRA purposes, a load bearing wall may be assumed to have a minimum resistance of 1.0 times the ultimate static capacity and a maximum value of 1.5 times the ultimate static capacity.

It should be noted however, that the resistance of a load bearing wall is usually determined using a sophisticated finite element programme such as ABAQUS. This allows a full non-linear dynamic analysis to be undertaken which can explicitly account for all the material enhancements described above.



9.2.5.4 Process Equipment

The level at which overpressures are likely to lead to displacement of vessels, and hence release further inventory, is not readily calculable. Explosions may lead to displacement of vessels, piping damage or instrument and fitting damage.

Unless more detailed platform specific information on failure of process equipment is available, general failure of process equipment should be assumed at 1.0 bar [31]. At this level of overpressure it is considered that a more or less instantaneous release of hydrocarbon will result, causing a potentially large but short duration fire. It is suggested that a 0.1 probability of this is taken for the most onerous fire conditions resulting from explosion escalation which may result in further process escalation, boundary or structural failure. This probability should be reviewed on a platform by platform basis as, for some process modules, the risk of escalation or structural collapse may warrant a higher probability.

9.2.6 Explosion Failure Probabilities

The failure probability of a specified target may be derived using the figures contained within this section. These figures relate to failure probabilities calculated using the generic or extended generic curves, where the severity index is used. For area specific curves, the methodology can be similar but the author of the curves should be consulted to ensure this is the case. For the majority of the Shell Expro area specific curves used to date, the probability of failure is taken from the specified exceedance curve using a simple ratio of Design Overpressure divided by Predicted Overpressure.

In Figure 9-11, the value of X will vary depending on whether the standard or extended exceedance curves are being used and the type of module under consideration. The following rules should be applied :

− Standard Curves – X will be 1 for A, C and D curves;

− Extended Curves :

Curve Type X

A 2.3

C 1.8

D 1.5

The value of B in Figure 9-9 was is taken to be 1 for all installations except for Goldeneye, where a factor of 2 has been applied.



Figure 9-9 – Step 1 – Treatment of Internal Overpressure

Partial Fill Factor = A

% Module Filled With Stoichiometric Cloud

Cloud Size > 25%

Partial Fill Factor 4 * % Filled

Partial Fill Factor = 1

YES NO

Internal O/P With Partial Fill

= A * Pint

Convert to Severity IndexSP

Factor To Account for UncertaintyB * Sp = S1

Convert S1 Back to Overpressure

Pl

Calculate Overpressure Factor

Fp = P'/P

Use Figure 9-11 to Calculate Probability of

Failure

Input to Figure 9-10



Figure 9-10 – Step 2 – Treatment of TR External Overpressure

Note, PTR above is the overpressure at the TR which, if from SCOPE, has been factored by 2 to account for reflection.

External TR O/P With Partial Fill PTR' = A * PTR

Apply Overpressure Factor for Uncertainty

= Fp * PTR'

Convert Overpressure to Severity

SE

Use Figure 9-11 To Calculate Probability of TR

Failure

Factor for Uncertainty, Fp, from Figure 9-9



Figure 9-11 – Step 3 – Assessment of Failure Probabilities

Determine static ultimate capacity - Lower Bound

Estimate [RL]

Apply Factor to allow for strain rate, dynamics, etc. - Upper Bound Estimate [R u]

Convert capacities to severity indices using equation in

Section 9.2.2 [SRL and SRU ]

Factored Internal or External TR Severity Index

lL S

XSR > Is SRU<Sl ?

No No

Select module type from Figure 9-4

Calculate Mean Capacity Severity Index Factor SRM= (SRL/X+SRU)/2

Use Ratio SRM/Sl to obtain Probability of Failure

from Figure 9-7 or 9-8

Probability of Failure = 0

Use ratio (SRL/X+Sl)/2Sl to obtain Probability of

Failure from Figure 9-7 or 9-8

Calculate correction factorFl= (Sl - SRL/X)/(SRU - SRL/X)

Multiply probability of failure obtained above by

correction factor Fl.

Select module type from Figure 9-4

Yes Yes



9.3 Fire Escalation

To assess the potential for fire escalation the failure times to be used for equipment and structures should be taken from Table 9-1.

Fire Type Object Failure Time In Minutes

Vessels < 30bar Design Pressure

Other Vessels and Structural Elements

Jet Fire in Open 5 10

Jet Fire in Compartment 5 10

Pool Fire in Open 10 20

Pool Fire in Compartment 5 10

Table 9-1 – Failure Times From Fire Impingement

However, platform specific data, where it is available should always be used in preference to the values above. For example, studies have been conducted that show the Shearwater processing vessels will withstand 20 minutes of jet fire engulfment due to the higher design pressure of these systems.

For non-load bearing structures or blast walls, failure times up to 30 minutes are suggested.

Process escalation to other hydrocarbon containing vessels is taken to result in the generation of worst case fires, with the greatest potential to cause impairment, with a probability of 0.1. Again, this generic probability should be reviewed on a module by module basis as escalation in some modules may result in a higher probability of producing a worst case fire event.

Where Passive Fire Protection is fitted then the following failure times may be assumed for load bearing walls.

PFP Type Jet Fire Pool Fire

A0 (steel plate) 10 10

A60 15 30

H60 30 60

H120 60 120

J120 120 >120

Table 9-2 – Failure Times for Protected Walls



Where equipment items are protected by PFP then the failure time that results in escalation is extended by the time taken to fail the PFP.

9.4 Smoke Escalation

Fires that escalate to other inventories may introduce an additional smoke hazard, particularly if the escalated inventory is a large oil inventory. Escalation to cause smoke impairment is not necessarily treated differently than escalation to cause structural collapse etc. However, the potential for more rapid smoke impairment should be considered following escalation. For example, a jet fire may result in impairment of the TR from smoke after one hour. However, escalation to an oil inventory may result in more rapid smoke impairment.

The potential to escalate and cause impairment in this way will depend on the equipment surrounding the initiating release. In some cases, there may be no significant oil inventories on the module and therefore escalation to cause more rapid impairment may not result.

9.5 Sea Surface Pool Fire Escalation

Sea fires that burn on the sea surface generally occur from subsea riser releases or above sea riser releases with oil rain out from two-phase or oil releases. Such fires may be of sufficient size and duration to fail critical structures underdeck or jacket legs to result in structural failure of the platform.

Failure of steel jacket legs may occur within 10 – 20 minutes, depending on redundancy and load bearing nature of the legs. Where passive fire protection is fitted or the legs are water filled, then this failure time may be extended.

Concrete platform legs are unlikely to fail before the steel transition areas connecting the legs to the platform structure. These transition areas may fail in approximately 20 minutes, but where a more detailed assessment of failure times is required then heat up analysis should be conducted.

Escalation to topsides equipment may also be possible if the flame heights reach the underside of the platform and cellar deck is grated. Escalation in this manner is unlikely to lead to a significantly greater risk, but may result in additional inventory falling through the grated deck to fed the fire on the sea.

9.6 Escalation From Leg Releases

The build up of hydrocarbon within concrete platform legs may occur in two ways:

− Release from risers or oil storage pipework to / from oil storage cells;

− Release from oil storage cells directly, resulting in gas build up within the legs.

Ignited releases within the legs are taken to result in explosions. Generally, any gas within the legs is likely to form two layers, with lighter gas forming at the top and heavier gas near the bottom of the legs. There may potentially be more ignition sources at the top of the legs than the bottom and ignition of the top layer of gas may result in an explosion, but this is unlikely to be significant enough to fail the leg structure. However, combustion of the top layer of gas may result in improved mixing of the bottom layer of gas and ignition to result in a more



severe explosion. Given the enclosed nature of the concrete legs overpressures in the region of 8 bar may be generated.

Such explosions are considered to result in either direct structural impairment of the platform or escalation to result in a large topsides process event capable of impairing the TR. The probability of either hazard occurring will depend on the number of legs supporting the platform.

For platforms with four legs, one at each corner, there is generally considered to be a 50% probability of the explosion resulting in structural collapse of the platform but this is unlikely to occur for over one hour as the weight is redistributed to other legs which may gradually fail. Escalation to topsides process inventories is considered to occur for the remaining 50% of events and taken to result in impairment of the TR in just under one hour.

For three legged platforms, an explosion in the single leg is taken to cause rapid structural collapse with a probability of 1. An explosion in one of the remaining pairs of legs is taken to have a 75% probability of causing rapid structural collapse, with the remaining 25% of explosions taken to result in topsides escalation and impairment in just under 60 minutes.

9.7 General Rule Sets for Escalation

The modelling of escalation within the QRA should follow as closely as possible the results of the Escalation Review Meeting and SCA reports. Some general guidance on typical probabilities that could be used for escalation modelling are given here.

9.7.1 Escalation Probabilities

The following probabilities should be used to model the outcome of escalation from an initiating event to a specified outcome.

1 Event will definitely occur, e.g. detailed structural assessment has shown that failure of a single critical structure will result in collapse of a module.

0.9 Event will almost certainly occur but there is considered to be a small amount of uncertainty that failure will not result.

0.5 There is an equal probability that the outcome will or will not occur, i.e. an explosion failing two independent walls with the same design strength.

0.1 Event will almost certainly not occur or is very unlikely to occur.

0.01 Event is considered not to occur, but is included so as not to completely dismiss.

0 Event will definitely not occur

These probabilities should be used for guidance only with specific probabilities generated in escalation review meeting used in preference to the above.

9.7.2 Directionality Probabilities

Directionality can be used to describe the probability of the initial event escalating or the final outcome of an escalated event resulting in collapse of a tall structure.



Jet fire events are considered to escalate in one of four directions and therefore a directionality probability of 0.25 is used. Although it could be argued that a 1 out of 6 directionality should be used i.e. North, South, East, West, Up and Down, the location of other equipment items, structures etc mean that an ideal free-field jet like that is unlikely to occur on an offshore module.

Fireballs and poolfires are taken to form at the location of release and have less of a directionality than jet fires. Typically other equipment items engulfed within the diameter of the fire are taken to fail with a directionality probability of 1.0. However, if the fire diameter reduces such that escalation may not occur unless the flames were still tilted in the direction of the equipment then a directionality probability of 0.5 is used.

Collapse of tall structures may also require a directionality probability of collapse towards the TR. Typically a value of 0.25 is used to model collapse in one of four directions. However, the escalation review meetings should consider this in some detail as collapse of certain structures within the platform may result in a higher probability of collapse towards the TR.

9.7.3 Consequence Trees

The TR impairment consequence trees are typically developed following the escalation review meeting and are therefore specific to the platform under review. The event or consequence trees take the initiating release and model how escalation could occur to result in TR impairment. The outcome from the consequence tree is a TR impairment mechanism i.e. smoke, structural collapse etc and a probability of the given mechanism. There may be up to 6 different mechanisms for each event, and the mechanisms and probabilities are fed into the RISKMODEL.

The mechanisms are fed into the RISKMODEL, for a particular event, in chronological order such that the mechanism that occurs first in the time frame is classified TRI1. The remaining mechanisms are TR2, TR3, TR4, TR5 and TR6. As shown in Figure 11-3, the RISKMODEL post muster event tree accounts for the possibility of an earlier mechanism impairing the TR, i.e. the probability of mechanism two impairing the TR is calculated by :

TRI2 = (1-TR1) x TR2 (P1)

and so on for subsequent mechanisms.



10. IMPAIRMENT CRITERIA

The following describes the impairment criteria used to assess whether personnel are at risk and whether the TR can be considered to be impaired or not.

10.1 Impact Assessment for Personnel

10.1.1 Effect of Thermal Radiation

Where there is line-of-sight between the person and the flame, the main impact is by thermal radiation (radiant heat). The main effects are:

− Burns to exposed skin;

− Ignition or melting of clothing.

The impact zone from a long duration fire (e.g. a jet fire or pool fire) is conveniently described by radiation contours. The harm to personnel is a function of both radiation intensity and exposure time. Thermal radiation levels applicable to offshore installations are:

− Below 5 kW/m2 - no effects, provided personnel can take normal escape action.

− Between 5 and 10 kW/m2 - escape routes are treated as “impaired”, meaning that personnel will not enter this zone. Personnel already in this zone are able to use the escape route provided they are able to egress within 30 seconds. Otherwise they must take emergency action such as jumping into the sea.

− Between 10 and 37.5 kW/m2 - personnel in this zone may use escape routes, providing this allows them to leave the zone within a few seconds, or jump into the sea, however they will suffer second degree burns.

− Above 37.5 kW/m2 – potential for all exposed personnel to become fatalities.

Personnel in water are assumed to survive radiation intensities up to 37.5 kW/m2. In an enclosed space, 60% of which experiences radiation above 10 kW/m2, death of all occupants is assumed to result from asphyxiation, and not from radiation.

For a short-duration fire (e.g. a flash fire or fireball), escape action is not normally practicable in the time available, and the impact modelling is simpler.

For flash fires, personnel within the gas cloud are engulfed in a fire which, although brief, is likely to cause death due to inhalation of hot combustion gases, if not due to burns. For people within the cloud a probability of death of 100% is assumed although, since the burning of the cloud may be uneven, a lower probability might be more realistic.

For fireballs, all personnel within the fireball itself are expected to become fatalities. Additional fatalities are likely in the surrounding are a due to intense thermal radiation.



10.1.2 Effects of Smoke

Smoke from liquid and gaseous hydrocarbons often contains toxic gases such as nitrogen oxides (NOx), ammonia (NH3), sulphur dioxide (SO2), hydrogen fluoride (HF) as well as carbon monoxide (CO) and carbon dioxide (CO2).

The obscuring effects of smoke may also result in personnel becoming disorientated and confused whilst attempting to escape from a module or use an escape route. However, carbon monoxide is taken to be the limiting criteria for impairment of personnel in modules or on escape routes.

Impairment of escape routes due to toxicity effects is assumed to occur when the CO concentration in the smoke is 3,000 ppm. This concentration relates to the short term toxic effects of CO, impairing human judgement and performance.

10.1.3 Effects of Explosion Overpressure

The main effects of explosion overpressure on personnel are :

− Direct blast effects of the overpressure caused by the explosion, causing lung and ear damage which may lead to death (Primary Effects);

− Impact from missiles projected by the explosion (Secondary Effects);

− Impact from collapsing buildings and glass (Secondary Effects);

− Whole-body translation due to the blast wave, resulting in impact with stationary objects, which may cause injury or death (Tertiary effects);

For semi-confined gas explosions on offshore installations the, main effects are :

− Combined effects of overpressure, burns and respiration of combustion products for personnel inside the gas cloud. However, since the combustion of the vapour cloud would be fatal for anyone inside the cloud regardless of the overpressure, there is no need to specify a criterion for fatalities due to overpressure.

− Impact from debris. This may occur both in the module containing the gas cloud, and in the neighbouring modules if firewalls or venting panels are blown out.

10.1.4 Immediate Fatalities

Based on the impairment criteria discussed above, rulesets can be developed to account for local fatalities in the vicinity of the event. Some account also needs to be taken of the possibility that personnel may escape the area before ignition occurs or may be sheltered by equipment within the area. Personnel are more likely to escape from smaller sized releases than larger releases due to the corresponding size of the fire or explosion event.

A recommended rule set is based on:

− Small gas fire (0.1kg/s), probability of fatality 0.25 based on directionality of jet fire and module size;



− Small oil fire, probability of fatality 0.1 based on limited size of fire, confined to drain area;

− Medium gas fire (1.0 kg/s), probability of fatality ~0.5 based on 50.50 chance that fire is towards person present and prevents escape;

− Medium oil fire, probability of fatality 0.25 based on size of fire, lower rate of flame coverage than gas and confinement to drain area;

− Large gas fire (10kg/s), all personnel present are fatalities;

− Large oil fire, probability of fatality 0.5, based on personnel visually registering release and escaping area before ignition.

A similar rule set can be drawn up for delayed ignition. Depending on the platform configuration, personnel away from the initial release area may also be affected. If the platform contains large open areas then personnel outside of the initial area may be exposed to the initial fire or explosion event in a similar manner to above. If the platform consists of a number of boxed in modules then the potential to affect personnel in adjacent areas, particularly from fires, may be limited.

The QRA looks at one adjacent module and typically the one that will result in the highest number of fatalities. The fatality fraction to apply to the personnel in adjacent areas is assessed on a case by case basis using the following criteria :

− Open areas with large fires engulfing more than one area / high overpressures – use same initial fatality fractions;

− Open areas with medium fires that may extend into adjacent area / lower overpressures – use 50% fatality fractions from initial areas;

− Open areas with small fires / no appreciable overpressure – no adjacent area fatalities;

− Enclosed areas with large fires / large overpressures significantly above boundary walls and structural capacity – no fatalities from fires but 100% of the initial fatality fraction for explosions;

− Enclosed areas with medium sized fires / overpressures above boundary wall capacity to enable escalation into adjacent areas – no fatalities from fires but 50% of the initial fatality fraction for explosions;

− Enclosed areas with small fires / low overpressures incapable of failing boundary walls – no adjacent fatalities.

