s-dp-001r2

NORSOK STANDARD

DESIGN PRINCIPLES TECHNICAL SAFETY

S-DP-001 Rev. 2, January 1996

Please note that whilst every effort has been made to ensure the accuracy of the NORSOK standards neither OLF nor TBL or any of their members will assume liability for any use thereof.

Technical safety S-DP-001 Rev. 2, January 1996

________________________________________________________________________________ NORSOK standard 1 of 41

CONTENTS

1 FOREWORD 3

2 SCOPE 3

3 NORMATIVE REFERENCES 3

4 DEFINITIONS AND ABBREVIATIONS 4 4.1 Definitions 4 4.2 Abbreviations 4

5 FUNCTIONAL REQUIREMENTS 5 5.1 General 5 5.2 Safety management 5 5.3 Analyses and optimisation 5 5.4 Risk reduction principles 6

6 EVACUATION AND EMERGENCY PREPAREDNESS 7

7 SAFETY REQUIREMENTS TO LAYOUT AND ARRANGEMENT 8 7.1 General requirements 8 7.2 Escape routes 9 7.3 Living quarters 10 7.4 Helicopter deck 10 7.5 Utility area 10 7.6 Emergency service areas 10 7.7 Process area 10 7.8 Riser area 11 7.9 Flare boom, flare tower, cold vent 11 7.10 Drilling and well head area 11

8 SAFETY REQUIREMENTS TO STRUCTURAL DESIGN 12 8.1 Accidental design loads 12

9 SAFETY REQUIREMENTS TO PROCESS AND AUXILIARY FACILITIES 12 9.1 General requirements 12 9.2 Safety systems 13 9.3 Process safety 13 9.4 Depressurisation 13 9.5 Relief and venting 14 9.6 Flaring 15 9.7 Cold vent 16 9.8 Drainage systems 16

10 REQUIREMENTS TO SAFETY AND COMMUNICATION SYSTEMS 16 10.1 General requirements 16 10.2 Fire and as detection 16 10.3 Emergency shutdown 22 10.4 Ignition source control 25 10.5 Alarm system 25 10.6 Emergency power 26



11 REQUIREMENTS TO EXPLOSION AND FIRE PROTECTION 27 11.1 General requirements 27 11.2 Fire protection philosophy 27 11.3 Protection of pressure vessels and process piping 28 11.4 Passive fire protection 30 11.5 Active fire protection 31 11.6 Explosion protection philosophy 31

12 SAFETY ASPECTS RELATED TO FLOATING INSTALLATIONS 31 12.1 General 31 12.2 Marine industry standard 31 12.3 Crude storage 31 12.4 Layout 31 12.5 Turret 32 12.6 Drainage 32 12.7 Emergency re-positioning 32 12.8 Topside/floater interface 33 12.9 Escape and evacuation 33

13 NORMALLY NOT MANNED INSTALLATIONS 33 13.1 General 33 13.2 Common requirements 33 13.3 Well head system 34 13.4 Auxiliary systems 34 13.5 Escape routes 35 13.6 Life-saving appliances 35 13.7 Emergency shut-down 35

ANNEX A NORMALLY NOT MANNED INSTALLATIONS (INFORMATIVE) 36

ANNEX B INFORMATIVE REFERENCES (INFORMATIVE) 40

ANNEX C FIRE PROTECTION DATA SHEET (INFORMATIVE) 41



1 FOREWORD NORSOK (The competitive standing of the Norwegian offshore sector) is the industry initiative to add value, reduce cost and lead time and remove unnecessary activities in offshore field developments and operations. The NORSOK standards are developed by the Norwegian petroleum industry as a part of the NORSOK initiative and are jointly issued by OLF (The Norwegian Oil Industry Association) and TBL (The Federation of Norwegian Engineering Industries). NORSOK standards are administered by NTS (Norwegian Technology Standards Institution). The purpose of this industry standard is to replace the individual oil company specifications for use in existing and future petroleum industry developments, subject to the individual company's review and application. The NORSOK standards make extensive references to international standards. Where relevant, the contents of this standard will be used to provide input to the international standardisation process. Subject to implementation into international standards, this NORSOK standard will be withdrawn. All annexes are informative. Revision 2 includes relevant parts of The Norwegian Oil Industry Association Recommended practice on emergency alarm systems.

2 SCOPE This standard applies to design and construction of new and modifications on existing installations for offshore drilling, production and transportation of petroleum. The objective of this document is to achieve implementation of technology which establishes and maintains an adequate level of safety for personnel, environment and material assets. This standard defines safety design principles for installations, arrangements and systems.

3 NORMATIVE REFERENCES API RP 521 Guide for pressure-reliving and depressing system. ISO 13702 Requirements and guidelines for the prevention, control and mitigation of

fires and explosions. Until the Draft International Standard (DIS ) becomes available (April 1996) the Committee Draft (CD) applies.

ISO 10418 Analysis, design, installation and testing of basic surface safety systems for offshore production platforms (replaces API RP14 C).

ISO 5660 Fire tests - Reaction to fire - Rate of heat release from building products. prEN 50145 Electric apparatus for potentially explosive gas atmosphere -

Classification of hazardous areas. IEC 79-10 Area Classification. IEC 79-13 Construction and use of rooms or buildings protected by pressurisation. IMO Res. A.653 Recommendation on improved fire test procedures for surface

flammability of bulkhead, ceiling and deck finish materials.



IP Part 15 Institute of Petroleum: Model code of safe practice, Part 15, Area classification code for petroleum installations

NORSOK S-DP-003 Environmental care.

4 DEFINITIONS AND ABBREVIATIONS

4.1 Definitions Normative references Shall mean normative in the application of NORSOK standards. Informative references Shall mean informative in the application of NORSOK standards. Shall Shall is an absolute requirement which shall be followed strictly in order

to conform with the standard. Should Should is a recommendation. Alternative solutions having the same

functionality and quality are acceptable. May May indicates a course of action that is permissible within the limits of

the standard (a permission). Can Can-requirements are conditional and indicates a possibility open to the

user of the standard. All terms and phrases within the scope of this standard shall be regarded as defined in the regulations and international codes and standards referred to in this document.

4.2 Abbreviations APS Abandon Platform Shutdown BOP Blow Out Preventer CCR Central Control Room ESD Emergency Shut Down ESDV Emergency Shut Down Valve F&G Fire and Gas HSE Health, Safety and Environment KO Knock Out LEL Lower Explosion Limit LQ Living Quarter PA Public Address HVAC Heating, Ventilation and Air Conditioning HC Hydrocarbons HSE Health Safety and Environment PSD Process Shutdown NPD Norwegian Petroleum Directorate IEC International Electrotechnical Commission IR Infra Red IP Institute of Petroleum (UK) UPS Uninterrupted Power Supply DHSV Downhole Safety Valve UV Ultra Violet



5 FUNCTIONAL REQUIREMENTS

5.1 General Governing documents, in the form of acts, regulations, standards and recognised practices shall be identified and applied in the design process. Use of international standards and codes shall be preferred to non-standard solutions unless it is documented that the alternative solution altogether will be optimal from a safety and cost point of view. The safety objectives established by project and implications of these with respect to the design shall be identified and expressed in the form of design objectives and requirements. Installations, equipment, systems and components shall be designed, equipped and located so that they can be operated safely and withstand anticipated loads. The technical safety requirements shall comply with the established risk acceptance criteria. The main goal is to develop cost optimum concepts which shall give sufficient protection for personnel, environment and material assets. Risk analyses are acknowledged as vital tools which provide input to the decision processes in both the design and during the operation of the installations. Analyses of scenarios that have been adequately covered by relevant previous analyses or of recognised standard designs, should be avoided.

5.2 Safety management This standard presumes that each project establishes a HSE program that includes or addresses: Scope and purpose of the program. System for identification and implementation of HSE design requirements. System for identification and assessment of risk. Risk acceptance criteria. Organisation and responsibilities in terms of safety. System for keeping track of assumptions, decisions and corrective actions related to safety. Procedures for handling of deviations and non conformances. Work program specifying all planned safety activities for each phase, including risk analysis and

safety verification plan.

5.3 Analyses and optimisation The design principles presented in clauses 6 to 13 reflect a normally adequate standard for safe design, whereas the project risk acceptance criteria are reflecting the maximum risk level, not necessarily achieved through a standard design. This is because the safety level depends on several factors, partly outside the range of standardisation, e.g. operational aspects, environmental conditions, new applications or new technology. In this connection risk analysis shall be applied in order to evaluate alternatives and provide necessary information for decision making.



5.4 Risk reduction principles

5.4.1 Overall principles The probability reducing measures shall be given priority over consequence reducing measures. Cost/benefit evaluation shall be applied to study different design alternatives. This principle shall be considered in connection with items below.

5.4.2 Inherent safety The design shall aim at a sufficient level of inherent safety, e.g. through: Eliminating or replacing hazardous materials. Reducing the quantities of hazardous materials. Selecting a process with a lower risk potential. Reducing numbers of leak sources (flanges, valves, instrument connections etc.) and ignition

sources. Sufficient material corrosion properties and toughness factors. 5.4.3 Failure mechanisms A systematic and documented identification of relevant failure mechanisms shall be performed. Relevant subject disciplines shall be involved. In particular this applies to: Failure mechanisms which can cause leaks and releases of hazardous substances, including all

types of corrosion, erosion, cavitation, material fatigue and ageing. Failure mechanisms which can cause ignition, e.g. ageing of electrical materials or components,

self heating of rotating machinery, current leakage due to water, static electricity, earth faults potential.

Failure mechanisms reducing the reliability and survivability of barriers and safety systems. 5.4.4 Escalation prevention Possibilities for escalation of events shall be identified and relevant measures taken to reduce this risk. The need for establishing safety barriers to avoid escalations shall be considered as part of the design.

5.4.5 Simplicity, comprehensibility and recognisability System and equipment complexity which may lead to human error shall be avoided by: Limiting the amount of equipment. Avoiding unnecessary functional dependency, especially in or between control systems, safety

systems and barriers. Selecting simple and logical solutions. Standardisation of codes, controls, colours, work methods and components. Designing with due attention to the 'human factor. Vital systems shall be properly marked and easily recognisable and understandable.



6 EVACUATION AND EMERGENCY PREPAREDNESS The installation shall have satisfactory access and evacuation facilities and be adequately equipped with rescue equipment. The emergency preparedness of any activity shall be established on the basis of defined situations of hazard and accident. An emergency preparedness analysis shall be carried out to design the emergency preparedness so as to meet the specific requirements for the activity in question. The emergency preparedness required in any activity shall form the basis for design and modification of the installation and the selection of equipment. In the establishment of emergency preparedness measures which prevent a hazardous situation from developing into an accident situation shall be given priority over measures which reduce the consequences of an accident situation. An emergency preparedness plan covering the operational phase shall be developed at an early stage of the conceptual phase. The plan shall be in accordance with clause 14 in ISO/DIS 13702. The plan shall take into account the following evacuation principles: The muster area and the access to the evacuation station shall be arranged and protected in order

to evacuate the actual number of personnel in an organised and efficient way. Area allocation: 0.4m2 per lifeboat seat. Main evacuation area: Gravity/free fall life boats with minimum life boat capacity of 100% of personnel on board the

installation. Other evacuation areas: One additional evacuation system in the far end of the installation shall be considered if escape

to the main evacuation area is impossible. The decision with regard to type of evacuation system, (lifeboat, escape chute, raft, etc.) shall be based upon the emergency preparedness assessment, ref. ISO/DIS 13702, clause 14.

For scenarios where the possibility for gas/smoke on the heli deck is within acceptable limits, helicopter may be considered as the primary means of evacuation.

For bridge connected installations and flotels the primary means of evacuation shall be the bridge. One additional evacuation system in the opposite end of the installation shall be considered if escape to the bridge is impossible in credible accident scenarios.

Evacuation chute with rafts shall be used as a secondary mean of evacuation in the main evacuation area.

The emergency preparedness assessment shall be applied to identify any need for additional evacuation means and the optimum location of these.



7 SAFETY REQUIREMENTS TO LAYOUT AND ARRANGEMENT

7.1 General requirements The installation shall be divided into main areas which shall be designed and located so as to minimise the risk to people, environment and material assets. The division of areas shall be made based on the risk they represent. Living quarters, control centre and equipment of major importance to safety shall be located in non-hazardous areas. Gas release points, e.g. flare/cold vent, shall be located and designed so that release of gas does not entail increased level of risk. Risers shall be located and designed so that leakages will have acceptable consequences. External riser inlet areas shall be shielded from fires and explosions on the installation. Reference is given to clauses 5 and 10 in ISO/DIS 13702 for layout, orientation and location of equipment and functions.

7.1.1 Area classification Installations shall be classified in terms of occurrence of ignitable gases, and divided into zones according to possibility of occurrence. The definition of hazardous areas shall be in accordance with IEC 79-10. As a guidance for the extent of hazardous zones, IP area classification code for petroleum installations, 15, may be used. Reference is also made to draft EN Standard pr EN 50145. The classification of hazardous areas shall be based on events and situations associated with normal platform operations, e.g. continuous or periodic venting, evaporation from open handling systems, small leaks from flanges and gaskets, escape of flammable substances during maintenance and work-over operations. "Catastrophic" events such as pipe rupture or vessel burst, which may be a result of material weakness, design error, falling loads, collision or sabotage, shall not be regarded as giving rise to a higher classification. This shall be reflected in the risk analysis, and may impose stricter requirements to arrangements and equipment than defined by the area classification alone. The area classification is an important part of the basis for layout, as it gives requirements to: Location of ventilation air inlets and outlets. Ventilation system requirements. Location of combustion air inlets and exhaust outlets for internal combustion engines and fired

units. Location and use of ignition sources. Location of emergency equipment. Location and design of doors and other connections between areas. Operational- and maintenance procedures in hazardous areas. Selection of equipment.