10.2 Safety Function Impairment Criteria

The safety systems are taken to be impaired under the same conditions as process equipment. Where a fire or explosion event has occurred then the Fire and Gas system is then taken to be redundant for the module where the release has occurred. Fire events may impair the ESD, blowdown or deluge system, but it is likely that these systems will have operated before the fire duration is sufficient to fail the system.



Explosions are taken to impair the safety systems where the overpressure exceeds 1 bar. It is also assumed, conservatively, that explosions that exceed 1 bar will fail the system before it operates, unless the safety performance of the system can be shown to act before the explosion has occurred. For example, rapid acting actuated ESD valves may operate and fail safe such that inventories are isolated before the explosion has occurred. Alternatively, if the critical valves are located out with the module where the explosion has occurred then these valves may be considered to still be operational.

10.3 Temporary Refuge Impairment Criteria

The following criteria are used to determine whether the TR is considered to be impaired or not. Each of the typical TR impairment mechanisms considered in the Shell Expro QRA’s are discussed with the criteria for impairment given. An indication of whether impairment is assumed to result in a large number of fatalities or whether impairment is simply taken to trigger evacuation with some other criteria required to result in fatalities is also given.

Where impairment occurs and personnel are unable to escape the TR then it is assumed that 90% of the personnel in the TR become fatalities. The remaining 10% are assumed to be able to escape the TR and finding their own independent means of escaping to sea and being rescued.

Derrick Collapse – collapse of the derrick onto the TR is taken to result in TR impairment. Smoke subsequently being blown into the TR following collapse is taken to result in rapid fatalities within the TR;

Flare Tower Collapse – same as derrick collapse and other tall structure collapse mechanisms;

External Explosions – external explosions that fail the structure of the TR are taken to impair and result in a high number of fatalities. Explosions that fail the TR cladding are taken to impair the TR and result in fatalities if smoke is then subsequently blown towards the TR;

HVAC Failure – failure of the TR HVAC system to close down may result in rapid smoke or gas ingress. In both cases, impairment of the TR is taken to occur quickly and result in a high number of fatalities. Concentrations of CO greater than 800ppm for 5 minutes or a gas concentration of 60% LFL is taken to cause impairment;

Smoke – a COHb level of 15% is taken to result in impairment, a level of 50% fatality;

Structural Collapse – collapse of critical TR structures, from fires or explosions, to result in rapid impairment of the TR are taken to result in a high number of fatalities if collapse occurs before evacuation occurs;

Jacket Collapse – collapse of the jacket structure is taken to result in a high number of fatalities if collapse occurs rapidly;

Leg Collapse – rapid collapse of the leg structure is taken to result in a high number of fatalities. Gradual collapse or escalation to topsides inventories is taken to result in a lower number of fatalities as evacuation may be possible before impairment occurs;

Heat Stress – an energy stored level exceeding 50 W hr/m2 is taken to result in impairment of the TR and will trigger the evacuation process;



Thermal Breach – thermal radiation levels exceeding the capacity of the TR cladding are taken to result in breach of the TR outer shell. Rapid heat or smoke impairment may then occur.

10.4 TEMPSC Impairment Criteria

Fire and explosion events that result in rapid impairment of the TR are also taken to mean that evacuation from the platform, in an organised manner, will not be possible.

Where sufficient time is available to evacuate then the TEMPSC are assumed to be made permanently inoperable by :

− Any jet fire impact (with or without water sprays operating);

− Any pool fire impact (without water sprays working);

− Permanent damage to adjacent walkways which prevents boarding;

− Explosion overpressure above 0.1 bar. This may be due to projectile impact on the craft or launching gear, or bodily translation of the craft jamming the falls. It is assumed only to occur if there is line-of-sight between the TEMPSC and the source of the explosion.

TEMPSC boarding maybe temporarily prevented by :

− Thermal radiation over 5 kW/m2;

− Smoke above 15% by volume;

− Unignited gas upwind.

Impairment of the TEMPSC should consider the number, location and means of protection available to the TEMPSC. Typically, the QRA considers the TEMPSC located closest to the TR to be the main means of evacuation.

On all of the Shell Expro installations, re-breather sets are available within the cabin’s grab bags. These sets are assumed to be 90% effective against smoke impairment of the TR or escape routes as long as there is sufficient time available to muster and don the sets. For those mechanisms that result in rapid smoke impairment, i.e. HVAC Failure and External Explosions, the re-breather sets are considered not to be effective as there will be insufficient time available to correctly don the sets.

Where personnel are able to escape from the TR and muster at the TEMPSC then it is assumed that 8% of all personnel escaping via TEMPSC will become fatalities during the evacuation procedure. This is an average value for all weather conditions.



11. HYDROCARBON FATALITY CALCULATIONS

11.1 Introduction

To assess the risk to personnel on offshore installations, a general purpose risk model using spreadsheet technology has been developed, entitled RISKMODEL. The structure used in a typical risk study is shown in Figure 11-1. The RISKMODEL consists of a set of interlinked spreadsheet files, into which data is entered, with the risk calculations being performed automatically.

This modular approach minimises the Quality Control problems associated with large spreadsheets whilst allowing a great deal of flexibility of application. The model allows parameters to be changed readily, allowing the effects of these changes on the calculated risk to be determined quickly.

The spreadsheet model calculates the risk in terms of Temporary Refuge (TR) Impairment Frequency (TRIF), Individual Risk Per Annum (IRPA) and Potential Loss of Life (PLL) for both hydrocarbon and other major hazards.

11.1.1 Temporary Refuge Impairment Frequency (TRIF)

A measure of the likelihood of TR impairment due to one or more of the mechanisms described in Section 10.3. The TR impairment frequency can be calculated for the specified endurance period of the TR and for a second time period outwith the endurance period.

11.1.2 Individual Risk Per Annum (IRPA)

A measure of the rate of fatality per year for individuals or, more commonly, specific personnel employment categories, for instance:

− Drillers;

− Operations Crew;

− Construction Workers;

− LQ Personnel;

− Maintenance;

− Caterers.

The RISKMODEL can typically calculate the risks for 4 or 5 of these worker groups.

11.1.3 Potential Loss of Life (PLL)

A societal measure, per year, for a specific installation. A value can also be produced for each phase of operations e.g. production, SIMOPS.



Failure RateData

Ignition /Explosion

Calculations

HydrocarbonConsequences

LeakageFrequency

Probability ofIgnition

Probability ofExplosion

F & G Reliability ESD / BDReliability

DelugeReliability

PersonnelDistribution

Event /ConsequenceTree Module

ImmediateFatalities

Number ofIgnitable Events

TR / Muster /EvacuationImpairment

HydrocarbonPLL and IRPA

Total PLL's andIRPA's

Non-Hydrocarbon

Hazards

Platform Data Platform Data

Platform Data Platform Data Platform Data

PreliminaryCalculations

Input Files

Event Trees

Output Files

ResultsSummary

Platform Data

Figure 11-1 - Flowchart Displaying Risk Model Methodology.



For a specific installation, the risk calculations may be performed for several operational phases. The calculated risk is subdivided into:

• different occupational groups;

• location or type of accident event;

• fatalities at different phases of the accident event, e.g. immediately, whilst mustering, whilst in TR and during evacuation.

The majority of the spreadsheet files and calculations are concerned with the hydrocarbon events, which have been discussed previously.

11.2 Event Tree Module

The event tree module within the model performs the majority of the risk calculations using input from other spreadsheet files. It sends data to other files, where the risks are summarised and the output is presented both in tabular format and graphically.

To assess the hydrocarbon risks on an installation, an event tree analysis is conducted for each hydrocarbon accident event. The events divide the process system into individual isolated (ESD) sections. However, items of process equipment which are in the same ESD section but not in the same geographical location can also be defined as different accident events. Similarly, as hydrocarbons released from a riser section above the sea will have different consequences from those released subsea and so different accident events are defined for these events.

There are four systems that will serve to limit the effects of a hydrocarbon release, as follows:

• Fire and Gas Detection;

• Isolation;

• Blowdown;

• Deluge.

The manner in which these events may combine is illustrated in Figure 11-2.

An input sheet is used for each of the hydrocarbon accident events defined for the installation. For process accident events, it is usual to model three breach sizes (3mm, 10mm and 50mm) in the event tree spreadsheet. Similarly, three breach sizes may be assessed for riser events (10mm, 50mm and full bore rupture). Blowout events are generally modelled as large only.



Figure 11-2 - Example Hydrocarbon Event Tree



The following data is entered automatically into the event tree module for each accident event, from other spreadsheet files:

• leakage frequencies assigned to each breach size;

• ignition probabilities calculated for each breach size;

• explosion probabilities calculated from the probability of gas build up within the enclosed modules and the probability of delayed ignition;

• probabilities of fire and gas system failure;

• probabilities of isolation and blowdown failures assigned for both fire and explosion events;

• deluge failure probabilities assigned for both fire and explosion events;

• the personnel distribution on the installation.

The relationships between the event tree module and the spreadsheet files containing this information is shown in Figure 11-1.

Muster, lifeboat and TR impairment probabilities are assigned for each breach size and are entered into each event tree input sheet. Lifeboat impairment is also entered for each of the TR impairment mechanisms.

Equations are set up within the event tree spreadsheet to calculate the fatalities per annum (PLL and IRPA), and the frequency of TR and EER impairment for each event. These calculations and equations are discussed below.

11.2.1 Calculation of Potential Loss of Life

PLL calculations are performed separately for the following phases of an incident within the event tree module:

• immediate fatalities within the module/area due to the accident event;

• fatalities during the mustering process as a result of personnel becoming trapped;

• fatalities in the TR, caused by loss of TR integrity;

• fatalities during evacuation of the platform.

All of the above can be presented on the event tree printout for each accident event. In addition, all the PLL calculations are transferred to a summary spreadsheet for presentation of overall results.

Immediate fatalities per annum are calculated for each fire or explosion event of an accident event by the equation:

Immediate fatalities = frequency of event x personnel within incident module x fatality fraction (Q1)

The "fatality fraction" represents the expected level of fatalities amongst the group of personnel located within the incident module at the time of the incident. This fraction varies according to the type of event and discussed in more detail in Section 10.1.4.



Impairment of muster routes following the accident event is assumed to result in fatalities due to personnel located on the plant being trapped in hazardous conditions. Muster fatalities per annum are calculated for each fire or explosion event by the equation:

Muster fatalities = frequency of event x (no. of personnel on the plant minus immediate fatalities) x muster impairment probability x 0.8 (Q2)

The value of 0.8 allows for the fact that personnel may be able to escape directly to sea by jumping, etc. This value may be judged to vary from installation to installation or by geographic location.

After the mustering phase, the risk calculations can be based on the event tree logic; similar to Figure 11-3.

If the TR maintains its integrity, no further fatalities are assumed to occur. If the TR is impaired, then the possibility of evacuation is considered. If platform evacuation is achieved, it is assumed that there were no fatalities in the TR, and that, say, 8% of the remaining platform POB become fatalities during the evacuation process. However, if the TR is impaired and platform evacuation cannot be achieved, then it is assumed that something of the order of 90% of the remaining platform POB become fatalities. The 90% factor allows for a degree of escape by jumping into the sea, etc. The fatality fractions can be modified to reflect the installation and geographical location. The equations for TR and evacuation fatalities are as follows:

TR fatalities = frequency of event x no. of personnel in TR (post muster) x TR impairment probability x evacuation impairment probability x 0.9 (Q3)

Evacuation fatalities = frequency of event x no. of personnel in TR (post muster) x TR impairment probability x (1 - evacuation impairment probability) x 0.08 (Q4)

TR and evacuation impairment probabilities are calculated for each accident event. The value of 0.08 is a weather averaged probability for impairment of successful TEMPSC launch.



TEMPSC1 90% Fatalities - Mechanism "TR1"

TR1

8% Fatalities - Mechanism "TEMPSC1"

Immediate and TEMPSC2 90% Fatalities - Mechanism "TR2"

Muster Fatalities TR2



TR3



TR4



TR5



TR6


No Further Fatalities

Figure 11-3 - Post Muster Event Tree Logic



11.2.2 Individual Risk Per Annum Calculation

IRPA calculations are performed within each event tree sheet for discrete groups of personnel, for example:

− Drillers;

− Operations Crew;

− Construction Workers;

− LQ Personnel;

− Maintenance;

− Caterers.

These calculations use the same methodology as that for the PLL calculations; but adjusted for a single individual whose working locations are the average of the personnel group. The equations are adjusted to calculate individual risk. The IRPA equations for fatalities amongst a particular group are as follows:

Immediate fatalities = proportion of time spent offshore x frequency of event x probability of being in incident module x fatality fraction (Q5)

Muster fatalities = proportion of time spent offshore x frequency of event x probability of being on plant minus probability of being an immediate fatality x muster impairment probability x 0.8 (Q6)

TR fatalities = proportion of time spent offshore x frequency of event x probability of being in TR (post muster) x TR impairment probability x evacuation impairment probability x 0.9 (Q7)

Evacuation fatalities = proportion of time spent offshore x frequency of event x probability of being in TR (post muster) x TR impairment probability x [1 - evacuation impairment probability] x 0.08 (Q8)

The impairment probabilities are the same as those used in the PLL calculations.

11.2.3 Frequency of Temporary Refuge Impairment

The frequency of TR impairment for each fire, explosion or non-ignited gas event is calculated by multiplying the frequency of the event with its probability of TR impairment according to the described methodology.

The frequencies of TR impairment for all fire, explosion and non-ignited gas events for each accident event are summed to give the frequency of TR impairment for that particular accident event. In addition the cause of, and most likely time to, TR impairment are quoted. As shown in Figure 11-3, the calculation of TR impairment for each of the mechanisms takes account of mechanisms that may have occurred before the particular mechanism being calculated.



As TR impairment is most critical either when there is no time to evacuate or when the evacuation route is impaired, this frequency of events (where the TR is impaired and evacuation cannot be achieved) is quoted.

11.3 Frequency of Temporary Refuge and Evacuation Systems Impairment

The conditional frequency of the evacuation facilities being impaired when the TR is also impaired is calculated in the risk model. This parameter is referred to as the frequency of TREER impairment (TREERIF). This is the frequency of events that causes a large number of fatalities, since if the TR is impaired and evacuation by TEMPSC is not feasible, it is assumed that 90% of personnel inside the TR will be fatalities.

11.3.1 Summary Calculations

The event tree module of the RISKMODEL sends data to other sheets, which calculate the following:

− total immediate fatalities per annum, muster fatalities per annum, TR fatalities per annum and evacuation fatalities per annum;

− potential loss of life (PLL), according to incident location and TR mechanism;

− individual risks per annum for 5 groups from production operators, maintenance crew, drill crew, deck crew, construction crew and catering/administration crew;

− frequency of TR loss;

− frequency of TR and evacuation route loss.

11.4 Presentation of the Risk Calculations

The output of the risk model can be selectively presented to support the main discussion points for a specific study. The following tables and figures can presented separately for drilling and non-drilling cases:

Potential Loss of Life (PLL)

− ranked list of hydrocarbon events;

− overall PLL;

− hydrocarbon PLL by fatality type ;

− immediate fatalities, hydrocarbon events by area;

− muster fatalities, hydrocarbon events by area;

− TR fatalities (by TR impairment mechanism), hydrocarbon events by area;

− evacuation fatalities, (by TR impairment mechanism), hydrocarbon events by area.

Individual Risk Per Annum (IRPA)

− ranked list of hydrocarbon event;



− all risks per worker group;

− immediate fatalities, hydrocarbon events by area;

− muster fatalities, hydrocarbon events by area;

− TR fatalities (by TR impairment mechanism), hydrocarbon events by area;

− evacuation fatalities, (by TR impairment mechanism), hydrocarbon events by area.

TR Impairment Frequency (TRIF)

− ranked list of hydrocarbon events;

− hydrocarbon events by area;

− hydrocarbon events - impairment frequency by mechanism type;

− hydrocarbon events - impairment frequency with time.

In addition, a separate QRA Results spreadsheet has been developed which takes the results from the RISKMODEL and manipulates them to present the risks in the following format:

− full list of hydrocarbon events considered in the QRA;

− Summary Sheet per module (or Major Accident Hazard [MAH] as these are assessed on a module by module basis);

− Hazards Management Data which provides all the data required to complete the MAH register in the Safety Case;

− Immediate fatality fractions;

− Blowout frequencies;

− Explosion Overpressures;

− Ranked lists of TRIF, PLL and ignited event frequency;

− TRIF and Ignited Event Frequency comparison per module;

− Breakdown of TRIF with time;

− Comparison of TRIF (within the TR endurance period) and Total TRIF (including TRIF after the TR endurance period);

− Breakdown of explosion frequency into <500mbar, >500mbar <1500mbar and >1500mbar;

− Table of TRIF per mechanism for each module;

− Risks per module showing leak frequency, ignited event frequency, fire frequency, explosion frequency, TRIF and PLL (immediate, muster, TR and evacuation);

− Smoke ingress times;

− Small and Large fire frequencies (small fires classified as less that 2m jet fire, 3m pool fire).



12. NON-HYDROCARBON RISKS TO PLATFORM AND PERSONNEL

This section describes the general data and calculations used to assess the non-hydrocarbon risks to personnel within the QRA. Non-hydrocarbon risks are not taken to contribute to the TRIF within the QRA, but are calculated for IRPA and PLL.

12.1 Occupational

Occupational accidents are defined as those with no potential to cause fatalities outside the immediate area of the incident and, in the majority of cases, they will result in a single fatality

This category includes a wide variety of events, such as falls, falling overboard, mechanical impacts, burns, asphyxiation, electrical shocks etc. Accident frequency is calculated from accident history data for different worker categories offshore.

All installations, with the exception of Goldeneye, use the following Occupational FARs :

Worker Group Onshift FAR Offshift FAR Total FAR

Drill Crew 6.2 1.3 7.5

Production / Maintenance Crew

5.2 1.3 6.5

Deck Crew 3.2 1.3 4.5

Construction Crew 3.2 1.3 4.5

LQ Crew 1.3 1.3 2.6

Table 12-1 – Occupational Risks

These occupational risks are based on information provided in [32] as detailed in Appendix E. For Goldeneye, the following FARs are used :


Drill Crew 11 N/A 11

Production 1.5 N/A 1.5

Maintenance Crew 5.5 N/A 5.5

Construction Crew 10 N/A 10

LQ Crew 1.3 N/A 1.3

Table 12-2 – Occupational Risks For Remaining Installations

The occupational risks given above are based on data taken from [33].



The calculation of individual risk is based on the following equation:

Occupational IRPA for shift = (FAR / 1x108 manhours) x 8760 hours x Fraction Time Offshore x 0.5 (R1)

It is assumed here that personnel spend 50% of their offshore time on-shift and 50% off-shift.

12.2 Structural Failures

Initiating events for structural failure include extreme weather, marine corrosion, fatigue cracking, foundation failure, construction defects and design errors. Seismic activity may also result in structural failure, but such failure is considered separately in Section 12.3.

There have been no cases of total loss of a platform from structural failures in the North Sea. From WOAD [34] there has been a total of 5095 fixed platform-years in the North Sea with no incidents of total collapse from structural failure. This means that the frequency of total loss must be less than 1.96 x 10-4 per year.

If the Worldwide WOAD [34] data is examined, then it can be seen that there were 7 occurrences of total loss incidents with 122,960 fixed platform-years. This results in a total frequency of 5.69x10-5 per year. If it is recognised that the North Sea practice for evaluating environmental loading is generally more conservative than in other geographical areas of the world then this frequency is likely to be conservative for the UK North Sea. Based on this conservatism, it is considered reasonable to assess the frequency of total loss of a North Sea installation as 1.0 x 10-5 per year.

If it is assumed that severe damage is an order of magnitude more likely than total loss then the failure frequencies used in the QRA are :

− Total Loss 1.0 x 10-5 per year

− Severe Damage 1.0x10-4 per year.

In the case of total loss, 90% of the POB remaining on the platform are assumed to be fatalities due to the sudden nature of the loss. For the Severe Damage event, it is assumed that topsides process disruption will occur to result in a fire of sufficient size and duration to impair the TR through smoke or any other major topsides mechanism.

The same failure frequencies are assumed for all types of fixed platform, i.e. multiple jacket leg, concrete etc.

12.3 Seismic Failure

The risk of platform failure due to seismic activity has been assessed by several sources in the UK. Typically ground accelerations would need to exceed 0.3g for there to be any plastic deformation of the steel structure.

The top of the jacket and the lower part of the deck are heavily loaded in an earthquake. Pipework in this area may have to deform plastically. In general, this deformation can be accommodated by the steel but it is expected that flanges may fail leading to release of inventory. This is expected to happen for earthquakes of intensity greater than 0.3g.

Damage might then be expected at the following frequencies.



− 0.3g causing severe damage 7 x 10-5 per year

− 0.6g causing collapse 5 x 10-6 year

The consequences of an event resulting in collapse are considered sudden and total and the assumption of 90% fatalities is frequently made. Seismic events that result in severe damage will result in similar consequences to severe damage events described in Section 12.2 for Structural Failure.

12.4 Ship Collision

Ship collision modelling centres around two key elements:

− The frequency with which ships are predicted to hit a structure.

− The damage done in the course of a collision.

The collision consequence modelling conducted for a QRA utilises both the structural design calculations and the historical record of vessel movements. Although detailed structural assessment may be required there is little merit in utilising more than a simple conservation of energy model to assess damage in QRA calculations.

12.4.1 Ship Collision Hazard Identification

The following list presents an overview of the types of collision risks associated with different vessel types:

Merchant Vessels, Tankers, Ferries

These vessels present a risk both in terms of drifting and head-on collisions. The size and velocity of passing vessels will be derived from information contained in shipping traffic databases (which are readily available in the North Sea).

Passing Offshore Vessels

Offshore vessels which are passing in the vicinity of one installation, enroute to other drilling rigs or platforms, will present a similar type of collision risk as presented by merchant traffic. Traffic flows may not be reported in the general databases.

Visiting Offshore Vessels

Vessels that might visit an installation include:

− Supply Vessels;

− Diving Support Vessels (DSV);

− Standby Vessel;

− Pipelaying Vessels;

− Heavy Lift Vessels;



− Barges;

− Survey Vessels;

− Semi-submersibles;

− Jackup Drilling Rigs;

− Anchor Handling Tugs.

The vessels visiting an installation present a risk when they are loading and operating in the vicinity of the offshore installation as well as when they are first entering the field. The collisions which may occur whilst loading are very different to passing vessel collisions due to the low impact energies associated with such collisions.

Passing Fishing Vessels

These vessels have been known to pose problems to offshore installations and have on occasion collided with installations. The collisions associated with these vessels mainly occur during fishing and when there is no standby vessel cover at the field. The majority of these vessels are small and less rigid structures and so the risk presented by these vessels is often discounted as trivial.

Naval Vessels

Naval vessels are usually considered to present negligible collision risk to offshore structures. This is due to the fact that such vessels will be manned with highly proficient navigators and procedures, radio operators and radar equipment. Historical experience supports this.

Submarines

Traffic patterns associated with submarines are very difficult to predict. Whilst there is a risk associated with these vessels it is difficult to quantify due to, for obvious reasons, the lack of up-to-date information. A risk assessment might consider the risk negligible or perhaps incorporate a qualitative assessment.

12.4.2 Critical Collision Energy

The analysis of collision consequences is usually based on the principle of conservation of energy. The incident kinetic energy of a ship can be estimated as follows:

E M k V

=

12 1000

2

(S1)

where: E = impact energy (MJ) M = vessel mass (tonnes) k = hydrodynamic added mass constant, conventionally taken as: 1.1 for head-on (powered) impact 1.4 for broadside (drifting) impact V = vessel speed (m/s) = 0.5144 x knots



In a collision, the incident kinetic energy of the colliding ship is split into the following:

− Residual kinetic energy of the ship;

− Energy absorbed in plastic deformation of the ship's structure;

− Energy absorbed in plastic deformation of the platform's structure;

− Energy stored in oscillation of the structure. For a jack-up, this is an exchange between elastic potential energy in the legs and kinetic energy in the deck. This is slowly dissipated by fluid damping.

In analysing collision consequences, collisions are split into two types:

− Glancing blows - where the ship brushes against the platform and retains most of its incident kinetic energy. Accident experience shows that, for most platforms, this event causes negligible damage.

− Head-on collisions - where the ship is stopped by the platform and has no residual kinetic energy. In principle, jack-ups may be sufficiently elastic to cause the ship to rebound, but this is considered unlikely.

Thus, after discarding glancing blows, only head-on collisions need to be modelled.

Energy Distribution

In head-on collisions, all the incident kinetic energy is absorbed by the structures. The distribution of energy may be predicted from both the ship's and platform's force-deflection curves. Typically, for minor collisions most of the energy is absorbed by the ship. Small vessels tend to absorb a greater proportion of the energy than large ones.

Data on the worst-known supply vessel collision in the UK Sector estimated an incident energy of 11MJ, of which 32% was absorbed by the facility, a semi-submersible.

In the next 5 worst collisions with semi-submersibles, all in the range 1-5MJ, an average of 80% of the incident energy was absorbed by the platforms. In the 4 worst collisions with fixed platforms, all in the range 1-5MJ, virtually 100% of the energy was absorbed by the platforms.

Consultation with Shell Expro structural engineers has resulted in the following energy distribution:

− Collisions involving vessels > 5000 tonnes, 32% of energy absorbed by the structure;

− Collisions involving vessels < 5000 tonnes, 75% of energy absorbed by the structure.

A theoretical calculation for a collision between a ship and a 3-leg jack-up platform indicated that the jack-up absorbed about 40% of the incident energy. This is in fairly close agreement with the experimental value of 32% above.

Collision Resistance of Steel Structures

Structures designed to meet the current UK vessel impact standards, which are based on supply vessel collision experience, will withstand without collapse an impact from a 5000te



vessel at 2m/s. This is equivalent to an impact energy of 11MJ for head-on (i.e. powered) collisions and 14MJ for broadside (i.e. drifting) collisions.

In fact, platforms should be able to survive more severe collisions than these, since the design would normally be based on surviving the above collisions without stresses exceeding the yield point. Beyond this, plastic deformation and load-shedding occur, which absorb further energy before the structure collapses. Not all existing platforms are however designed to these standards.

Jack-ups are designed to withstand the same boat impact as fixed platforms, but increased flexibility may allow more impact resistance.

However, for the purposes of the QRA it will be assumed that collisions that result in an impact energy of 11MJ or above will result in sudden and total collapse of the platform.

12.4.3 Critical Collision Frequency

The frequency of ship collision is calculated using the COLLIDE software package. The frequency of impacts greater than 11MJ is calculated for passing (powered and drifting) and attendant vessels.

For powered passing and attendant vessels it is assumed that the collision may occur with little warning and before a full evacuation can be carried out. It is assumed that 90% of the POB become fatalities from such collisions. For drifting collisions, it is assumed that sufficient warning will be available to initiate the evacuation process. It is assumed that 10% of the POB become fatalities from such collisions.

Where there are two or more platforms linked to the main TR platform then credit could be taken for personnel being able to watch the approaching ship and escape to the other platform before collision occurs. In such circumstances the fatality fraction could be reduced significantly, with a value of 10% proposed for powered collisions and 1% for drifting.

The Risk Reduction Matrix within the COLLIDE model should also be used to account for safety measures, such as upgraded Stand By Vessel with ARPA, Early Warning Systems etc, to reduce the collision frequency.

12.5 Dropped Objects

There are many triggers for the initiation of dropped object studies at an installation. The first occasion can be expected to be at the conceptual stage of an installation’s design, following the conceptual HAZID study. Dropped object studies can be expected to be revisited and upgraded as the iterative design process progresses. At some point the findings can be incorporated into the QRA so that the profile of such risks can be put into context with other hazards that exist on such an installation.

Studies during an installation’s operational phase are more likely to be triggered by specific concerns, such as the adequacy of mechanical protection, or associated with modifications, changes of use, or temporary simultaneous operation.

In general, the leak frequency databases used for the QRA account for dropped object damaging processing equipment and the occupational data used accounts for risk to personnel being hit by dropped objects.



12.5.1 Methodology

A dropped object study can be divided into the following steps:

[1] Study Initiation – agreement of scope to include period of site lifespan, the detail and level of precision within the assessment.

[2] Data Acquisition – the analyst needs to gain an appropriate understanding of:

− The three dimensional layout of the installation;

− Description of the lifting gear involved and the physical and operational controls over its use;

− Loads lifted and routes taken;

− Potential targets for dropped objects;

− The nature of the equipment in the target areas;

− Generic and site specific lifting gear incident frequency data.

A detailed study would consider the specific geometry of items being lifted and the target areas. The probable variants of lifting routes, lift heights and traversing can be assessed. This level of detail is not usually merited in the first pass of a QRA which concentrates on identifying significant risk contributions.

[3] Identification and Classification of Incidents – The following types of incident are possible:

− Load falls;

− Boom falls;

− Crane falls;

− Collisions from swinging loads;

− Collisions from swinging booms.

The analyst needs to identify hydrocarbon and structural targets vulnerable to loads.

[4] Gathering and Collating Lifting Gear Incident Frequency Data – The following sources of data provide an insight into the frequency and magnitude of dropped object incidents and lifting gear failures:

− Department of Energy Brown Book – for population of installations and (by derivation) of crane populations

− HSE (formerly DEn) Report Accident Records, North Sea UK Sector 1980 –1990 (Product of OIR9 reports)

− OREDA Handbook of Offshore Reliability Data, Pub, prepared by SINTEF [26]



− World Offshore Accident Database (WOAD) [34]

− F.P. Lees (1996), Loss Prevention in the Process Industries [35]

[5] Risk Ranking of Events – The scenarios evaluated can be quantitatively ranked and, if appropriate, modifications to the design or procedures can be made accordingly. In the context of a QRA the frequencies associated with the scenarios developed can be used to supplement appropriate hydrocarbon or, much less likely, structural events.

12.5.2 Assessing Damage Potential to Underwater Targets

In order to assess the vulnerability of underwater equipment to falling objects the movement of the object through the water and it’s terminal velocity must be calculated. A detailed study would need the following:

− Impact strength of target object(s);

− Weight and geometry of dropped object(s);

− Geometry and point of impact of dropped object;

− Protection and shock absorbance provided by seabed to targets located on it;

− Strength and thickness of concrete targets;

− Possible impact damage to pipework and other steel or flexible targets;

− Possible damage to underwater structure of installation;

− Survivability of underwater structure.

Such studies tend to be very specific, an example might be an assessment of the risks of dropping pipe lengths near an existing pipeline during pipelay or drill pipe near subsea wellheads.

A dropped object spreadsheet has been developed by Atkins Process and is used in the assessment of subsea dropped object risks.

12.6 Turbine Failure / Missile Impact

Gas turbines, particularly aero-derivative types, are generally designed so that blade loss does not lead to catastrophic failure. It is not normal practice to design against catastrophic failure following a turbine or compressor disc disruptive failure. Turbine disc burst has occurred on offshore gas turbines.

The frequency of turbine disc burst is estimated at 5.0E-3 per year derived from US commercial aircraft motor burst protection programme [36]. On the basis that turbines used offshore are less highly stressed since power to weight is less important than for aircraft, it is considered that the frequency of turbine disc burst could be reduced by an order of magnitude to 5.0E-4 per year.



The likelihood of turbine failure resulting in a high number of fatalities with the TR due to missile damage is unlikely. However, personnel in the immediate vicinity of the turbines may be at risk from blade disintegration. It is assumed that 50% of the personnel within the vicinity of the turbines become fatalities as a result of this. Escalation from the turbines to nearby process equipment is considered to result in impairment of the TR. If a large process fire forms from this incident then smoke impairment may be possible or any other form of impairment depending on the location of the fire. Such events are of low probability, but may result in a high number of fatalities within the TR.

12.7 Transport to and From the Installation

The travel risks associated with personnel movement to and from the installation will involve a period of travel in a helicopter and, for some platforms, preceded by a fixed wing flight.

12.7.1 Fixed Wing Incidents

Travel to the Brent, CADA and TENC assets generally requires a fixed wing flight from Aberdeen to Scatsa and then an onward helicopter journey to the platform. The information used to calculate the fixed wing risks to personnel is :

Fatal Accident Rate (per 108 person flight hours) 17

Flight Time from Aberdeen to Scatsa 1.5 hours

Fatality Fraction 1

The FAR is taken from the E&P Forum QRA Datasheet Directory.

The IRPA is calculated using the following equation :

IRPA = (FAR / 1x108) x No. Flights per Year x Flight Duration (T1)

For a 2-on-2-off shift pattern 26 flights per year would be used, for 2-on-3-off 21 flights per year are used.