For design principles related to pressurisation of rooms, alarms and disconnection upon loss of pressurisation, ref. is made to IEC 79-13.

7.2 Escape routes The total time needed for escape to a safe area, including the time for safe termination of critical tasks, rescue operations, etc., shall be estimated and efforts shall be made to minimise this time. For large manned installations the escape route system and the temporary refuge shall be available for at least 1 hour. The temporary refuge shall be in accordance with ISO/DIS 13702 clause 14. The dimension of escape routes shall be minimum 1m width (0.9m for doors) and 2.1m in height (2005mm for doors). Escape routes intended for use by more than 50 persons shall be extended to 1.5m (1.2m for doors) in width and 2.2m in height. Other general principles are listed below. There shall be at least two exits to escape routes from every regularly manned area outside

quarters and offices, leading in different escape directions. The escape route network shall lead to safe areas and facilities as follows:

Living quarters. Temporary refuge. Life boats and life rafts-stations. Boat landings (not normally manned installations) Heli deck. Flotel or other installations linked by bridge/walk way.

Escape routes shall preferably be part of the daily used transport- and passageways. Where appropriate, main escape routes shall be provided on the outside along the periphery of the installation.

Doors shall normally open in the escape direction, but shall not block the outside escape route. Opening of doors should not require electric, hydraulic or pneumatic power. If such power is required the power supply shall be local.

Any dining room, recreation room in L.Q. etc., where more than 15 persons may be assembled shall have at least 2 exit doors. Internal room arrangement shall be evaluated for possible blocking of exits following an accident as well as external blockings. For all areas where there is a risk of congestion and panic, the doors shall be provided with panic bars.

Escape routes leading to a higher or lower level shall be provided by stairways. The number of these stairways shall be assessed based on the platform size, configuration of areas and equipment layout. Vertical ladders can be used in areas where the work is of such a nature that only a few persons (max. 3) are in the area on short time basis.

It shall be possible to escape from a drilling area without running through a well head area. A dead end corridor of more than 5m length is not acceptable. Stairways included in escape

routes shall be designed to allow for transport of injured personnel on stretcher. Lifts shall not be considered as a part of escape ways. However, it shall be possible to escape

from the lift and the hoist way with the lift at any elevation. Escape from legs/shafts/columns of an installation shall be considered separately. If use of lift is necessary to ensure adequate and effective escape, the lift system shall satisfy special requirements, e.g. concerning transport of injured personnel on stretchers, protection, ventilation, power supply.

Escape routes and emergency stations shall be illuminated. Escape routes shall be provided with adequate emergency lighting. Emergency stations should have minimum 15 lux, escape routes minimum 4 lux.



Escape routes in all areas outside the living quarter shall be marked by yellow painting. The escape routes within the living quarter shall be provided with low level directional lighting,

showing correct escape direction. Other enclosed and regularly manned utility and process areas shall be considered separately.

Escape routes shall be arranged from the drill floor to adjacent modules and also down the substructure. Protection of these escape routes from radiation heat shall be considered.

7.3 Living quarters The living quarters shall be designed, equipped and located so that acceptable safety for all accommodated personnel is achieved. Special emphasis shall be given to separation of the areas with drilling, production and auxiliary systems from areas for living quarters. Living quarters shall be designed and protected so as to ensure that the functions they are designed for can be maintained during a dimensioning accidental event. The living quarters shall be equipped with a reliable smoke detection and alarm system. The ventilation system shall be designed to prevent ingress of external smoke in an external fire scenario and vent smoke in case of a fire within the living quarter.

7.4 Helicopter deck The helicopter deck shall be subject to approval by the National Civil Aviation Administration.

7.5 Utility area The utility area should serve as a barrier between hazardous areas and LQ/emergency service areas. Routing of hydrocarbon piping to, or through, the utility area shall be minimised.

7.6 Emergency service areas An emergency service area is defined as an area containing equipment and systems required during emergency conditions. This includes firewater systems, emergency generators and emergency power distribution systems, main control and communication equipment, emergency ventilation equipment, ballast system and position keeping system. The location and protection of these systems as well as system design shall secure operations during and after an emergency condition. The equipment necessary during evacuation is of particular importance. Routing of hydrocarbon piping within emergency service areas shall be limited to diesel fuel supply lines for the emergency services themselves. The emergency stations shall be provided and located in accordance with ISO/DIS 13702 clause 10.

7.7 Process area The separation philosophy for different parts of the process systems shall be that equipment items of relatively high integrity but containing large volumes of liquids and low pressure hydrocarbons (separator vessels) shall be separated from equipment with high pressure which are the most likely sources of leakage (gas compression plant).



Process equipment containing larger volumes of high pressure hydrocarbons should be located above main load bearing structures to minimise the potential fire and explosion loads on such structures. Process piping, pig launchers and receivers and equipment shall be protected from external impact, e.g. from dropped objects or missiles due to disintegration of rotating machinery or as found required through analysis. ESD-valves shall be located and arranged in such a way that the exposure to fires and explosions are minimised. Electric cables, pneumatic tubings and hydraulic systems shall be protected from fire and explosion loads until they have completed shut down sequence time.

7.8 Riser area For risers which may release larger amounts of hydrocarbons, protection from external impact due to ships and drifting objects shall be evaluated by locating the risers behind main support structures or by dedicated protection structures able to resist the dimensioning impact energy. Impact energy of 14MJ may be assumed until a detailed collision risk study is available. The following means of protection shall be considered: For two or more gas risers, or one gas riser together with several oil risers: passive fire

protection. Pig launchers and receivers: location in open, naturally ventilated areas, at the periphery of the

platform, and with hatches directed away from equipment and structures. ESDV's: location in open naturally ventilated areas as close to the sea as practical. 7.9 Flare boom, flare tower, cold vent Flare booms and flare towers shall be located and dimensioned with due attention to all relevant flaring rates and wind situations to ensure that the heat radiation level (ref. clause 9.6 Flaring) will be within acceptance limits at all relevant locations on the platform, with regard to the operators, the structures such as cranes and towers and the electrical and mechanical equipment and pipes. The flare flame or hot gases shall not represent a hazard due to increased surface temperature to crane operators, crane structures and drill tower structures. Cold vents shall be designed in such a way that ignition of the gases will not represent unacceptable risk. A flare/vent study is required, showing the potential effects on all exposed areas.

7.10 Drilling and well head area The drilling and well head areas shall be located with maximum distance to the safe areas and be separated from processing areas in order to minimise the consequences from a blow out. The areas shall be arranged such that where practically possible it allows for external fire fighting assistance from two different directions in order to fight a burning blow out. Alternatively, the area shall be provided with a fire fighting system upgraded to provide a substitute for external fire fighting. The activities in this area will also be of a critical nature in case of emergencies, and it is of vital importance that escape routes are available to the personnel in the area. Furthermore the well head area shall be located so as to:



Avoid storage of combustible fluids. Facilitate access and emergency work in the well head area in the event of a blow-out. Minimise hydrocarbon piping not connected to the well. Ensure that the well head area is separated or protected from sources of ignition. The well heads shall be located as high as practical and above the main frame in order to

minimise exposure of the main frame from a well head fire, and to facilitate control of a blow out on the platform.