12.7.2 Helicopter Accidents

Table 12-3 summarises the helicopter incidents during 1969 to 1996 period. It shows that of 87 North Sea helicopter accidents including the UK, Danish, Dutch and Norwegian sector, 17 resulted in fatalities. Note that due to a change in EC reporting requirements, the CAA data for 1995 and 1996 only covers UK registered aircraft and data for other sectors was not available. There is a significant difference between helicopter accidents in general and helicopter accidents which cause fatalities.

27% of the recorded North Sea accidents took place during take-off or landing at a helideck or heliport. These resulted in 13% of the fatalities.

The number of inflight accidents are 51% of the total number of accidents but represent 82% of the total number of fatalities.

The remaining accidents and fatalities relate to emergency landings and accidents involving personnel outside the aircraft.



This data does not provide detailed historical information on the number of landings as a percentage of the flying hours. A FAR or fatality risk/landing can therefore only be estimated.

Accident Type

Accidents

Fatal Accidents

Fatalities

No. % No. % No. % Crash on take-off or landing on heliport 11 13 - - - - Crash following critical aircraft system failure during flight

27

31

6

35

88

66

Sudden crash into terrain, obstructions or sea during flight

6

7

4

24

22

16

Mid-air collision with other aircraft - - - - - - Crash on take-off or landing on helideck 24 27 3 18 18 13 Unsuccessful emergency landing 12 14 1 6 3 2 Personnel accident outside aircraft 5 6 3 18 3 2 Personnel accident inside aircraft 1 1 - - - - Unknown 1 1 - - - - TOTALS

87

100

17

100

134

100

Table 12-3 - UK Sector Accident Statistics

The UK helicopter accident statistics are reported by the CAA each year. The data available from the CAA prior to the early 1970s are limited and the analysis has therefore been based on the 20 year period from 1977 to 1996 inclusive. A recent change in reporting requirements by EC regulations mean that total flight distances and passengers carried have not been recorded since 1993 and therefore the number of persons exposed is no longer obtainable from the CAA reports. The numbers of persons exposed for 1994 and subsequent years has been estimated by assuming the average number of persons per flight stage has remained constant. This is considered reasonable as, despite changing aircraft type and capacity, the number has only varied between 6.8 and 7.6 over the period from 1977 to 1993 with an average 7.2.

The UK sector accident statistics from 1977 to 1996 are summarised in Table 12-4.

Description

Accident data 1977 to 1996



Number of fatalities 84 67 17 Total reported flight hours 2,195,026 1,067,232 1.073,347 Number of reported flight stages 4,984,711 2,321,779 2,593,000 Average length of flight (minutes) 26 28 25 Total estimated number of passengers 35,479,602 16,594,246 18,885,386 Average number of passenger per stage 7.21 7.15 7.31 Total estimated exposure (person hours) 15,452,758 7,627,733 7,817,409 FAR overall 540 880 220

Table 12-4 - UK Accident Statistics 1977 to 1996

The overall FAR estimated for the 20 year period from 1977 to 1996 is about 50% greater than previous estimates which included earlier data since 1966 from a number of other sources. The variation in FAR is dominated by the Chinook accident in 1986 with 45 fatalities as shown by the comparison of 1977 to 1986 data with 1987 to 1996 data in Table 12-4.



The Chinook is no longer in UK offshore service and the largest current aircraft operate with 19 passengers and 2 crew so that the maximum number of fatalities in a single incident is reduced. In addition to the reduction in potential number of fatalities, the CAA data show a reducing trend in helicopter accident frequency although the frequency of accidents involving one or more fatalities has remained virtually constant. It is therefore considered reasonable to base future risk estimates on data collected since the Chinook incident.

It should be noted that the data from 1987 to 1996 do include two major incidents in 1989 (Brent Spar incident - 6 fatalities) and 1992 (Cormorant Alpha incident - 11 fatalities).

In order to estimate the effect on FAR and individual risk of flight patterns that deviate from the average of flight stages of 25 minutes, a notional FAR for a take-off and landing combination can be developed based on the proportion of fatalities that occur during take-off and landing. It is sometimes difficult to clearly differentiate between accidents during flight and accidents during take-off and landing particularly for an incident such as the Cormorant Alpha incident in 1992 where the event occurred immediately after take-off. Estimates of the proportion of fatalities that occur in incidents associated with take-off and landing range from 13% based on all data in Table 7.2.1 to 100% based on the two incidents since 1987 and considering the 1992 incident as associated with take-off. Previous analysis of helicopter incidents has used a proportion of 20% obtained from all UK offshore incidents and this is endorsed for continued use. The FAR for helicopter transport can therefore be presented in:

FAR = FAR take off and landing + FAR normal flying = FAR total

= 0.2 x Total FAR + 0.8 x Total FAR = 220

= 45 + 175 = 220

Based on the above, and a flight stage of 25 minutes associated with each take-off and landing, the fatality frequency for a take-off and landing combination is 1.9x 10-7. The FAR and individual risk are summarised in Table 12-5.

1977-1996 1977-1986 1987-1996 FAR overall 540 880 220 Notional FAR for take-off and landing 110 180 45 FAR normal flight 430 700 175 Individual risk per hour, overall 5.4 x 10-6 8.8 x 10-6 2.2 x 10-6 Individual risk per take-off and landing 4.8 x 10-7 8.4 x 10-7 1.9 x 10-7 Individual risk per hour, normal flight 4.3 x 10-6 7.0 x 10-6 1.8 x 10-6

Table 12-5 – FAR and Individual Risk For Helicopter Transport

The calculation of individual risk is therefore based on the following equation :

Helicopter IRPA = [(1.9E-07 x No. Take-off / Landings per trip) + (1.8E-06 x Flight time per trip (hours)) x No. Trips per year (T2)

Combining the helicopter and fixed wing risks produces the total transport risk flying to and from the installation.



13. SENSITIVITY ASSESSMENT

13.1 Introduction

Once the base case risk levels have been calculated it is important to ensure that further analysis of the risks are conducted to determine the effect any uncertainty may have on the risk levels. The sensitivity assessment reviews the change in risk through modifications to the inputs or key assumptions in the analysis.

The QRA model is developed using the best available information on the platform. However, it must be recognised that some of this information will be subject to some uncertainty and, where this is the case, the QRA attempts to model the most conservative approach in assessing the risk levels. The main areas of uncertainty generally relate to:

1. failure times of vessels from flame impingement; 2. the overpressure at which equipment fails when subjected to explosion loading; 3. modelling of structural failure and times to failure for critical structures and walls when

under fire and explosion loading; 4. effectiveness of deluge in controlling the escalation and impairment potential of fires

on the platform; 5. the modelling of gas concentration build up within the release area based on CSTR

modelling; 6. the ignition and explosion probability model that has been used; 7. the reliability of the safety systems on the platform and in particular the

accommodation HVAC system; 8. effectiveness of the re-breather sets in allowing escape from the TR; 9. explosion loading and exceedance curves used in the assessment; 10. hydrocarbon release frequencies used in the assessment in comparison to known

leaks on the platform or other release models; 11. ship collision frequency calculated using COLLIDE.

Many of these areas of uncertainty are specific to particular platforms, i.e. structural capacities to explosions. In some cases, the contribution to platform risks from structural failure may be small and the risk from explosions low such that the sensitivity of changes to the structural capacity need not be explored further. Such sensitivities are not discussed in great detail here.

The following sensitivities are of a generic nature and could be applied to all platform QRA’s.

13.2 Leak Frequency Model

The E&P Forum [4] leak frequency model could be replaced with the OIR 12 [37] leak database to determine the impact that modifications to the topsides leak frequency have on the risks. The equipment leak frequency for OIR 12 is shown in Table 13-1.



Frequency (/yr)


Reciprocating Compressors 6.28E-02 4.93E-02 1.12E-02 2.30E-03

Centrifugal Compressors 4.74E-03 3.72E-03 8.44E-04 1.74E-04

Reciprocating Pump 6.30E-03 4.67E-03 1.31E-03 3.29E-04

Centrifugal Pump (double seal) 5.08E-03 3.76E-03 1.05E-03 2.65E-04

Centrifugal Pump (Single seal) 5.37E-03 3.98E-03 1.11E-03 2.80E-04

Shell & Tube Heat Exchangers Shell 3.93E-03 2.80E-03 1.03E-03 1.07E-04

Shell & Tube Heat Exchangers Tubing 2.42E-03 1.73E-03 6.31E-04 6.69E-05

Plate 1.11E-02 7.88E-03 2.88E-03 3.05E-04

Fin Fan Coolers 3.56E-03 2.54E-03 9.26E-04 9.81E-05

Dual Fuel Turbines 5.38E-02 4.23E-02 9.57E-03 1.98E-03

Gas Turbines 2.09E-02 1.64E-02 3.73E-03 7.69E-04

Expanders 2.86E-02 2.24E-02 5.08E-03 1.05E-03

Pressure Vessels 2.02E-03 1.23E-03 4.35E-04 3.52E-04

Pig Receivers & Launchers 2.54E-03 1.55E-03 5.47E-04 4.43E-04

Other Pressure Vessels 1.25E-02 7.62E-03 2.69E-03 2.18E-03

Wellheads / Xmas Tree (Press. < 5000 psi) 2.47E-03 1.51E-03 8.63E-04 9.59E-05

Wellheads / Xmas Tree (Press. > 5000 psi) 1.64E-03 1.00E-03 5.71E-04 6.35E-05

Crude Oil Storage Tank 1.06E-03 6.49E-04 2.29E-04 1.85E-04

Filters 2.22E-03 1.39E-03 5.92E-04 2.31E-04

Instruments 4.54E-04 3.02E-04 1.39E-04 1.24E-05

Flanges D < 3 inch 3.21E-05 2.28E-05 3.64E-06 5.62E-06

Flanges 3 < D < 11 4.09E-05 3.33E-05 3.50E-06 4.09E-06

Flanges D > 11 inch 6.67E-05 5.44E-05 5.71E-06 6.68E-06

ESD Valves D < 3 inch 2.74E-04 1.79E-04 6.51E-05 3.01E-05

ESD Valves 3 inch < D 2.74E-04 1.99E-04 3.86E-05 3.70E-05

Other Actuated Valves D < 3 inch 8.20E-04 5.35E-04 1.95E-04 8.99E-05

Other Actuated Valves 3 inch < D 8.20E-04 5.94E-04 1.15E-04 1.11E-04

Manual Valves D < 3 inch 4.69E-05 3.06E-05 1.11E-05 5.14E-06

Manual Valves 3 < D < 11 9.97E-05 7.22E-05 1.40E-05 1.34E-05

Manual Valves D > 11 inch 4.58E-04 3.32E-04 6.44E-05 6.18E-05

Steel Piping (/ metre) D < 3 inch 1.40E-04 9.48E-05 3.46E-05 1.10E-05

Steel Piping (/ metre) 3 < D < 11 4.73E-05 3.30E-05 6.86E-06 7.37E-06

Steel Piping (/ metre) D > 11 inch 3.58E-05 2.50E-05 5.20E-06 5.58E-06

Flexible Piping (All sizes / metre) 2.24E-04 1.07E-04 7.61E-05 4.04E-05

Table 13-1 – OIR12 Leak Frequency



13.3 Platform Specific Leak Frequency

If the actual number of QRA type leaks and operating period of the platform is known then an overall leak frequency for the platform can be calculated. By factoring the leak frequency calculated in the QRA by the platform specific leak frequency, then the risk levels can be obtained for an equivalent platform leak frequency. This sensitivity assumes that the leaks are equally spread throughout the platform and not specific to a particular problem with one piece of equipment in one module, as may actually be the case.

13.4 Ignition Model

The Cox, Lees and Ang model [38] may be used to assess the ignition and explosion probabilities on the platform. This model has been developed for naturally ventilated modules and as such may under predict the potential ignition probability for enclosed modules. The ignition model makes use of the following equations to calculate the ignition probability :

)333.4)ln(392.0( −= Qignition eP for oil releases, min 0.01 and max 0.08. (U1)

)16.4)ln(642.0( −= Qignition eP for gas releases, min 0.01 and max 0.3 (U2)

where Q is the oil or gas release rate (kg/s).

The conditional explosion probability is calculated using the equation :

)995.2)ln(38.0(exp

−= Qlosion eP min 0.04 and max 0.3 (U3)

where Q is the gas release rate or flash gas release rates from an oil release (kg/s).

13.5 Safety System Reliability

The reliability of the safety systems on an installation are dependent on the testing and maintenance regime employed on the platform. The reliability values set in the QRA are based on IPF review and to test the sensitivity of the risk levels to these values, the following values are proposed for the sensitivity analysis.

Safety System Reliability

ESD 94%

Blowdown 94%

TR HVAC 97%, 90%

Table 13-2 – Sensitivity Values for Safety Systems



13.6 Deluge Effectiveness

The effectiveness of deluge can be treated to sensitivity assessment by removing the benefit from the calculation of impairment probabilities, i.e. setting effectiveness to zero. For high pressure gas platforms it will be found that this has little impact on the risk levels as deluge is particularly ineffective against deluge. For high inventory oil platforms this sensitivity may result in a significant increase in risk as deluge has been taken to have a high effectiveness in controlling oil fires. The effectiveness values that are used for deluge are given in Table 8-5.

13.7 Explosion Exceedance Curves

The sensitivity of the risks to the exceedance curves can be tested by increasing or decreasing the probabilities of exceedance by 10%. Alternatively, the maximum overpressures predicted by SCOPE or EXSIM could be factored to determine the impact of such changes on the risks. In general, there may be more uncertainty with the SCOPE results than with EXSIM results, due to the nature and level of detail included in these explosion packages.



Page 103

14. REFERENCES

1 SI 1992 No. 2885 Offshore Installations (Safety Case) Regulations 1992.

2 Health and Safety Executive : Hydrocarbon Release Database Population Data Questionnaire, Doc. Ref. JWP/FRD/66, Rev 5.

3 “PARLOC 96: The Update of Loss of Containment Data for Offshore Pipelines”, Advanced Mechanics and Engineering for the HSE, OTH 551, 1998.

4 “Hydrocarbon Leak and Ignition Database”, E&P Forum, Report No. 11.4/180, May 1992.

5 Blowout Frequencies 2000, BlowFAM Edition, Scandpower, Report No. 27.20.01/R3, March 2000.

6 Blowout Frequency Assessment Shearwater Development, Scandpower, Project Number 27.78.01/R1, Final, January 1998.

7 "Handbook for Fire Calculations and Fire Risk Assessment in the Process Industry", Scandpower - Sintef, 1992.

8 FRED 3.0 Technical Manual, Shell Global Solutions, March 2000.

9 Shell International Exploration and Production: Riser Safety Evaluation Routine, C2718/DC/PN, September 1991.

10 Young, W.C.: Rourk’s Formulas for Stress and Strain, 6th Edition, 1989.

11 Joint Industry Project, Gas Build Up From High Pressure Natural Gas Releases in Naturally Ventilated Offshore Modules, Workbook on Gas Accumulation in a Confined and Congested Area, May 2000.

12 Information Note EN/064 Evaluation Of Fire Hazards And Passive Protection Requirements - Offshore Installations Rev : 0/Aug 1993, Shell Engineering Reference Document.

13 The SFPE Handbook of Fire Protection Engineering, Society of Fire Protection Engineers, 2nd Edition,1995.

14 Shell U.K. Exploration and Production, Smoke Task Force, Vol.1, Summary and Findings, April 1992.

15 Health and Safety Executive, “Major Hazard Assessment: A Survey of Current Methodology and Information Sources”, Specialist Inspection Report No. 29, 1991.

16 Norwegian Public Reports, NOU 1986:16, “Uncontrolled Blowout on West Vanguard Drilling Platform, 6th October 1985”, Universitetsforlaget A/S.

17 Shell U.K. Exploration and Production, TR Life Support Impairment Assessment, January 1997, Rev 2.

18 Chamberlain, G.A. : (ORTEE/3) Physical Effects Modelling Handbook OP.97.47104 (Confidential)

19 AIDA, M Liddament, Air Infiltration Review, Vol. 11(1), December 1989.

20 TNGR.94.133 Guidance on Fire Severity and Smoke Source Terms in Fire Scenarios. G.A. Chamberlain

21 Shell U.K. Exploration and Production, Heat Stress Impairment User Manual, UEOE/214, E95011.



Page 104

22 Technical Note. Review of Shell Expro Ignited Events, C.2567A/19.005, 23 April 1992, DNV Technica.

23 Hydrocarbon Leaks on Northern Operations Production Platforms, August 1987, M P Turpin and P Pentecost.

24 Loss of Containment Incidents for Northern, Central and Brent Fields, September 1990, D Raghunathan.

25 Human Reliability Estimates within Offshore Safety Cases, J. N. Edmondson, Issue 1, 12 November 1993, JWP/FRD/74.

26 Offshore Reliability Data (OREDA) ’97, Prepared by SINTEF, 3rd Edition, 1997.

27 Extension of the Subsea isolation Systems Reliability Database, RM Consultants Ltd, OTH 96 502.

28 FABIG Newsletter Issue 25, The Steel Construction Institute, January 2000.

29 Explosion modelling - the application of pressure correction factors via a "severity index". J.S. Puttock. Report TNRN.97.7407

30 Explosions in offshore modules - revisions to guidance on probability of exceeding given overpressures. J.S. Puttock. Report TNRN.97.7408

31 Shell U.K. Exploration and Production, “Safety and Environmental Audit, Kittiwake Platform QRA”, Final Issue, December 1992.