Consideration should be given to the protection of well and BOP equipment, such as control panels and hydraulic systems and their related signal paths. When simultaneous drilling, work over and/or production is planned for, operational procedures shall ensure an acceptable safety level of the installation.

8 SAFETY REQUIREMENTS TO STRUCTURAL DESIGN

8.1 Accidental design loads Accidental loads shall be identified and taken into account in the structural design. The probability, magnitude and potential consequences of identified loads shall be assessed and analysed. Relevant loads are: Impact loads caused by explosion, dropped object, ship collision or others.

- Explosion: Ref. is given to ISO/DIS 13702. - Dropped objects: Protection of structure to be dimensioned for falling container, pipes etc. based on estimated weight, probability drop height, vulnerability and criticality of the exposed areas. - Ship collision: The possibility of collisions caused by merchant vessels and the need for adequate sea traffic

surveillance system should be evaluated. For supply vessels operating beside the installation, a collision load of 14MJ shall be assumed.

Heat loads caused by jet fires or pool fires on the platform or adjacent platform, from risers or from the sea surface in case of large oil releases to the sea or in case of sub sea gas releases. - Fire:

Fixed installations shall be able to withstand a dimensioning blow-out/fire on sea for a time period sufficient for safe evacuation of the installation. The endurance shall not be less than 1 hour. Fixed installations shall be protected against fire on sea, as identified by risk analyses. For blow-out/fire on sea concerning floating installations, see clause 12.7.

Loads caused by extreme weather, earthquake, damage to structural elements (damaged condition) or extreme temperatures.

9 SAFETY REQUIREMENTS TO PROCESS AND AUXILIARY FACILITIES

9.1 General requirements Process and auxiliary systems shall be designed, manufactured, equipped and installed in such a way that the installations can be operated safely.



Process and auxiliary facilities shall be designed such that no single failure during operations can lead to unacceptable hazardous situations. This principle shall apply to operational errors as well as equipment failure.

9.2 Safety systems A safety shutdown system shall be independent of and in addition to other systems and equipment used for normal operation, control and monitoring, and shall act as a safety barrier in case of malfunction or maloperation of these systems and equipment. The safety shutdown system is logically divided into three main levels of shutdown: Process shutdown (PSD). Emergency shutdown (ESD). Abandon platform shutdown (APS). Basic system philosophy is that a shutdown on a certain level shall never initiate shutdowns on higher levels, but shall always include shutdowns on lower levels. For more details reference is given to clause 10.3 Emergency shutdown.

9.3 Process safety Abnormal operating conditions leading to potential hydrocarbons release shall be controlled by two levels of protection according to ISO 10418 (API RP 14C): Primary level of protection. Secondary level of protection. As far as possible, the two levels of protection shall operate on functionally different basis. Duplication of identical safety devices given different set points shall not be regarded to satisfy the requirement of two levels of protection. The PSD system shall automatically detect abnormal operation conditions within systems or equipment and initiate actions so that uncontrolled release of hydrocarbons is prevented. The systems shall be designed to avoid cascading effects due to partial shutdown within PSD, i.e. shutdown signals should trip all affected systems so that a new abnormality is not developed as a result of the initial trip action. The system philosophy also implies that the fail safe principle shall apply. I.e. components shall move to, or stay in the predetermined safest position upon loss of signal or power. The degree and extent of a PSD situation will depend on type of abnormality, and may vary from equipment shutdown with minimum effect on the production rate, to a total process shutdown.

9.4 Depressurisation Fast depressurisation shall be the mean of protection which shall be utilised to its full potential for the installation concept. Active and passive fire protection is to be considered to function as supplement to depressurisation, if necessary to prevent any resulting unacceptable events (rupture or explosion of pressure vessels/piping). All pressure vessels and piping segments, which during shut down contains more than 1.0 ton of produced hydrocarbons or unprocessed crude, shall be



equipped with a depressuring system. For gas segments, the maximum containment should be set lower than 1.0 ton. Location of segment (enclosed or open area), risk of segment being exposed to a fire, consequence of rupture, etc. should be considered. Depressurisation systems are required in addition to pressure relief facilities because of the loss of material strength during a fire. Depressurisation systems may also be required for systems which are unable to contain flammable or toxic materials by passive means alone. Loss of the active method of containment will require depressurisation to prevent escape of the material concerned (e.g. centrifugal compressor's dependence on seal oil systems). The material properties at actual temperatures and pressures during depressurisation, steel thickness, active or passive protective measures shall together ensure that a pressure vessel/piping segment does not rupture at a stage where this may escalate the fire scenario beyond the control of the protective systems and arrangement. This may call for a detailed study of each ESD segment in particular. The design procedure is outlined in clause 11.3. The depressuring, manually or automatic, shall be applied the following way: Manual field depressurisation sequence is considered initiated after 3 minutes from detection of

initial fire. Automatic depressurisation sequence is considered initiated immediately after detection of initial

fire. API RP 521 may be used as a guidance in the design of depressurisation systems.

9.5 Relief and venting The release of hydrocarbons from relief and depressurisation systems shall be routed through a closed system terminating at a liquid's disengagement vessel and with the liquid free gas being safely flared. Vents which are not suitable for routing to flare (e.g. due to back-pressure) shall be terminated outside the platform perimeter in such a way that accumulation of gases due to "dead pockets" etc. is avoided. Local venting of hazardous gases shall not be permitted unless it can be done without hazard to the personnel or the platform, e.g. for small and normally not manned installations local venting may be found acceptable. Flare K.O. drums shall be sized for two criteria: Disengagement of entrained liquid droplets. Containment of liquid carry over. The criteria for droplet removal will depend on the flare concept. The objective is to avoid condensate dropping from flare. The particle size shall be less than 400 microns. In case of vertical flare tower using subsonic flare burner the droplet size shall be less than 300 microns. The K.O. drum liquid containment capacity shall be based on the largest foreseeable liquid condensation rate for a period of at least 20 minutes. This period shall provide realistic time to



identify a problem and allow for operator intervention. Longer periods may be required, e.g. for sub sea flow lines and inter field pipelines. This shall be evaluated for each case. In addition the knock-out drum shall provide capacity for 90 seconds of liquid carry over from the largest source (assuming overfilled vessel). Progressive release of inventories from process piping and pressure vessels that can cause significant escalation of a fire, shall be avoided. As a minimum, the piping system and the pressure vessels shall maintain their integrity during depressurisation. The depressuring system itself (blow down valves, branch piping and headers and K.O. drums) is of particular importance. The ability to maintain integrity when exposed to the fire loads depends on selection of material, wall thickness, pressure rating and applied fire protection.

9.6 Flaring The need for flaring should be minimised from an environment point of view. Ref. NORSOK S-DP-003, Environmental care. Calculations shall be performed to determine the levels of radiation on all areas of the platform for critical flare conditions. Flare radiation calculations shall account for variations in flaring quantities and wind conditions. Maximum heat loads from flares on open areas where personnel may be present and on locations where structures and equipment are exposed shall be as follows: Permissible radiation levels to personnel shall follow radiation levels as given in API RP 521. The heat loads from planned continuous flaring conditions on areas where personnel are

supposed to perform work tasks lasting for two hours or more the working environment requirements for exposed areas shall be considered and ample protection provided as required.

For long periods of flaring (continuous flaring), consideration shall also be given to the radiation level on the heli deck, i.e. the radiation/temperatures on the heli deck shall not become intolerable to personnel or limit the necessary helicopter operations. Unless otherwise accepted by the responsible for helicopter operations, max. 1.9kW/m2 is allowed on heli deck.

Max. heat loads from flare on structures and equipment not designed for high heat loads shall be limited to meet the requirements below. Higher exposure for short times, e.g. during emergency flaring conditions, that will not harm the structure or equipment can be accepted. Such deviations shall be documented.

Protection of exposed areas may be necessary to meet these requirements. Heat loads on steel- or aluminium structures shall not give temperatures that results in loss of

structural integrity. Heat loads on wires in drill tower and cranes shall be limited depending on type of lubrication

and inspection- /replacement frequency. Flare radiation shall not cause temperatures in areas classified as hazardous above 200oC or

above the ignition temperature of the actual gas, whichever is the lowest . Heat loads on Ex-rated electrical equipment and instrumentation shall not give temperatures

exceeding 40oC. Based on a case to case evaluation of protective clothing, provision of local radiation shields, etc., the limits for acceptable heat loads can be adjusted as applicable. Such deviations shall be documented.



9.7 Cold vent The design of cold vents shall be based on dispersion calculations to prove that the foreseen gas rates can be released without creating explosive air/gas mixtures on the installation or in its vicinity. Further, the possibility of an unintended ignition shall be taken into account in the design and dimensioning of the cold vent, i.e. ignition of foreseen gas rates shall not give unacceptable heat loads or other consequences on the installation. The need for extinguishing ignited cold vent shall be considered.

9.8 Drainage systems The platform shall be equipped with the following drainage systems: One closed drainage system. One open drainage system from non-hazardous areas. One open drainage system from hazardous areas. Where applicable, a separate mud drainage system shall be provided covering the drill floor and

mud treatment areas. Open drainage systems from areas where there is no pollution, e.g. rain water drain from roofs and heli deck shall be routed directly to the sea. Reference to ISO/DIS 13702 clause 8.

10 REQUIREMENTS TO SAFETY AND COMMUNICATION SYSTEMS

10.1 General requirements The general requirements to safety and communication systems are to be in accordance with ISO/DIS 13702 clause 10. Safety and communication systems shall be designed and protected so as to retain their operational capability for the required period of time during an accidental event. Safety systems shall be designed to operate independently of other systems or with a safety equivalent to an independent system.

10.2 Fire and as detection

10.2.1 General All F&G detection system display and information facilities shall be centralised, and located in a continuously manned area, normally the central control room. With the installation divided into fire areas the design of F&G system shall presume that each fire area shall be covered by a sufficient number of detectors. The alarm presentation in CCR should in addition to screens (VDUs) be given on a simple fire and gas mimic. Only essential information shall be shown on the mimic, i.e. with fire area status, unless for areas or equipment where a more detailed alarm identification is appropriate, e.g.: Around heli fuel package.



In or at ventilation inlets. Inside critical equipment enclosures. Local F&G display and status facilities shall be provided in the drilling area incorporating F&G control of the drilling facilities.

10.2.2 Gas detector layout and alarm initiation The following principles shall apply concerning detector layout and alarm initiation: Location, type and number of gas detectors shall take into account:

- Leakage sources within the area. - Borders between non-hazardous and hazardous areas. - Gas density relative to air. - Detection principles and voting logic. - Ventilation air flow patterns. - Wind-direction and velocity. - Critical reaction time/detector response time. - Size of the area. - Criticality of the area with regard to safety.

HVAC intakes - Gas detectors in HVAC supply shall be located at the air intake, alternatively in the duct as

close to the duct opening as possible. Detectors in a duct shall be positioned as near as practical to the centre of the duct where the air velocity is greatest and where the response time to gas ingress is consequently most rapid. At big intakes, the flow patterns around the opening shall be determined to achieve an optimum position of the detectors with regard to response.

- HVAC intakes or ducts shall be monitored by minimum two gas detectors. Confirmed gas

- Is activation of two detectors arranged in one voting area, one at high and the other at low LEL set point. Each project shall define the high and low set points, considering the distance between individual detectors working in a voting area, ventilation conditions, etc. However, the high level shall not be set above 60% LEL. Automatic alarm as specified in table 1 shall be initiated upon two detectors at low level.

- Where single detector logic is employed, single detector at high gives confirmed gas. One detector at low shall initiate automatic alarm.

- A non-hazardous area covered by dedicated detectors should be arranged in a voting such that one detector in the non-hazardous area, e.g. in a ventilation intake coinciding with gas detected in a hazardous area should be interpreted as a confirmed gas in the non-hazardous area.

Alarm on gas detection - Alarms shall be automatically initiated according to table 1.

Table 1 Automatic alarm in area.

Automatic alarm in area CCR Living

Quarter Non-haz.

utility areaProcess

area Drilling

area Drill control cabin/office

Confirmed gas detected at:

HVAC intake LQ X X X X X X



Non-hazardous utility area HVAC/air intakes

X X X X X X

Process area incl. HVAC outlets

X X X

Drilling area incl. HVAC

X X X

Any single detector X X low LEL detector in

drilling area

Beam gas detectors - Beam detectors are preferred where the layout enables good coverage by such detectors.

Beam detectors should be used in combination with point detectors. This can be a way of limiting the number of detectors.

10.2.3 Fire detector layout and alarm initiation Fire detector type:

The selection of fire detectors shall be based upon an evaluation of the nature of the fire that is to be detected and the operational conditions that may exist. Early smoke detection systems, sensitive to small concentration of combustion products shall be considered in all rooms without automatic fire fighting, such as: - Central control room. - Instrument room. - Switch board and electrical rooms.

IR or dual IR/UV fire detectors shall be used in process areas. Manual detection:

Manual fire alarm buttons shall be provided at strategic locations, e.g. exits from process areas, escape routes, fire stations. These buttons may be used for other accidents or situations where the attention of CCR is to be called in accordance with established operational procedures.



Confirmed fire: Is activation of two fire detectors working on a voting principle in a fire area. Confirmed fire is activation of one single fire detector when no voting is employed.

Alarm on fire detection:

Alarms described in table 2 shall be automatically initiated. Alarms in other areas to be manually initiated from CCR.

Table 2 Automatic alarms upon fire detection.