32 Brent Alpha Additional Compression Train Quantitative Risk Assessment, Rev A2, Doc. No. BA0908-X-96506-001.

33 Department of Energy's 'Brown Book' for fixed and mobile platforms and vessels, 1979-89.

34 Worldwide Offshore Accident Databank (WOAD), Statistical Report 1998, DNV.

35 Loss Prevention in the Process Industries, Frank P Lees, 2nd Edition, 1996.

36 Troll SP-4 Concept Safety Evaluation, 89-3049, Veritec cite SRS.

37 AEA Technology, An Analysis of the OIR12 Data And Its Use In QRA, AEAT/NOIL/27564001/002(R), November 2000.

38 Cox, Lees & Ang, IChemE: “Classification of Hazardous Locations”, February 1993.


Page A


1

APPENDIX A

Equipment Count Methodology


Page A


2

1. RULE SETS FOR PARTS COUNTING This section outlines the rule sets employed to convert P&ID information into the data required for the process and riser hydrocarbon leak frequency.

1.1 System Data A boundary definition of the separation system has been given by the HSE. This philosophy has been extended to define the boundary of each system. The system begins just after the first shut-off valves on the output line of the previous systems. The system ends after the first-shut-off valves on the output lines. The shut-off valves are taken to be emergency shut-down (ESD) valves. Blowdown, depressurisation and pressure relief valves are not considered to be part of the separation system. They are to be included in the relevant blowdown or flare system. All chemical injection lines are counted as a separate system. For detailed definitions of each system, reference should be made to the HSE Guidance Notes [1].

1.2 Detailed Parts count

For each system identified, a parts count spreadsheet is completed as appropriate. Certain systems, for example the diesel distribution, do not necessarily require a detailed parts count to be completed due to the low level of risk associated with such systems.

1.2.1 Valves Valves are assigned to one of the following categories:

• Manual Block: all hand operated valves in pipework; • Manual Bleed: all small hand operated valves connected to the pipework; • Manual Choke • Manual Check: all non return valves; • Activated ESD: all emergency shut down valves; • Activated Control: all flow control valves.

1.2.2 Flanges Each valve counted has two flanges, unless it is welded in place. For valves at the boundary, half of the valve and 1 flange are included in one system and the rest in the adjacent boundary. Spectacle blinds and orifice plates count as 3 flanges. Blinds on bleed valves are counted as 1 flange. In addition, an extra flange joint (i.e. 2 flanges) has been assumed for every 3m of


Page A


3

pipework, except where the pipework is welded. Figure A 1.2.1 details the entries made in the parts count for typical flange and valve P&ID symbols.

1.2.3 Instruments An instrument includes the instrument itself, plus up to 2 valves, up to 4 flanges and associated small bore piping (1”). Any additional equipment is included in the appropriate equipment item category. Figure A 1.2.1 details the entries made in the parts count for typical instrument arrangement.

1.2.4 Piping lengths Rather than take detailed measurements from piping isometrics (generally not held by Atkins) or carry out an offshore survey, pipework lengths are simply estimated from equipment layout drawings. The pipe lengths between vessels have been estimated from these drawings. The location of ESD valves on the pipework are assumed to be located half way between the vessels. In addition, it is assumed that there is 5m of 2” piping associated with the level indicators, in addition to that included in the instrument count. The form used in the parts count for each system is included below (Figure A 1.2.2). The data in this form is combined and simplified to feed into the E&P Forum Leak Frequency calculation as shown in Figure A 1.2.3.

1.3 Package Count Occasionally there may be a requirement to conduct a high level package count of equipment rather than a detailed equipment count of every single piece of equipment. The circumstances where a package count may be conducted include:

• Where there is insufficient details on the P&ID, i.e. an equipment item is shown as a Vendor Package blank box;

• Where the package may contribute a low level of risk to the overall risks on the platform, i.e. a diesel pump package;

• Where the assessment is a concept risk assessment of many concepts being conducted at a high level.

The individual equipment items that contribute to these packages was based on a review of typical packages conducted in [2]. The breakdown of the equipment packages is shown in Figure A.1.2.4.


Page A


4

Typical P&ID Symbol Description Parts Count Entry

Flange joint 2 flanges of the appropriate dimension.

Open spectacle blind 3 flanges of the appropriate dimension.

Any type of valve (including check valve)

2 flanges of the appropriate dimension. 1 valve of the appropriate type and dimensions.

Any simple instrument 1 instrument.

Sample connection 2 bleed valves.4 flanges.SC

Figure A 1.2.1 Parts Count Data


Page A


5

PARTS COUNT (BASED ON HSE METHODOLOGY)

Event ID:

Event Description:

Location:

NO. OF ITEMS/EQUIPMENT ITEM CATEGORY LENGTH OF

PIPEWORK (m)1 BOP STACKS SURFACE

SUBSEA2 WELLHEADS P <= 5000 psi (345 bar)

5000 psi < P <= 10000 psi (690 bar)P > 10000 psi

3 XMAS TREES P <= 5000 psi (345 bar)5000 psi < P <= 10000 psi (690 bar)P > 10000 psi

4 COMPRESSORS CENTRIFUGALRECIPROCATING

5 FILTERS -6 EXPANDERS -7 RECOMPRESSORS - Extra Flanges Total8 FIN FAN COOLERS - For Pipework Flanges9 FLANGES D <= 3" 0 0

3" < D <= 11" 0 0D > 11" 0

10 HEAT EXCHANGERS HC IN SHELLHC IN TUBEPLATE

11 INSTRUMENTS -12 MUD/SHALE TANKS

PUMPSSHAKERS

13 DEGASSERS SURFACESUBSEA

14 DIVERTERS -15 (NOT USED) -16 PIG LAUNCHERS D <= 8"

8" < D <= 12"12" < D <= 16"D > 16"

17 PIG RECEIVERS D <= 8"8" < D <= 12"12" < D <= 16"D > 16"

18 PIPELINES (STEEL) D <= 4"4" < D <= 8"8" < D <= 12"12" < D <= 16"D > 16"

PIPELINES (FLEXIBLE) D <= 4"4" < D <= 8"8" < D <= 12"12" < D <= 16"D > 16"

19 RISERS (STEEL) D <= 4"4" < D <= 8"8" < D <= 12"12" < D <= 16"D > 16"

RISERS (FLEXIBLE) D <= 4"4" < D <= 8"8" < D <= 12"12" < D <= 16" ExtraD > 16" Length (m) Flanges

20 PIPING (STEEL) D <= 3" see opposite Pipework 2" NB3" < D <= 11" see opposite Pipework 4" NBD > 11" see opposite Pipework 6" NB

PIPING (FLEXIBLE) D <= 3" see opposite Pipework 8" NB3" < D <= 11" see opposite Pipework 12" NBD > 11" see opposite

21 PRESSURE VESSEL (VERTICAL) SEPARATORSCRUBBERADSORBERREBOILERK.O. DRUMSTABILISEROTHER (SPECIFY BELOW)

PRESSURE VESSEL (HORIZONTAL) SEPARATORSCRUBBERADSORBERREBOILERK.O. DRUMSTABILISEROTHER (SPECIFY BELOW)

22 PUMPS CENTRIFUGAL (SINGLE SEAL)CENTRIFUGAL (DOUBLE SEAL)RECIPROCATING (SINGLE SEAL)RECIPROCATING (DOUBLE SEAL)

23 STORAGE TANKS -24 TURBINES GAS

DUAL FUEL25 MANUAL BLOCK VALVE D <= 3"

3" < D <= 11"D > 11"

MANUAL BLEED VALVE -MANUAL CHOKE VALVE D <= 3"

3" < D <= 11"D > 11"

MANUAL CHECK VALVE D <= 3"3" < D <= 11"D > 11"

ACTUATED P/L ESDV VALVE D <= 4"4" < D <= 8"8" < D <= 12"12" < D <= 16"D > 16"

ACTUATED P/L SSIV ASSEMBLY VALVE D <= 4"4" < D <= 8"8" < D <= 12"12" < D <= 16"D > 16"

ACTUATED ESDV VALVE D <= 3"3" < D <= 11"D > 11"

ACTUATED CONTROL VALVE D <= 3"3" < D <= 11"D > 11"

ACTUATED BLOCK VALVE D <= 3"3" < D <= 11"D > 11"

ACTUATED CHOKE VALVE D <= 3"3" < D <= 11"D > 11"

ACTUATED BLOWDOWN VALVE D <= 3"3" < D <= 11"D > 11"

ACTUATED RELIEF VALVE D <= 3"3" < D <= 11"D > 11"

NOTES:

P = design pressureD = nom. bore/diameter per APIP/L = Pipeline

Figure A 1.2.2 Parts Count Form


Page A


6

Event NameEvent Location

Equipment DescriptionNumber of Components

Reciprocating CompressorsCentrifugal CompressorsReciprocating PumpCentrifugal Pump (double seal)Pressure VesselsShell & Tube Heat Exchangers (3) Shell HSE Storage Tanks also added hereShell & Tube Heat Exchangers (3) Tubing HSE Plate Heat Exchangers added hereShell & Tube Heat Exchangers (3) CombinedSmall Process Piping ( /m ) < 3 inchProcess Piping ( /m ) 4 inchProcess Piping ( /m ) 6 inchProcess Piping ( /m ) 8 inchProcess Piping ( /m ) 10 inchProcess Piping ( /m ) 11 inchLarge Process Piping ( /m ) > 12 inchFlange <3 inchFlange 4 inch Note 1Flange 6 inchFlange 8 inchFlange 10 inchFlange 11 inchFlange > 12 inchValve <3 inchValve 4 inch Note 2Valve 6 inchValve 8 inchValve 10 inchValve 11 inchValve > 12 inchSmall bore fitting (2)

Packages

Vessel PackageSeparator PackageHeat Exchanger PackagePump (Centrifugal) PackageCentrifugal Compressor PackageSpare 1Spare 2Spare 3Spare 4Spare 5

Notes:

1. All flanges from the HSE count in the range 3"< D <=11" have been added to the 4" flange category above. This makes no difference to the release frequency calculations since the failure rate values for all the above flange sizes apart from the < 3" size are the same.

2. All valves from the HSE count in the range 3"< D <=11" have been added to the 4" valve category above. This makes no difference to the release frequency calculations since the failure rate values for all the above valve sizes apart from the < 3" size are the same.

Figure A 1.2.3 Parts Count Data Summary fed into the Process Leak Frequency


Page A


7

Vessel PackageNumbers

Pressure Vessels 1Small Process Piping ( /m ) < 3 inch 25Process Piping ( /m ) 8 inch 25Flange <3 inch 5Flange 4 inch 5Flange 6 inch 10Flange 8 inch 5Valve <3 inch 2Valve 4 inch 2Valve 6 inch 4Valve 8 inch 2Small bore fitting 10

Separator PackageNumbers

Pressure Vessels 1Small Process Piping ( /m ) < 3 inch 25Process Piping ( /m ) 6 inch 25Flange <3 inch 12Flange 4 inch 12Flange 6 inch 24Flange 8 inch 12Valve <3 inch 5Valve 4 inch 5Valve 6 inch 10Valve 8 inch 5Small bore fitting 20

Heat Exchanger PackageNumbers

Shell & Tube Heat Exchangers (3) Combined 1Small Process Piping ( /m ) < 3 inch 13Process Piping ( /m ) 6 inch 13Flange <3 inch 2Flange 4 inch 2Flange 6 inch 4Flange 8 inch 2Valve 6 inch 4Small bore fitting 4

Pump (Centrifugal) PackageNumbers

Centrifugal Pump (double seal) 1Small Process Piping ( /m ) < 3 inch 13Process Piping ( /m ) 6 inch 13Small bore fitting 4

Centrifugal Compressor PackageNumbers

Centrifugal Compressors 1Small Process Piping ( /m ) < 3 inch 25Process Piping ( /m ) 6 inch 25Flange 6 inch 6

Figure A 1.2.4 Package Count Data


Page A


8

[1] Health and Safety Executive: Hydrocarbon Release Database Population Data Questionnaire, Doc. Ref. JWP/FRD/66.Rev 5 [2] Failure Rate and Ignition Probability Data for the Central Fields QRA, WS Atkins Consultants Ltd, D1668-FR (Rev .04), December 1993.


Page B


1

APPENDIX B

Topsides Release Frequency Database


Page B


2

1. LEAK FREQUENCY IMPLEMENTATION The leak frequencies for each hydrocarbon event in the QRA are calculated using the data presented here. From the available data sources listed in the references, the most appropriate data source for each type of equipment item is given next.

1.1 Methodology Applied to Process Leak Frequencies

1.1.1 Basis for Hole Sizes Used To identify the number and dimensions of the hole sizes to be used, a review of the consequences was made for a number of release cases. Given that a release occurs, its consequences generally depend on a number of factors. These include:- − Probability of ignition, dependent on:-

o Duration and release rate of an event, which are themselves dependent on :- § blowdown and isolation § inventory size and pressure § composition of released fluid § whether the hole is in the liquid or gas phase of an inventory

o Ignition sources (the electrical equipment within modules being intrinsically safe and the permit to work system try to control the number and location of any potential hazard).

− Probability of explosion, dependent on:- o Gas cloud size (hence release rate and duration dependent) o module size, module congestion and ventilation rates

− Escalation Potential from fire, dependent on:- o Size of fire event (release rate and duration dependent), o Proximity of other equipment / structure to which escalation could occur, o Active fire fighting systems/passive fire protection provisions.

These factors determine whether an event gives rise to fatalities and eventual impairment of the TR. To consider all these factors analytically would require a great deal of effort while not necessarily providing a clear answer. The following table summarises the main areas to be considered along with the following points:- − If blowdown and isolation is effective then the event duration for:

o Small \ medium releases is dictated by the blowdown system, o Very large releases will be almost instantaneous.

− The rate of fluid released is dependent on the hole size area. The proportion of the module filled will therefore depend on this, the size of the module and the air change rate.

− Fire sizes from large releases have the potential to fill the module and be uncontrolled by active fire fighting systems.

− Fires from medium releases may be controlled by active fire fighting systems but could still cause escalation \ impairment.

− Fires from small releases will be potentially controllable by active fire fighting systems reducing the probability of escalation.


Page B


3

Hole Size

Successful Isolation and Blowdown Failure of Isolation and Blowdown

Explosion O/P and Prob.

Fires Gas Build-up Fires Gas Build-up (either case)

Large Fill Module, Ventilation Controlled with some External Burning, Short Duration

Large Gas Cloud of Short Duration

Large Fires of Reasonable Duration

Large Gas Cloud of Long Duration

High O/P and Probability due to Potentially Large Gas Clouds.

Medium Unlikely to Fill Module, Large enough to Impinge several equipment items. Duration Governed by B/D System

Medium Gas Cloud, Duration Dependent on B/D

Fires of Long Duration

Medium Gas Cloud with Long Duration

Potentially High O/P but with Medium Probability. Large Gas Clouds Less Probable than Large Release.

Small Could Impinge on Adjacent Equipment, Escalation Potential Reduced by Active Fire Fighting System. Duration Governed by B/D System

Relatively Small Gas Clouds, Duration Dictated by B/D System

Small Fire of Long Duration

Relatively Small Gas Clouds with Long Duration

Likely to be Low O/P with Low Probability. Gas cloud Unlikely to Fill a Significant Part of the Module.