Automatic alarm upon fire detection CCR Living

Quarter Non-haz.

utility areaProcess

area Drilling

area Drill control cabin/office

Confirmed fire detected at:

LQ X X Non-hazardous utility area

X X X X

Process single well head

X X X

Conf. process X X X X X X Conf. drilling X X X Any single X X detector detector in

drilling area Table 3 below presents normative examples of fire and gas detection in the various areas on installations. Alarms are described in the text above, and is not repeated in the table. The solutions presented in the table can be deviated upon an evaluation of the specific risks in an area. Reference is also made to figure 1 regarding the emergency shutdown philosophy, and clause 11.5 regarding active fire fighting. Table 3 Fire and gas detection/shut down actions.

Fire and gas detection / shut down actions Area/room Automatic fire

detection Shutdown

action Automatic gas

detection Shutdown

action Comments

Well head area Flame or heat (fusible plugs*)

ESD II Area ESD II Not normally manned

installations* Manifold area Flame ESD II Area ESD II Nat. vent./ outdoor H.C. process area

Flame ESD II Area, leak detection

ESD II




detection Shutdown


detection Shutdown

action Comments

Mech. vent. process area (separation/gas compression)

Flame ESD II Area + HVAC extr. duct

ESD II

Water injection treatment area

Flame or smoke* ESD II HVAC intake*None**

ESD I* Area assumed non-hazardous

*Mech. vent.

area ** Nat.vent/ outdoor area

Gas compression area

Flame ESD II Area ESD II

Drill floor None Manual Area Manual* *See 10.3.5 Drillers cabin Smoke Manual HVAC intake Manual* *See 10.3.5 Degasser room Flame Manual

Drillers cabin

HVAC extract Manual* Drillers

cabin

*See 10.3.5

Shale shaker room Flame Manual Drillers

Cabin

Area, H2S* Manual Drillers cabin**

*If sour service**See 10.3.5

Active mud tank room

Flame Manual Drillers

cabin

Area + HVAC extract

Manual* Drillers

cabin

*See 10.3.5

Sack/bulk storage room

Heat None HVAC intake ESD II

Mud lab Smoke None HVAC intake ESD II Assumes no piped

connection to mud system

Cementing unit room

Flame None HVAC intake Manual Drillers Cabin

Central control room (CCR)

Smoke in cabinets* and/ or

at roof level

Manual HVAC intake ESD I *Fire detection Early warning

system Instrument room adjacent to CCR

Smoke* Manual HVAC intake ESD I *Fire detection Early warning

system Central tele eq. room

Smoke* Manual HVAC intake ESD I

*Fire detection Early warning

system

Local equipment Smoke Manual HVAC intake ESD II* *Shut down of




detection Shutdown


detection Shutdown

action Comments

room (LER) internal equipment to be

evaluated Turbine hall Flame *

Smoke ** Manual HVAC intake ESD I * Fuel system

**Electric equipm.

Turbine hood Flame and heat* Unit shutdown upon area

fire detection

Area (hood) Unit** shutdown upon area

gas detection

*Supplier to confirm.

**Continue ventilation.

Block and bleed fuel gas system

Turbine Combust. air intake

ESD I

Switch board and electrical room

Smoke* El.** power switch off

HVAC intake ESD 1 *Fire detection Early warning

system **Manual or

automatic with timer to be

decided Battery room (lead acid)

Smoke HVAC intake H2detector at

extract

ESD Shutdown

boost charge

Fire pump room with diesel engine

Flame Manual HVAC intake ESD I, Close fire- damper*

*Running fire pump will be

shutdown only on overspeed

Air compressor Smoke or heat Manual Air intake ESD I* *Incl. unit shutdown

Mechanical workshop

Smoke or heat Manual HVAC intake ESD I Separate welding HVAC

extract Instrument workshop

Smoke or heat Manual HVAC intake ESD I

Paint storage Heat or flame HVAC intake ESD I HVAC intake common for LQ.

Smoke at intake and in HVAC

room

HVAC shut down

Air intake ESD I

LQ, cabins/rooms/ areas

Smoke Manual * *Covered by gas detector in

HVAC intake (see above line)

Vent extract from galley

Heat Manual




detection Shutdown


detection Shutdown

action Comments

General galley area

Heat Manual

Crane engine room

Heat Manual Combustion air intake*

ESD* Unit s.d. timer

delay 30sec

*Depend on crane location

Heli deck None None Hangar Smoke and flame None Chain locker None None Turret area Flame ESD II Area ESD II Pump room in column

Smoke, heat HVAC intake ESD I

10.3 Emergency shutdown

10.3.1 General References are given to ISO/DIS 13702 clause 6. The installation shall be analysed to identify all hazardous conditions and their consequences. The critical operating parameters shall then be selected and an emergency shutdown logic developed. Due consideration shall be given to the event sequence in relation to the overall installation safety. In the detail assessments of ESD philosophy, actions associated with time delays in the achievement of a state of no escalation potential shall be identified and the implications on ESD philosophy determined. The ESD principle hierarchy presented in figure 1 shall be applied for complex installations and used as guidance for simpler installations. For drilling operations see clause 10.3.5.



Figure 1 Emergency Shutdown Principle Hierarchy

10.3.2 Abandon platform shutdown (APS) The APS shall be provided for manual operation in case of total evacuation from an installation. The intent of an APS is to ensure that an abandoned platform is:



Depressurised. Electrically dead. Fire pumps, if running, shall be allowed to run empty the diesel day tank. Emergency support systems with self-contained, built-in power supply shall be left operational. Such systems may be: Navigational aids. Heli deck perimeter lights. Emergency lights. Shutdown of other emergency systems shall be via 'timer' to ensure that systems are operational as long as required, for ensuring a safe shutdown, evacuation and abandonment (see fig. 10.1).

10.3.3 ESD With a few exceptions as further described below, initiation of ESD I shall only leave the emergency systems active. Typical emergency systems are: F&G detection. Fire fighting. ESD including ESDV status presentation in CCR. Radio/external communication. UPS. PA. Blow down and flare. Bilge/ballast water. Dynamic positioning Emergency generation & distribution. Emergency lighting. Evacuation. Vital equipment required in an emergency situation, including systems for status display of

critical systems in CCR. Personnel lifts and hydraulic work platforms must be kept operable to ensure that personnel can escape safely from such equipment after a shutdown. Shutdown of utility systems and activation of emergency systems are shown in fig. 10.1. Initiation of ESD II shall shut down the process; close riser/flow line valves and well head valves and switch over turbine generators from fuel gas to diesel. Welding sockets and other sockets which serves areas where hot work permits are required shall be disconnected in all areas upon ESD II as well as upon gas detection (single detector). Depressurisation upon fire in the process or well head area shall be manual or automatic subject to the evaluations outlined in clause 9.

10.3.4 Manual APS/ESD stations Manual APS stations shall in principle be distributed at strategic positions such as:



Muster/escape areas, e.g. lifeboat stations, heli deck, bridge connections. CCR. Manual ESD stations shall in principle be distributed in essential areas such as: Exits from areas with hydrocarbon piping and equipment, e.g. well heads, drilling, process etc. Along major escape routes, muster areas, e.g. life boat stations, heli deck. Control points, e.g. central control room, drillers cabin, local manned control room, emergency

operation centre, radio room etc.