Table B 1-1: Summary of Relative Release Consequences

1.2 Topside Process Events

The hole size split for the topside process events is based on three nominal sizes; small, medium and large. These descriptions correspond to the following diameters:

Breach Description

Breach Diameter (mm)

Small 3 Medium 10 Large 50

Table B 1-2: Breach Diameters for Topsides Process Releases

The rationale for these values is briefly discussed below. Large Hole Size For the large hole size case, values greater than this could have durations which are much shorter and whose consequences would not be any worse (in terms of QRA analysis) given the confines of a module. The gas cloud formed from a large release is


Page B


4

likely to fill the module (dependent on size and ventilation rate of a module). An ignited gas release is likely to give ventilation controlled fires across a broad range of inventory pressures. The large hole size case given provides a good balance between release rate and duration. Medium Hole Size This event has to be distinctive from the large hole case to represent the potential risks from a moderate fire size with a duration dependent on the blowdown system (if successfully operated). The fire size for a medium hole size event, while large enough to have a high probability of impingement on adjacent equipment, will not be so large that the event will rapidly depressurise the inventory. The gas cloud formed from this release case is still likely to be of a reasonable size, though much less likely to fill the entire module than the large release case. Small Hole Size The small hole size value chosen in the table above was picked since sizes smaller than this are unlikely to have fire consequences which would lead to escalation, except for high pressure inventories. The potential of gas build-up from small hole size releases will be greatly reduced compared to the medium hole size case.

1.2.1 Indicative Hole Sizes Since discrete hole sizes are representative of a range it should be ensured that the consequences of the selected hole size considered reflects the broad range of possibilities as much as possible. For this a method has been developed to estimate the upper and lower bound values for each hole size based on the consequences of the release. The hole size that this range describes is termed the “indicative hole size”. This is illustrated in Figure B 1-1.

0

U3/ L10

3 10 50

U10/ L50

IndicativeHole Size

3 mmRange

10 mmRange

50 mmRange

Figure B 1-1: Range Covered by Each Indicative Hole Size

The consequences (flame length, flame volume, gas build-up) are at least partly proportional to the flowrate. Therefore to allocate a suitable range to each hole size the flowrate can be considered. This concept is best expressed by considering the ratio of the flowrate for the boundary of the range to the flowrate of the indicative hole size.


Page B


5

These ratios have been set using a relationship, which sets the boundary of each range such as to maximise the extent to which it represents the indicative hole size. The relationship is shown below for the boundary value between the x1 and x2 mm indicative hole size values.

=1

21 /

x

LxUx

Q

Q

21

2

/ LxUx

x

Q

Q

Where:- Q= Flowrate, the subscripts represent the hole size i.e.

x1 and x2 for indicative hole sizes & Ux1/Lx2 is the upper bound for the x1 mm and therefore Lower bound for x2 mm release.

The ranges calculated for each indicative hole size are shown in Table B 1-3.

Range (mm) Description Indicative Hole Size (mm) Lower Upper

Small 3.00 0.0 5.5 Medium 10.00 5.5 22.4 Large 50.00 22.4 Rupture

Table B 1-3: Ranges calculated for each Indicative Hole Size


Page B


6

2. EQUIPMENT COUNT LEAK FREQUENCIES BASED ON E&P FORUM DATA The leak frequency distributions have been based on those suggested in E&P Forum [1] except in the case of the centrifugal pump which uses Cox, Lees and Ang [2] data as E&P Forum data for pumps is based on Nuclear Industry experience. A model has been developed which uses the data points provided in [1, 2] to estimate the probability of the indicative hole size (based on the upper and lower bounds discussed earlier). Some interpretation of the data points has been made since most of the information has a comparatively large initial starting hole size. If a simple linear interpolation method is used then the probability of say a hole size in the 0 to x1 mm range would be equal to x1 to x2 mm hole size. Experience has shown that the probability for the smaller range (0 to x1) is much higher. Hence the data points have been derived with an exponential curve fitted to the first point in the data (which usually accounts for about 90% of the probability). The two figures below show the different results obtain from a linear interpolation and from an exponential curve fitted to the first point in the data.

Probability of (d<D) for Centrifugal Pump (double seal)

0

0.2

0.4

0.6

0.8

1

0 20 40 60 80 100 120 140 160 180 200 220

Hole Size (m m )

Pro

bab

ility

of

Rel

ease

Figure B 2-1: Linear Interpolation between Data points (only) for a Probability Distribution for a Centrifugal Pump


Page B


7


0.000

0.200

0.400

0.600

0.800

1.000

0 20 40 60 80 100 120 140 160 180 200 220

Hole Size (m m )

Pro

bab

ility

of R

elea

se

Figure B 2-2: Exponential Curve Fitted to First Data Point for a Centrifugal Pump

Where: d = Actual breach diameter (mm)

D = any given diameter (mm)

Table B 2-1 gives the breakdown of leak frequency, for the various items considered in the QRA, based on the assumptions already outlined. The probability of the different hole sizes occurring is based on the data graphically shown below.

Probability of (d<D) for Reciprocating Compressors

0.0000.2000.4000.6000.8001.0001.200

0 20 40 60 80 100 120

Hole Size (mm)

Pro

bab

ility

of

Rel

ease

Total Leak Frequency per Year: 6.60E-01


Page B


8

Probability of (d<D) for Centrifugal Compressors

0.000

0.200

0.400

0.600

0.800

1.000

1.200

0 20 40 60 80 100 120

Hole Size (mm)

Pro

bab

ility

of R

elea

se


Probability of (d<D) for Reciprocating Pump

0.000

0.200

0.400

0.600

0.800

1.000

1.200

0 20 40 60 80 100 120

Hole Size (mm)

Pro

bab

ility

of R

elea

se



0.000

0.200

0.400

0.600

0.800

1.000

1.200

0 50 100 150 200 250

Hole Size (mm)

Pro

bab

ility

of

Rel

ease



Page B


9

Probability of (d<D) for Pressure Vessels

0.000

0.200

0.400

0.600

0.800

1.000

1.200

0 50 100 150 200 250

Hole Size (mm)

Pro

bab

ility

of

Rel

ease


Probability of (d<D) for Shell & Tube Heat Exchangers

0.000

0.200

0.400

0.600

0.800

1.000

1.200

0 50 100 150 200 250

Hole Size (mm)

Pro

bab

ility

of

Rel

ease


Probability of (d<D) for Small Process Piping ( /m )

0.000

0.200

0.400

0.600

0.800

1.000

1.200

0 0.2 0.4 0.6 0.8 1 1.2

Hole Size (hole / pipe Diameter)

Pro

bab

ility

of

Rel

ease



Page B


10

Probability of (d<D) for Process Piping ( /m )

0.000

0.200

0.400

0.600

0.800

1.000

1.200

0 0.2 0.4 0.6 0.8 1 1.2


Pro

bab

ility

of

Rel

ease


Probability of (d<D) for Large Process Piping ( /m )

0.000

0.200

0.400

0.600

0.800

1.000

1.200

0 0.2 0.4 0.6 0.8 1 1.2


Pro

bab

ility

of

Rel

ease


Probability of (d<D) for Flange

0.000

0.200

0.400

0.600

0.800

1.000

1.200

0 0.2 0.4 0.6 0.8 1 1.2


Pro

bab

ility

of

Rel

ease



Page B


11

Probability of (d<D) for Valve

0.000

0.200

0.400

0.600

0.800

1.000

1.200

0 0.2 0.4 0.6 0.8 1 1.2


Pro

bab

ility

of

Rel

ease


Probability of (d<D) for Small bore fitting

0.000

0.200

0.400

0.600

0.800

1.000

1.200

0 0.2 0.4 0.6 0.8 1 1.2


Pro

bab

ility

of

Rel

ease


It should be noted that for process pipework between 4 and 11 inches, no change in leak frequency distribution is made. This is due to the E&P Forum [1] data specifying that the hole size is not pipework diameter specific. To estimate the hole size an averaged value has been taken. It has also been decided to use average flange and valve sizes for the range 4 and 11 inches since often the count is not detailed enough in this area. A similar frequency has been developed for OIR 12 [3] data and is presented in Section 13 of the main QRA report.


Page B


12

Frequency (/yr)


Reciprocating Compressors 6.60E-01 5.63E-01 8.42E-02 1.29E-02Centrifugal Compressors 1.40E-02 1.06E-02 2.65E-03 7.27E-04Reciprocating Pump 3.10E-01 1.91E-01 1.11E-01 8.48E-03Centrifugal Pump (double seal) 3.33E-03 1.51E-03 1.50E-03 3.18E-04Pressure Vessels 1.50E-04 2.32E-05 5.14E-05 7.54E-05Shell & Tube Heat Exchangers Shell 1.50E-04 2.32E-05 5.14E-05 7.54E-05Shell & Tube Heat Exchangers Tubing 1.30E-05 2.01E-06 4.45E-06 6.54E-06Shell & Tube Heat Exchangers Combined 1.63E-04 2.52E-05 5.58E-05 8.20E-05Small Process Piping ( /m ) < 3 inch 7.00E-05 4.45E-05 1.73E-05 8.26E-06Process Piping ( /m ) 4 inch 3.60E-05 1.54E-05 1.05E-05 1.01E-05Process Piping ( /m ) 6 inch 3.60E-05 1.54E-05 1.05E-05 1.01E-05Process Piping ( /m ) 8 inch 3.60E-05 1.54E-05 1.05E-05 1.01E-05Process Piping ( /m ) 10 inch 3.60E-05 1.54E-05 1.05E-05 1.01E-05Process Piping ( /m ) 11 inch 3.60E-05 1.54E-05 1.05E-05 1.01E-05Large Process Piping ( /m ) > 12 inch 2.70E-05 7.50E-06 9.71E-06 9.79E-06Flange <3 inch 8.80E-05 7.64E-05 8.75E-06 2.82E-06Flange 4 inch 8.80E-05 5.68E-05 2.78E-05 3.40E-06Flange 6 inch 8.80E-05 5.68E-05 2.78E-05 3.40E-06Flange 8 inch 8.80E-05 5.68E-05 2.78E-05 3.40E-06Flange 10 inch 8.80E-05 5.68E-05 2.78E-05 3.40E-06Flange 11 inch 8.80E-05 5.68E-05 2.78E-05 3.40E-06Flange > 12 inch 8.80E-05 5.68E-05 2.78E-05 3.40E-06Valve <3 inch 2.30E-04 1.72E-04 4.54E-05 1.22E-05Valve 4 inch 2.30E-04 1.20E-04 8.86E-05 2.15E-05Valve 6 inch 2.30E-04 1.20E-04 8.86E-05 2.15E-05Valve 8 inch 2.30E-04 1.20E-04 8.86E-05 2.15E-05Valve 10 inch 2.30E-04 1.20E-04 8.86E-05 2.15E-05Valve 11 inch 2.30E-04 1.20E-04 8.86E-05 2.15E-05Valve > 12 inch 2.30E-04 1.20E-04 8.86E-05 2.15E-05Small bore fitting 4.70E-04 2.03E-04 2.67E-04PackagesVessel Package 1.20E-02 6.37E-03 4.82E-03 8.12E-04Separator Package 2.32E-02 1.25E-02 9.53E-03 1.22E-03Heat Exchanger Package 5.17E-03 2.67E-03 2.07E-03 4.30E-04Pump (Centrifugal) Package 6.54E-03 3.07E-03 2.91E-03 5.47E-04Centrifugal Compressor Package 1.72E-02 1.25E-02 3.51E-03 1.21E-03

Table B 2-1: Leak Frequency Split between Different Hole Sizes


Page B


13

[1] E & P Forum, “Hydrocarbon Leak and Ignition Data Base”, Report No. 11.4/180, May 1992. [2] Cox, A.W., Lees, F.P. & Ang, M.L., “Classification of Hazardous Locations”, 1991. [3] AEA Technology, An Analysis of the OIR 12 Data And Its Use In QRA, AEAT/NOIL/27564001/002(R), November 2000.


Page C


1

APPENDIX C

Riser Release Frequency Database


Page C


2

1. LEAK FREQUENCY IMPLEMENTATION The leakage frequencies calculated for each riser hydrocarbon event in the QRA are calculated using the data given below. The riser and pipeline leak frequency is estimated based on PARLOC 96 [1].

1.1 Riser and Pipeline Leak Frequency

As for the topsides events, three hole sizes are used to represent riser and pipeline releases. These are:

Breach Description

Breach Diameter (mm)

Small 10 Medium 50 Full Bore 100/Full Bore

Table C 1-1: Breach Diameters for Riser & Pipeline Events

The rational for the hole sizes used for the riser release cases follows similar lines to the process events. A 100mm and full bore release is assessed with the release with worst case consequences carried forward to the QRA. Full Bore Release The full bore riser release accounts for a large proportion of the reported riser loss of containment events. Due to severity and the significant proportion of the historical leak frequency it is sensible to represent this as a separate event. Medium Hole Size The medium hole size while having a fairly large outflow rate (and therefore consequence) can also have a reasonable duration even when isolation occurs. Thus unprotected steel work on legs could be failed, or general radiation levels below decks may be sufficient to prevent successful evacuation. Small Hole Size While giving a low probability of ignition due to the small release rate, such a release may have a very long duration which if ignited could eventually fail support structures in the immediate area even if Passive Fire Protection was present. Another reason for using the hole sizes suggested above is that they fit well with the reported ranges provided in the used leak frequency data set:


Page C


3

Used Hole Sizes (mm)

PARLOC ’96 Hole Size Range (mm)

10 0-20 50 20-80 (+>80 not full bore)

Full Bore Full bore

Table C 1-2: PARLOC ’96 Hole Size Range The location of the leaks has been taken for four main locations:- − Riser above sea, from Riser ESDV to sea level. − Riser below sea, from sea level to sea bed. − Pipeline near field, within 100 m. − Pipeline far field, between 100 and 500 m of platform

The riser below sea and the near field pipeline releases can be pessimistically taken together as occurring below the platform. The splitting out of far field leak frequencies is to represent the reduced probability of ignition and subsequent impact on the platform. The leak frequency from valves, fittings etc is accounted for separately with data based on a parts count approach and the E&P Forum leak data. This allows estimates to be made which reflect the actual design rather than assuming a generic complement of fittings per riser.


Page C


4

2. RISER LEAK FREQUENCY The leak frequency specified for the risers is based on data taken from PARLOC ‘96 [1]. The spreadsheet that has been developed allows for the different failure mechanisms identified in [1] to be accounted for.

Steel Pipelines and Risers

CategoryCategories to be

Included(Y/N)

Anchor N

Impact Y

Corrosion Y

Structural Y

Material Y

Nat. Hazard Y

Fire Explosion N

Other Y

Table C 2-1: Categories of Riser / Pipeline Failures The table above shows the default set up for the categories reported. In splitting up the leak frequencies some assumptions have been made, these include:-

− riser releases have been split 50:50 between subsea and above sea releases, this judgement is reasonable given the limited amount of data .

− anchoring incidents make up a large number of the historically recorded incidents. Most vessels which operate near North Sea platforms nowadays use dynamic position (DP) systems,

− the riser failures during the Piper Alpha incident have been discounted since this is part of the QRA escalation analysis,

− the reporting of leak frequencies for fittings in [1] is in a form which is difficult to extract useful information. Subsequently the data used for topside process equipment is used. Only valves, flanges and instrument tapings are catered for. The explicit counting of fittings allows an installation specific estimate to be made, not one which is based on a ‘generic’ number of fittings.


Page C


5

− the difference in the various pipe diameter leak frequencies is not statistically significant in [1], therefore all pipe diameters are represented by the same leak frequency and hole size distribution.

2.1 Steel Risers The analysis for steel risers and pipeline is described below. The hole size distribution is based on all the leaks irrespective of whether riser or pipeline within safety zone. This is a logical assumption which has to be made given the small data set (see Table C 2-2 and Table C 2-3).

Location of Pipeline Diameter Range (inches) TotalIncident 2 to 8 10 to 16 > 16

Equivalent Hole Diameter (mm) Equivalent Hole Diameter (mm) Equivalent Hole Diameter (mm)0 - 20 20 - 80 > 80 0 - 20 20 - 80 >80 0 - 20 20 - 80 >80

PlatformPiping 1 1Splash Zone 1 1 2

Riser Subsea 1 1 2Unknown 1 1 2Near 5 1 1 7

Safety Zone Far 1 1 1 1 4Unknown

Total 8 1 1 4 2 1 1 18

Table C 2-2: Leaks not Resulting in Line Rupture

Location of Pipeline Diameter Range (inches) Total Proportion RupturesIncident 2 to 8 10 to 16 > 16 (Over Specific

Equivalent Hole Diameter (mm) Equivalent Hole Diameter (mm) Equivalent Hole Diameter (mm) Areas)Area Zone 0 - 20 20 - 80 > 80 0 - 20 20 - 80 >80 0 - 20 20 - 80 >80Platform

PipingSplash Zone 1 1 ` 2 0.36

Riser SubseaUnknown 1 1 2Near 1 1 2

Safety Zone Far 2 2 0.27Unknown

Total 1 2 5 8 0.31

Table C 2-3: Pipeline Rupture Cases

The leak frequency distribution employed for risers and pipelines is shown in Table C 2-4. The initial data taken from [1] is given in terms of three hole size ranges and summarised in Table C 2-2 and Table C 2-3. Table C 2-4 summarises the probability splits based on Table C 2-2 and Table C 2-3. Table C 2-5 then reports the estimated leak frequencies for the different release locations considered. It should be noted that the leak frequency for pipelines within the safety zone is an average. However the leak frequency associated with pipelines of 2 km or less is much higher. If analysis of short pipelines (less than 2 km) is being made then a leak frequency of 8.58 x 10-3 / km / year should be used in the first instance assuming an even leak frequency distribution. This is supported by Figure 4.5a in [1], which shows the


Page C


6

confidence limits for Midline, safety zone and wells overlap. Taking account of the pipeline length will only be significant if the far field releases can impair the platform. This conclusion is reached since the above assumption (leak frequency of 8.58 x 10-3 / km / year) would give a near field leak frequency of 8.58 x 10-4 /yr compared to an average of 6.25 x 10-4 /yr. The same hole size distribution should be assumed for pipelines of 2km or less since there is no other information to base the data on. It should be noted that the leak frequency has been split between riser (above / below sea) and pipeline in the near and far field. It is proposed as a first pass to model the riser below sea and the pipeline case as the same event in the QRA.

Release Case Probability Distribution 10 mm 0.50 50 mm 0.19 Rupture 0.31

Table C 2-4: Probability Distribution For Riser and Pipelines, excluding fittings

(Within Safety Zone) Breach Diameter

(mm) Above Sea Below Sea Total Near Far Total10 2.01E-04 2.01E-04 4.02E-04 2.99E-04 8.56E-05 3.85E-0450 7.73E-05 7.73E-05 1.55E-04 1.15E-04 3.29E-05 1.48E-04

Full Bore 1.24E-04 1.24E-04 2.47E-04 1.84E-04 5.27E-05 2.37E-04Total 4.02E-04 4.02E-04 8.04E-04 5.99E-04 1.71E-04 7.70E-04

Riser Leak Frequency (/ yr) Pipeline Leak Frequency within Safety Zone (/ yr)

Table C 2-5: Leak Frequency Estimates for Risers and Pipelines (average, not applicable for pipelines less than 2km), excluding fittings (Within Safety Zone)

2.2 Flexible Risers / Pipelines Table C 2-6 and Table C 2-7 show the base data taken from PARLOC table 4.4.

Location of Pipeline Diameter Range (inches)Incident 2 to 8 10 to 16 > 16

Equivalent Hole Diameter (mm) Equivalent Hole Diameter (mm) Equivalent Hole Diameter (mm)0 - 20 20 - 80 > 80 0 - 20 20 - 80 >80 0 - 20 20 - 80 >80

PlatformPipingSplash Zone

Riser SubseaUnknown 2 1Near 1

Safety Zone FarUnknown 1

Total 3 1 1

Table C 2- 6 : Leaks from Flexible Pipelines which do not Result in Line Rupture


Page C


7

Location of Pipeline Diameter Range (inches)

Incident 2 to 8 10 to 16 > 16Equivalent Hole Diameter (mm) Equivalent Hole Diameter (mm) Equivalent Hole Diameter (mm)0 - 20 20 - 80 > 80 0 - 20 20 - 80 >80 0 - 20 20 - 80 >80

PlatformPipingSplash Zone `

Riser Subsea 1UnknownNear

Safety Zone FarUnknown

Total 1

Table C 2-7: Leaks from Flexible Pipelines Resulting in Line Rupture The proposed release frequencies are shown in Table C 2-8.


Total 10 50 RuptureRiser Above Sea 2.56E-03 1.70E-03 4.26E-04 4.26E-04


Far

Total 7.41E-03 4.94E-03 1.23E-03 1.23E-03

Table C 2-8: Flexible Riser Release Frequency

2.3 Riser and Pipeline Fittings As already mentioned the riser and pipeline fitting leak frequency information given in [1] cannot be easily used. It has therefore been decided to use the topside data for valves, flanges and fittings. This may appear to be a optimistic assumption since the potential operating conditions (both internal and external) could well be worse, however the equipment should be specified based on particular design codes which will take account of this. Some assumptions have been made however when applying the leak frequency distributions given in [1]. These are:- − The leak frequency distribution for valves and flanges is taken as varying

dependant on the internal pipe diameter. This is done since there can be very large differences between riser / pipeline diameters which could effect the possible leak size.

− The proportion of events modelled as resulting in a rupture case does not go above 6% for valves and 4% for flanges (taken from [2]). These upper bounds are thought to be conservative, with such large failures of the valves and flanges considered highly unlikely.

The leak frequency information is summarised in Table C 2-9.


Page C


8


Total 10 50 Rupture Steel Riser Above Sea 4.02E-04 2.01E-04 7.73E-05 1.24E-04


Far 1.71E-04 8.56E-05 3.29E-05 5.27E-05Flexible Riser Above Sea 2.56E-03 1.70E-03 4.26E-04 4.26E-04


FarValves 2 2.30E-04 2.16E-04 1.40E-05 2.72E-07[1] 8 2.30E-04 1.47E-04 6.98E-05 1.30E-05

12 2.30E-04 9.81E-05 1.18E-04 1.38E-0516 2.30E-04 7.36E-05 1.43E-04 1.38E-0520 2.30E-04 5.89E-05 1.57E-04 1.38E-0524 2.30E-04 4.90E-05 1.67E-04 1.38E-0530 2.30E-04 3.92E-05 1.77E-04 1.38E-05

Flanges 2 8.80E-05 8.49E-05 3.08E-06 6.16E-08[1] 8 8.80E-05 4.16E-05 4.35E-05 2.95E-06

12 8.80E-05 2.77E-05 5.70E-05 3.27E-0616 8.80E-05 2.08E-05 6.38E-05 3.43E-0620 8.80E-05 1.66E-05 6.79E-05 3.52E-0624 8.80E-05 1.39E-05 7.06E-05 3.52E-0630 8.80E-05 1.11E-05 7.34E-05 3.52E-06

Small Bore Fittings 4.70E-04 3.70E-04 9.99E-05

Table C 2-9: Riser / Pipeline and Fittings Leak Frequency


Page C


9

[1] PARLOC 96, “The Update of Loss of Containment Data for Offshore Pipelines”. [2] E & P Forum, “Hydrocarbon Leak and Ignition Data Base”, Report No. 11.4/180, May 1992.


Page D


1

APPENDIX D

Blowout Release Frequency Database


Page D


2

1. BLOWOUTS Recommended blowout and well release frequencies for use in risk analysis have been calculated for well operations in the North Sea by Scandpower A/S. Two sets of data have been compiled and used to evaluate the risk engendered by blowouts:

• Shearwater – Specific study in 1998 [1] • All Other Assets – BlowFam 2000 [2]

The data used are given below.

1.1 Shearwater Blowout Data Risks contributors to blowout during drilling, completion, production, workover and wireline of the Shearwater wells have been identified by Scandpower [1]. The blowout frequency was adjusted to reproduce the High Pressure High Temperature conditions as well as the specific drilling characteristics of the reservoir. Diverter releases are not included as part of blowout frequency as they are assumed to be safely diverted. The total frequencies compiled in [1] and used for the breakdown per work categories are given below.

Frequency

Activity Units Total Shallow

Gas Deep Gas Development Drilling per well 1.07E-03 2.02E-04 8.72E-04

*( ) Modified values to remove safely diverted releases from Drilling. (9.62E-04) (1.27E-04) (8.34E-04)

Well Completion per well 2.90E-04 Production Well per well year 2.04E-05 Workover Operation per operation 4.78E-04 Wireline Operation per operation 8.40E-06

Table D.1.2.1 Data taken from Scandpower A/S 27.78.01/R1, January 1998.

The breakdown of release locations and sizes for various well operations is given next: Shallow gas


Page D


3

Shallow Gas

Location Path % Choked Frquency Subsea BOP Area Wellhead DrillfloorFlow Outside Annulus Annulus Outside Annulus Annulus Drill String Outside Annulus Annulus Drill String Outside Annulus Annulus Drill String

0 Drillfloor Outside Annulus 2.4% N 4.79E-06 4.79E-061 (note 1) Subsea Outside Annulus 23.7% N 4.79E-05 4.79E-05

2 Subsea Annulus 2.6% N 5.25E-06 5.25E-063 Wellhead Annulus 2.6% N 5.25E-06 5.25E-064 Wellhead Outside Annulus 10.5% Y 2.12E-05 2.12E-055 Drillfloor Annulus 7.1% N 1.44E-05 1.44E-056 Drillfloor Annulus 11.9% N 2.40E-05 2.40E-057 Diverted Annulus 36.9% N 7.45E-058 Drillfloor Drill String 2.3% N 4.73E-06 4.73E-069 0 0 0.0% 0.00E+0010 0 0 0.0% 0.00E+00

Totals 100.0% 2.02E-04 4.79E-05 5.25E-06 0.00E+00 0.00E+00 0.00E+00 0.00E+00 5.25E-06 2.12E-05 4.79E-06 3.84E-05 4.73E-06

Note 1: Assumed that Outside casing blowout equivalent to Outside Annulus Table D 1.2.2 Shallow gas Blowout Frequencies

Drilling

Drilling

Location Path % Choked Frquency Subsea BOP Area Wellhead DrillfloorFlow (/yr) Outside Annulus Annulus Outside Annulus Annulus Drill String Outside Annulus Annulus Drill String Outside Annulus Annulus Drill String

0 Drillfloor Outside Annulus 4.3% N 3.79E-05 3.79E-051 (note 1) Subsea Outside Annulus 17.4% N 1.52E-04 1.52E-04

2 Wellhead Annulus 17.4% N 1.52E-04 1.52E-043 Wellhead Outside Annulus 4.3% Y 3.76E-05 3.76E-054 Wellhead Outside Annulus 8.7% Y 7.60E-05 7.60E-055 Drillfloor Annulus 15.7% N 1.37E-04 1.37E-046 Drillfloor Annulus 3.9% N 3.38E-05 3.38E-057 Diverted Annulus 4.3% N 3.76E-058 Drillfloor Drill String 15.7% N 1.37E-04 1.37E-049 BOP Area Annulus 4.3% Y 3.76E-05 3.76E-0510 Drillfloor Annulus 3.9% Y 3.38E-05 3.38E-05

Totals (/yr) 100.0% 8.72E-04 1.52E-04 0.00E+00 0.00E+00 0.00E+00 3.76E-05 0.00E+00 1.52E-04 1.14E-04 3.79E-05 1.71E-04 1.71E-04

Note 1: Assumed that Outside casing blowout equivalent to Outside Annulus Table D 1.2.3 Drilling Blowout Frequencies

Completion

Completion


0 Drillfloor Outside Annulus 8.7% N 2.54E-05 2.54E-051 (note 1) Wellhead Drill String 12.5% N 3.63E-05 3.63E-05

2 Drillfloor Drill String 33.8% Y 9.79E-05 9.79E-053 Drillfloor Drill String 11.3% N 3.26E-05 3.26E-054 Drillfloor Drill String 22.5% N 6.53E-05 6.53E-055 Drillfloor Drill String 11.3% N 3.26E-05 3.26E-056 0 0 0.0% 0.00E+007 0 0 0.0% 0.00E+008 0 0 0.0% 0.00E+009 0 0 0.0% 0.00E+0010 0 0 0.0% 0.00E+00

Totals (/yr) 100.0% 2.90E-04 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 3.63E-05 2.54E-05 0.00E+00 2.28E-04

Note 1: Assumed that Outside casing blowout equivalent to Outside Annulus Table D 1.2.4 Completion Blowout Frequencies

Production

Production


0 Drillfloor Outside Annulus 0.0% N 0.00E+00 0.00E+001 (note 1) Subsea Outside Annulus 14.3% N 2.91E-06 2.91E-06

2 Subsea Annulus 14.3% N 2.91E-06 2.91E-063 Wellhead Annulus 14.3% Y 2.91E-06 2.91E-064 Wellhead Outside Annulus 14.3% Y 2.91E-06 2.91E-065 Wellhead Drill String 14.3% Y 2.91E-06 2.91E-066 Wellhead Annulus 14.3% N 2.91E-06 2.91E-067 Wellhead Annulus 14.3% Y 2.91E-06 2.91E-068 0 0 0.0% 0.00E+009 0 0 0.0% 0.00E+0010 0 0 0.0% 0.00E+00

Totals (/yr) 100.0% 2.04E-05 2.91E-06 2.91E-06 0.00E+00 0.00E+00 0.00E+00 0.00E+00 2.91E-06 1.17E-05 0.00E+00 0.00E+00 0.00E+00

Note 1: Assumed that Outside casing blowout equivalent to Outside Annulus Table D 1.2.5 Production Blowout Frequencies

Workovers


Page D


4

Workovers


0 Drillfloor Outside Annulus 8.2% N 3.92E-05 3.92E-051 (note 1) Wellhead Outside Annulus 4.5% Y 2.15E-05 2.15E-05

2 Wellhead Annulus 4.5% Y 2.15E-05 2.15E-053 Wellhead Drill String 4.5% N 2.15E-05 2.15E-054 BOP Area Annulus 4.5% Y 2.15E-05 2.15E-055 Drillfloor Annulus 4.1% Y 1.94E-05 1.94E-056 Drillfloor Drill String 16.4% N 7.83E-05 7.83E-057 Drillfloor Drill String 20.6% N 9.85E-05 9.85E-058 Drillfloor Drill String 4.1% N 1.94E-05 1.94E-059 Drillfloor Annulus 16.4% N 7.83E-05 7.83E-0510 Drillfloor Drill String 12.3% N 5.89E-05 5.89E-05

Totals (/yr) 100.0% 4.78E-04 0.00E+00 0.00E+00 0.00E+00 0.00E+00 2.15E-05 0.00E+00 0.00E+00 6.45E-05 3.92E-05 7.83E-05 2.74E-04

Note 1: Assumed that Outside casing blowout equivalent to Outside Annulus Table D 1.2.6 Workovers Blowout Frequencies

Wireline

Wireline


0 Drillfloor Outside Annulus 10.0% N 8.40E-07 8.40E-071 (note 1) Drillfloor Drill String 90.0% N 7.56E-06 7.56E-06

2 0 0 0.0% 0.00E+003 0 0 0.0% 0.00E+004 0 0 0.0% 0.00E+005 0 0 0.0% 0.00E+006 0 0 0.0% 0.00E+007 0 0 0.0% 0.00E+008 0 0 0.0% 0.00E+009 0 0 0.0% 0.00E+0010 0 0 0.0% 0.00E+00

Totals (/yr) 100.0% 8.40E-06 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 0.00E+00 8.40E-07 0.00E+00 7.56E-06

Table D 1.2.7 Wireline Blowout Frequencies

The total blowout frequencies gathered from the above breakdowns are presented in Table D 1.2.8. These values are used in the Risk Model. Shearwater Blowout Data

Activity Operation Frequency Subsea BOP AREA Wellhead Drillfloor OverallOpen Hole Annulus Open Hole Annulus Drill String Open Hole Annulus Drill String Open Hole Annulus Drill String Total

Shallow Gas Per Operation 4.79E-05 5.25E-06 5.25E-06 2.12E-05 4.79E-06 3.84E-05 4.73E-06 1.27E-04Drilling Per Operation 1.52E-04 3.76E-05 1.52E-04 1.14E-04 3.79E-05 1.71E-04 1.71E-04 8.34E-04Completion Per Operation 3.63E-05 2.54E-05 2.28E-04 2.90E-04Production Per Year 2.91E-06 2.91E-06 2.91E-06 1.17E-05 2.04E-05Workovers Per Operation 2.15E-05 6.45E-05 3.92E-05 7.83E-05 2.74E-04 4.78E-04Wireline Per Operation 8.40E-07 7.56E-06 8.40E-06Total 2.03E-04 8.17E-06 5.91E-05 1.60E-04 2.47E-04 1.08E-04 2.87E-04 6.86E-04

Table D 1.2.8 Total Blowout Frequencies

1.2 2000 BlowFam Data The breakdown of blowout frequencies within this report is not as detailed as the other Scandpower studies. As such, it is not possible to use the same frequency breakdown within the QRA. The overall blowout frequencies proposed for use in risk analysis is therefore:

Activity Operation Frequency Subsea Wellhead BOP AREA Drillfloor OverallOpen Hole Annulus Drill String Total

Development Drilling Per Operation 4.85E-05 5.90E-05 1.08E-04 2.15E-04Well Completion Per Operation 7.20E-04 7.20E-04Production Well Per Year 1.81E-04 4.43E-04 6.24E-04Workover Operation Per Operation 5.16E-05 3.20E-04 3.72E-04Wireline Operation Per Operation 1.80E-04 1.80E-04Total 2.29E-04 5.54E-04 1.33E-03


Page D


5

[1] Scandpower A/S Report No. 27.78.01/R1: “Blowout Frequency Assessment Shearwater Development”, January 1998. [2] Scandpower A/S Report No. 27.20.01/R3: “Blowout Frequencies 2000 BlowFAM Edition”, March 2000.