10.3.5 Shutdown of drilling and work-over operations Automatic initiated shutdowns of drilling and work-over operations shall only be activated from the F&G detection system at confirmed fire or gas detected in rooms critical for the drilling and work-over operations. Loss of over pressure in these rooms shall not give an automatic shutdown, but give alarm to the responsible drilling personnel The adverse effects of automatic shutdowns shall be thoroughly evaluated for each case of automatic action that are accepted. By any other ESD, the drilling and work-over operations shall not be automatically affected, except for burning on the burner boom, which shall be stopped automatically. Supply of emergency power to drilling plant in case of main power generation shutdown shall be subject to evaluation by the project. An ESD push button for initiation of ESD I shall be provided at Drillers cabin and drilling supervisor's office. Responsible drilling personnel shall in addition have a manual drilling shutdown switch available to stop drilling and work-over operations. The BOP system, the draw work brakes and cementing unit shall not be affected by this switch.

10.4 Ignition source control Equipment left live in the APS situation shall be certified for operation in zone I areas. Excepted is only equipment required for the safety operations, see figure 10.1, that are located in rooms continuously manned or monitored in emergency situations. Such equipment shall be easily shut down manually from the manned area/room. Equipment left live in the ESD I situation shall be certified for operation in zone 1 areas. Excepted is emergency equipment in LQ and other areas subject to special considerations. Examples of equipment that can be accepted without certification for zone 1 areas are: Emergency generator. Emergency switch gear. Equipment in CCR required for the control of the ESD I situation. Central equipment for internal/external communication. Upon ESD II, all equipment operated under hot work permits shall be disconnected. Power supply to welding sockets shall be disconnected upon detection of low level at any single gas detector.

10.5 Alarm system The objective of an alarm system is to warn and guide personnel as quickly as possible in the event of a hazardous or emergency situation and to promote quick response.



Location, number, type and effect of alarm systems/equipment/signal shall be so that the alarm condition is easily recognised in any area where distribution of the alarm is required. The alarm system shall be designed in accordance with table 4. An audible alarm signal shall always be followed by an announcement on the Public Address system. For zoning of alarms, see table 1 and 2. Table 4 Alarm signals.

Alarm Type Signal Indicates Muster Alarm Continuous audible signal.

Yellow flashing or rotating visual lamp

Prepare to abandon installation

General Alarm Intermittent audible signal. (1 sec. on, 1 sec. off). Yellow flashing or rotating visual lamp

Fire, or fire related situations, gas leak or other serious situations

Toxic Gas Alarm Note 1.

Intermittent audible signal (0.1 sec. on, 0.1 sec off). Yellow flashing or rotating visual lamp

Toxic gas, e.g. H2S.

Local alarm in rooms protected by CO2 or other gases with lethal concentrations.

Local red light at entrance. Local high freq. tone in room/area and in adjacent room/area providing access.

Gas released. Note 2.

Inert gas protected rooms/areas.

Local red light at entrance. Gas released. Note 2.

Local alarm on loss of over pressure.

Local white flashing or rotating visual lamp. Announcement by PA system.

Over pressure lost in room.

Alert Two level audible tone on P.A. system.

Important announcement to follow on PA system

Notes 1. At small local occurrences, local alarm may suffice. 2. Pre warning before release to be considered in inert gas protected rooms. The system shall be designed to give appropriate access priorities. For muster, general and toxic gas alarm conditions, the personnel shall: Stop all work. Follow instructions given on the PA system. Carry out duties according to emergency instructions. If not instructed otherwise, personnel without emergency duties report to muster station

immediately.

10.6 Emergency power The emergency systems listed in clause 10.3.3. shall be supplied with emergency power.



The emergency power shall be supplied from a diesel engine driven emergency generator located in an unclassified area. The consumers shall be supplied with emergency power for at least 18 hours. An uninterrupted power supply for emergency equipment and systems shall be installed. Emergency batteries shall have a capacity to supply emergency power for a minimum period of 30 minutes. The emergency generator shall be exclusively dedicated for supply of emergency power. The emergency generator system shall be self-contained. Arrangements for black start shall be provided. Start and monitoring of the emergency power system shall be possible from the CCR where a matrix panel shall display the status of the generator. The time required for the emergency generator to accept electrical loading after initiation of start signal shall be evaluated. In addition to automatic starting provisions a manual starting and testing device shall be provided. The emergency power distribution system shall be sufficiently protected against fire and explosion to operate during an emergency situation until safe evacuation has been performed. For operational reasons, the following systems should also be supplied with emergency power: Process control and data acquisition system. PSD system.

11 REQUIREMENTS TO EXPLOSION AND FIRE PROTECTION

11.1 General requirements The general requirements to explosion and fire protection are given in ISO/DIS 13702.

11.2 Fire protection philosophy The requirement for protection against fire on a installation is directly related to the actual fire potential in the area. Active and passive fire protection shall be arranged in such a way that a fire is prevented from spreading to other areas within a certain time specified and to protect load carrying structure against critical heat loads. The fire protection philosophy shall be established and shall as a minimum reflect the aspects listed below: Accidental loads. Relevant fire scenario. Fire water capacity. Manning. Availability of fire protection equipment during emergencies. Requirements for automatic detection. Mutual aid. Compatibility of equipment. System availability during maintenance.



For utility areas, including electrical and instrumentation rooms, choice of fire retarding materials, for sectioning of switch boards, etc.

The fire load shall be established based on fire load analyses where due attention is given to: Leak and ignition probabilities. Leak source parameters, leak rate vs. duration, gas/oil ratio. Fire characteristics, pool fire, flash fire, jet or diffuse fire. Air/ventilation conditions/limitations. Distances, separation or shielding. The effects of ESD and depressurisation. Active fire protection, availability and efficiency. In addition to requirements given in ISO standard, the fire protection design shall be documented by fire protection data sheets, annex A. Credit for fire water can be taken in the protection of equipment piping and (secondary) structures, subject to considerations outlined in 11.3. such credit shall not affect design of primary fire partitions segregating areas or design of load carrying structures. It is a condition that escalation within an area due to failure of the fire water systems does not affect the main fire partitions and load carrying structures.

11.3 Protection of pressure vessels and process piping The procedure described below shall be followed unless more detailed evaluations are performed. The design procedure includes the following principal steps. Figure 2 gives an overview of the procedure. Step 1. Identification of fire types. The initial step is to decide which type of fire the pressure vessel/piping can be exposed to. Fuel supply and ventilation conditions shall be determined: Types of fire: Pool fires in open or enclosed areas, fuel controlled. Pool fires in enclosed areas, ventilation controlled. Jet fires. Step 2. Effect of fire water. Water applied for controlling the fire and cooling of pressure vessels and piping is very effective when evenly distributed over the exposed areas. Credit for fire water can be taken when the design provides: Spray of deluge water from nozzles from below, from both sides and from above. Spray nozzle location ensuring that water spray projection covers all surfaces of the protected

equipment/piping. Supply of deluge water to a module is arranged so that accidents can not damage the supply. Coverage of fire detectors that ensures immediate detection of small fires in all parts of the fire

area. Operation procedures shall ensure high availability of these systems.