Shell U.K. Exploration and Production

QRA Methodology for Shell Expro Installations

Page E 1

Report No: CL4172-RP-305 Rev 1

Issue Date: October 2004

APPENDIX E Occupational Fatal Accident Rate Data



Page E 2



1. INTRODUCTION

This appendix outlines the data sources and calculation method used in determining the occupational fatal accident rate (FAR) that is used in the main body of the QRA methodology document.

1.1 Fatal Accident Rate

The fatal accident rate (FAR) is defined as the number of fatalities that occur in 108 man hours.

The FAR is designed to represent ‘occupational incidents’, which are defined as those with no potential to cause fatalities outside the immediate area of the incident and, in the majority of cases, they will result in a single fatality. The FAR does not account for major hydrocarbon incidents such as blowouts, fires and explosions; nor does it include fatalities resulting from travel to/from an installation by helicopter or boat. Occupational fatalities include a wide variety of events, such as slips, trips, falls, falling overboard, mechanical impacts, burns, asphyxiation, electrical shocks etc. The FAR will vary for personnel who carry out different types of work and therefore each different worker category is assigned a separate FAR.

Within the QRA risk model, the FAR values are converted to Individual Risk Per Annum (IRPA), which takes into account the actual time that each worker category is exposed to the hazards on the installation.

1.2 Worker Groups

In order to represent the different types of work carried out by different groups of people on an offshore installation, the personnel are split into five worker categories within the QRA.

• Operations and Maintenance

• Drilling

• Construction

• Deck Crew

• LQ personnel (catering, admin & other support personnel who are always located in the living quarters).

The fatal accident rate is determined for each of these categories of personnel.

1.3 On/Off Shift

Within the QRA, it is important to note that the occupational FAR for the first four worker categories above will only apply for the 12 hours that the personnel are on-shift. For the remaining 12 hours of the day, all personnel will be treated as LQ workers. Therefore an off-shift FAR can be assumed; this will be the same for all personnel on the installation. Therefore each worker group has two different FARs that are used in the QRA model.



Page E 3



2. METHODOLOGY

2.1 Sources of Data

Data providing the number of fatal accidents in the off-shore industry, including worker category and type of incident, is published by the Offshore Safety Division of the Health and Safety Executive (OSD/HSE). This methodology uses two sources of data – one from an ‘Offshore Injury and Incident Statistics Report’ by the OSD/HSE [1] and another, which contains earlier data, from the Department of Energy's 'Brown Book' for fixed and mobile platforms and vessels, 1979-89 [2], which was the predecessor to the OSD/HSE reports. These two sources of data have been used together in the calculations of FARs for each worker category. Note that there are more worker categories in the tables than the five outlined previously, but the simplification of the worker groups into those used within the QRA will be explained later. The tables also show, in 1000s, the number of employees in the UK North Sea Oil industry, for each year, which is based on information from Inland Revenue surveys.

BASE DATABrown Book Worker Categories - Number of FatalitiesYear 80 81 82 83 84 85 86 87 88 89 90 TotalConstruction 0 0 3.75 0 0 0 0 1 0 0 0 4.75Drilling 0 3 3.75 3 1 0 0 1 0 0 2 13.75Production 0 0 0.75 3 0 3 0 0 0 1 0 7.75Maintenace 0 1 1.75 0 7 4 1 3 1 0 0 18.75Domestic 0 0 1 0 0 0 0 0 0 0 0 1Deck 1 0 0 1 0 0 2 0 3 0 0 7TOTAL 1 4 11 7 8 7 3 5 4 1 2 53

Persons Employed 000'sYear 80 81 82 83 84 85 86 87 88 89 90Personnel 22 21 21.5 28.7 31.3 29 22.3 28.2 29.3 30.7 36.5 300.5

Total 300.5

Table E1: ‘Brown Book’ Data

BASE DATAOTO Worker Categories - Number of Fatalities

91 92 93 94 95 96 97 98 TotalConstruction 0 0 0 0 0 0 0 0 0Drilling 0 0 0 1 1 0 1 1 4Production 0 0 1 0 0 0 0 0 1Maintenace 0 1 0 0 1 1 1 0 4Domestic 0 0 0 0 0 0 0 0 0Deck 1 3 0 0 2 0 0 0 6TOTAL 1 4 1 1 4 1 2 1 15

Persons Employed 000'sYear 91 92 93 94 95 96 97 98Personnel 33.2 29.5 34.2 27.2 29 26.9 23 25.5 228.5

Table E2: OSD/HSE Data

2.2 On Shift

For the calculation of FAR, it is assumed that all personnel working on an installation will be offshore for 22 weeks of every year (i.e. they spend 0.425yr offshore) and of that time spent offshore, 50% of the time is spent on-shift. Therefore each member of personnel is on-shift for:



Page E 4



0.425*24*365*0.5 = 1861.5 hours

The offshore population data is obtained from annual population surveys conducted by the Inland Revenue.

2.3 Off-Shift

For 12 hours a day all personnel are considered to be LQ personnel, as they are off-shift. As a conservative estimate, the off-shift FAR for all worker categories is taken to be equal to the on-shift FAR for LQ personnel.

2.4 Calculation of FAR

To find the on-shift FARs, the total number of fatalities and the total number of employees in each worker category during the period in question. The number of fatalities is taken directly from the tables above. Table E3 shows the % of total employees that are included in each category, as well as the actual number of employees in each category [1], [2].

Actual Number of Employees (000s)Category % of total employees Brown Book OSD/HSEConstruction 15% 45.10 34.29Drilling 20% 60.10 45.70Production 21% 63.10 47.98Maintenace 30% 90.20 68.59Domestic 8% 24.00 18.25Deck 6% 18.00 13.69

Table E3: % employees in each category

Knowing the number of employees in each category, the FAR can be calculated using the following equation:

employeesfatalities

FAR*5.1861

*108

=

The denominator represents the total manhours of the category over the period and the FAR is the total number of fatalities incurred in 108 manhours.

In order to use the most up-to-date data, if the total number of fatalities from 1991–98 is greater than zero, then only this (1991-98) data is used to determine the FAR. However, if there are no fatalities in the 1991-98 period, then the total number of workers and fatalities from 1980-98 will be used to determine the FAR.

The above methodology gives rise to the following results. Note that the ‘production’ and maintenance’ categories are combined to give the ‘operations and maintenance’ category. The ‘domestic’ category is the ‘LQ personnel’ category.



Page E 5



Group Fatalities Employees FAR Data UsedConstruction 4.75 79.4 3.21 1980-1998Drilling 4 45.7 4.70 1991-1998Operations 5 52.0 5.17 1991-1998Admin & Catering 1 42.2 1.27 1980-1998Deck 6 42.2 7.63 1991-1998TOTAL 20.75 261.6 4.26

Table E4: Calculated FARs

For the ‘drilling’ crew in the QRA, the average of the ‘drilling’ and ‘deck’ crew FARs is used, as workers in this category may spend time around the pipe decks as well as on the drill floor. The ‘deck’ crew category used in the QRA is taken to have the same occupational risk as the construction crew as they are considered to perform similar tasks within the QRA. This results in the following occupational risks being used within the QRA :


Drill Crew 6.2 1.3 7.5

Production / Maintenance Crew

5.2 1.3 6.5

Deck Crew 3.2 1.3 4.5

Construction Crew 3.2 1.3 4.5

LQ Crew 1.3 1.3 2.6

Table E5: Occupational FARs used in QRA



Page E 6



3. REFERENCES

[1] ‘Offshore Injury and Incident Statistics Report’, Offshore Safety Division of the Health and Safety Executive

[2] Department of Energy's 'Brown Book' for fixed and mobile platforms and vessels, 1979-89.


Page F


1

APPENDIX F

Explosion Exceedance Example


Page F


2

1. INTRODUCTION

This appendix runs through an example calculation of the probabilities of failure from explosions in offshore installations using the exceedance curve methodology. The example is not specific to any platform but refers to the equations, figures and charts in the main QRA Methodology report.

2. WORKED EXAMPLE

2.1 Background The SCOPE model has been used to predict the explosion overpressure within an offshore module. Supports within the module are critical to the support of the TR and failure of any one of these supports may result in direct and immediate failure of the TR. The TR is located at some distance from this module and is supported on anti-vibration mountings, the failure of which are taken to result in impairment of the TR due to loss of structural integrity. The TR has no vulnerable windows around the front and side facings, but the cladding itself may fail to enable rapid smoke ingress into the TR if the wind is blowing towards the TR. The SCOPE model predicts the following overpressures for this module : Maximum Internal Overpressure : 3500 mbar Maximum External Overpressure : 650 mbar Direct Line-of-Sight Overpressure at TR : 100 mbar Reflected Overpressure at TR : 75 mbar Total Overpressure At TR : 175 mbar (Line-of-sight + Reflected) The module and TR design conditions are : TR Critical Structure within Module : 3000 mbar TR Anti-Vibration Mountings : 600 mbar TR Cladding : 100 mbar The platform wind rose has shown that the probability of the wind blowing towards the TR is 0.2. The scenario being worked is a 50mm release of methane from an HP compression train. The gas build up calculations have shown that the maximum concentration in the module is 7%. The stoichiometric concentration of methane is 10% and therefore this gas cloud size is taken to be equivalent to a module that is 70% (7%/10%) filled with a stoichiometric mixture of methane. From Section 9.2.1 of the main report, it is clear that a gas cloud filling greater than 25% of the module with a stoichiometric mixture is taken to have the same overpressure


Page F


3

as a cloud completely filling the module. The overpressures predicted by SCOPE are directly used here. To account for the reflected element of the overpressure as it propagates towards the TR we will conservatively factor the line-of-sight element by 2 (Table 9-2 QRA Methodology main report) rather than use the reflected element from SCOPE, which accounts for reflection off the sea only. As the overpressures have been predicted by SCOPE 4 then we have some confidence in their results and therefore will not factor the Severity Index for these calculations (Table 9-1 of main report).. The revised explosion overpressures we will use for this scenario in the example are : Internal Overpressure : 3500 mbar Overpressure At TR : 2 x 100 = 200 mbar. The module is deemed to be an ‘A’ type (Figure 9-4 QRA Methodology main report) and we will use the extended exceedance curves to account for any additional uncertainty in the loadings (Figure 9-8 QRA Methodology Main Report).

2.2 Severity Index The steps to be followed in this calculation are outlined in the QRA Methodology main report, Figures 9-9 to 9-11. As the explosion overpressure is known, the first stage is to convert the internal overpressure to a severity index. This is done using equation O2 from the main report :

S P PP P

=−

−

−

*exp . * *.

*.

.6 915

17 888

122 59

3109

where, P is the overpressure in bar. For an internal overpressure of 3.5 bar this converts to a severity index of 9.5. There is no requirement to factor the severity index and therefore the value remains 9.5. Converting the severity index back to an overpressure will produce the original 3.5 bar. The internal overpressure has therefore not been factored up and hence the external overpressure will not be factored up (Figure 9-10 from main report). The external overpressure at the TR is 0.2 bar, which converts to a severity index of 0.21 using the equation above.

2.3 Internal Structural Failure To calculate the probability of failing the critical structure in the module we need to know the upper and lower bound value of resistance. The static capacity of the structure is the 3 bar reported earlier and as the structure is load bearing, the lower bound is taken from the QRA Methodology (Section 9.2.5.3) to be 1.0 times the static capacity and the upper bound 1.5 times. This produces a lower bound capacity of 3.0 bar and an upper bound capacity of 4.5 bar. The values are converted to severity index, as the exceedance curves are based on severity index, to produce the following values :

− Lower bound, SL – 6.9


Page F


4

− Upper bound, SU – 17.9 The A-type curve shown in Figure F1 is used along with Figure 9-11 in the main report to calculate the probability of failure. The A-type curve ratio of failure does not stop at 1.0, but extends to 2.3. This takes into account any uncertainty in the loading and effectively means that overpressures below the lower bound may still result in failure of the wall, structure etc. To account for this in the calculations, the lower bound limit must be reduced from SL to SL/2.3. Adapting this approach then the value of SL reported previously, 6.9, becomes 3. The upper bound remains unchanged. The predicted severity index of 9.5 lies between the lower and upper bounds of the structural limits. For this particular scenario we need to calculate the ratio of failure for the exceedance curve using the equation :

xSSSL

2+

which produces a failure ratio of (3.0+9.5)/(2x9.5) = 0.66.

From Figure F1, a ratio of 0.66 produces a probability of exceedance of 0.38. As the severity index lies in between the lower and upper bounds then an additional correction factor is applied to the probability of exceedance. The correction factor, F, is found from the following equation :

)()(

LU

L

SSSS

F−

−= , which produces a correction factor of (9.5-3)/(17.9-3) = 0.44.

Multiplying the probability of exceedance by the correction produces a 0.17 probability of the explosion generating an overpressure high enough to fail the critical structure in the module.


Page F


5

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0 0.5 1 1.5 2 2.5

Type A

Type C

Type D

Pro

bab

ility

of

Exc

eed

ing

S de

sig

n

S Design / S Predicted

Figure F1 – Extended Generic Exceedance Curves


Page F


6

2.4 External TR Failure The approach adapted for external explosions is similar to the calculation of internal structural failure, except failure of the TR external structure and cladding will be reviewed here. The TR structure was assumed to fail at 0.6 bar, which converts to a severity index of 0.7. As we are using the A-type curve again, then this lower bound will become 0.7/2.3 = 0.30 and we can see that the predicted overpressure at the TR will not fail the external structure as the predicted severity index is 0.21, below the lower bound. The cladding was taken to fail at 0.1 bar and converting to a severity produces a value of 0.1. Due to the simplistic nature of the cladding there is no upper limit applied and therefore the upper and lower limit are taken to be the same. As the A-type curve is being used the actual lower limit reduces to 0.1/2.3 = 0.04. The predicted severity index at the TR, 0.21, exceeds the lower and upper limits. The average of the upper and lower capacities is therefore taken, from Figure 9-11 of the main report, to give (0.04+0.1)/2 = 0.07. The ratio of structural capacity to predicted severity, 0.07/0.21 = 0.33, is used directly in the A-type curve to determine the probability of exceedance. This is found to be 0.69 and as there is no correction factor to apply, this is the final probability from the exceedance curve. Failure of the TR cladding on its own is not classified as TR impairment, but where the wind is blowing smoke towards the TR then this in combination with cladding failure is TR impairment. The probability of wind blowing towards the TR is 0.2 and therefore the overall probability of external explosions failing the TR integrity is 0.2 x 0.69 = 0.14.

2.5 QRA RISKMODEL For the purposes of inclusion within the RISKMODEL, the internal and external explosions are treated as two separate mechanisms. Failure of the critical structure within the module would be entered as Mechanism 1, with a probability of 0.17 and a time to failure of 5 minutes. External explosions failing the TR cladding would be entered as Mechanism 2, with a probability of 0.14 and time to failure of 5 minutes which is used to highlight the potential for rapid smoke ingress that may occur following cladding failure.

3. CONSERVATISMS There are a number of known conservatisms in this methodology which are listed next :

− Stoichiometric cloud sizes filling 25% of the module are unlikely to result in the same overpressures as clouds that fully fill the module. Further assessment with SCOPE would provide a more detailed breakdown of the overpressure versus cloud size;

− Similarly partially filled modules are likely to produce lower external explosions as a smaller volume of unignited gas would be ejected from the module;

− The overpressures predicted at a distance from the module in SCOPE are believed to


Page F


7

be conservative, particularly when compared with CFD models such as EXSIM; − The extended exceedance curves are also likely to introduce further conservatisms

into the assessment.

Gavin A Chisholm Clifton House Clifton Place Glasgow G3 7LD 0141 342 2917 0142 332 4428 [email protected] www.atkinsglobal.com

Atkins is one of the world’s leading providers of professional, technology based consultancy and support services. In recent years, it has expanded from its historical base in traditional engineering, management consultancy and property services into related technological consultancy and the management of outsourced facilities. With over 14,000 staff worldwide, Atkins has enormous expertise, providing both breadth and depth of knowledge in an extremely diverse range of disciplines. Our clients are varied and include governments, local and regional authorities, funding agencies and commercial and industrial enterprises. We help our clients to realise their objectives by developing and delivering practical solutions, adding value to their businesses through the application of our experience, innovative thinking and state-of-the-art technology.

21089232 offshore qra guidelines

Documents

phase fires

pool fires

compartment fires

flash fires

sea fires

function of safety systems

hydrocarbon outflow

production qra methodology