Alternatively, heat loads shall be based on detail evaluation of the credible fire scenarios. Application of predicting tools for calculation of heat loads may be an integral part of the evaluation. Step 3. Heat flux values for the next step are then selected from the following table: Table 5 Heat flux values.

Type of fire Initial heat flux

density Initial heat flux

density Reduced average

initial heat load due max. point loads average load to fire water creditPool fire (crude) open or enclosed area fuel controlled

150 kW/m2

100 kW/m2

80 kW/m2

Pool fire enclosed area ventilation controlled

200 kW/m2

130 kW/m2

100 kW/m2

Jet fire 250 kW/m2 200 kW/m2

The reduced average initial heat loads shall only be applied if the conditions outlined in step 2 is fulfilled. Step 4. Depressuring / rupture calculations. Perform depressuring calculations for each major pressure vessel and piping segment, establishing internal pressure fluctuation, wall material temperature and residual strength, as a function of time. Determine whether rupture will occur during depressuring, and identify time to rupture if this will occur. The effect of manual versus automatic initiation is specified in clause 9.4. Step 5. Evaluation of failure mode. If a rupture of pressure vessels and piping occurs as a result of a combination of excessive heat input and internal pressure, an acceptance of the situation will have to be judged based on the risk analyses. Residual quantities, escalation potentials both within the area and towards adjacent areas shall be evaluated. Simplified evaluations can be made when the pressures are considered low (< 4.5 bar) in the pressure vessels and piping when the rupture occurs. Where rupture can not be accepted, i.e. the risk acceptance criteria are not met, the provision of additional protective systems and arrangements shall be implemented. This can be: Upgrading of active fire water system so that credit from fire water can be taken. Application of passive protection that will reduce the heat loads to the exposed pressure

vessels/piping. Modifications to pressure vessel /piping design (material , wall thickness etc.). Modifications to the general arrangements that have an impact on the time to rupture. Change from manual to automatic depressuring.



The procedure will then have to repeated from step 1, 2 or 3 as applicable.

Figure 2 Flow diagram for deciding of use of passive fire protection on pressure vessels and

piping.

11.4 Passive fire protection Living quarters shall be designed and protected so as to ensure that the functions they are designed for can be maintained during a dimensioning accidental event. If fire technical calculations indicate that the outer surfaces of living quarters in the event of a dimensioning fire may be subjected to at heat flux exceeding 100 kW/m2, they shall be fitted with fire divisions of minimum class H-60. The choice of materials and interior design of living quarters shall be decided in relation to the fire risk, and shall prevent fire from spreading. Floor, wall and roof finishes shall pass fire test in IMO Resolution A 653 (flame spread). In addition, the materials shall pass test according to ISO 5660 (smoke and ignition properties). Windows should not be installed in H-rated fire divisions.



11.5 Active fire protection For large integrated installations shall be based on 2 independent pump systems. Each pump system should have the capacity to supply 100% of the largest fire water demand. It is recommended that each pump system consists of 2x50% pump units, unless other solutions are found to comply with the over all fire protection philosophy based on thorough evaluation, including pump standard, favourable effects, compensating measures, alternative fire water supply. Ref. clause 11.2. Fire pumps with a capacity above 2500m3/h (each) shall not be selected without special reason.

11.6 Explosion protection philosophy Reference is given to ISO/DIS 13702 standard clause 13.

12 SAFETY ASPECTS RELATED TO FLOATING INSTALLATIONS

12.1 General This clause contains additional safety design principles related to floating production/ drilling/storage installations. The risk analysis, emergency preparedness analysis and fire risk analysis, ref. clause 5, 6 and 11 shall be performed , taking the special aspects related to the floating installation into consideration. Other aspects covered by this standard, clause 1-11 shall be applied as relevant. Items covered by clause 12.3 - 12.9 are related to special design solutions and should be applied accordingly. Installations intended for short term exploration drilling, shuttle of crude to harbour and general service are not covered by this standard.

12.2 Marine industry standard This standard assumes that structure, marine systems and marine equipment on floating installations do comply with relevant requirements in the marine industry, i.e. international codes and conventions, authority requirements and class society rules.

12.3 Crude storage Crude storage tanks, and in particular large tanks, shall be subject to special safety considerations in light of their fire and explosion potential. Main principles for such tanks are described below: Large crude storage tanks shall be provided with an adequate and safe vent system, and gases

shall be routed to either cold vent, flare or re-cycling system. Pumping units shall be of the 'deep well' type. 12.4 Layout The following additional requirements shall apply concerning the layout of floating installations: Vital control functions, e.g. maritime control/bridge, process control and special emergency

preparedness functions, should be arranged in one common control centre for the entire installation.

Turret location/arrangement shall be based on evaluations including leak frequencies and potential leak quantities.

Hydrocarbon pressure vessels and heavy duty equipment shall not be located within main hull structure unless it is verified that: - The explosion venting is sufficient to prevent unacceptable overpressure. - The fire loads do not cause structural collapse.

Process decks and relevant parts of the floater deck shall be arranged with the aim of minimising the risk of large pool fires on decks and tank tops.



Process areas, turret areas and piping shall be designed to minimise the risk of jet fires towards tank tops.

12.5 Turret The following design principles applies to turret design: 1. The turret arrangement design shall aim at achieving open naturally ventilated areas and

minimising explosion pressure. Enclosed mechanically ventilated areas shall be restricted to containers or small rooms with control and special equipment that requires special protection or cannot be located in outdoor environment. Such enclosed premises shall have over pressure ventilation, with air taken from a non-hazardous area. Location of the premises themselves as well as their ventilation intakes shall take into account the prevailing wind directions. Equipment that can be ignition sources, e.g. electric equipment should not be arranged in the moon pool area.

2. Anchor handling winches should be located in open areas. If located in hazardous area, suitability for operation in hazardous area shall be ensured. Sea water spraying (deluge) for spark suppression may be applied to equipment that is exposed to sea water under normal operations. For spraying of other equipment, fresh water shall be used. Where winches are arranged on the deck below Riser Termination and ESD valves, the deck separating the areas shall be solid and gas tight.

3. The use of flexible hose connections for well stream transfer, within the turret and between turret and ship, should be minimised.

4. Fire protection of turret can be arranged by fixed or oscillating fire monitors located on the ship, e.g. on gantry structure. Portable equipment and fixed systems for enclosed rooms shall be arranged according to clause 11.

5. Production or export/gas injection risers shall be protected against fires in the turret by passive means. Routing of risers within conductors is one acceptable design principle. At riser termination end, the riser connector and first ESD valve shall be protected by passive means. For protection of other parts of the structure, please refer to other relevant parts of this standard.

6. Risers shall be protected against damage from wires and chains used for mooring. Arrangements that provides both protection against such loads as well as fire protection are preferred.

7. Decks above moon pool where hydrocarbons leaks may occur shall have an adequate drain routed to a collection tank.

12.6 Drainage Drainage systems on floating installations shall be designed to operate satisfactorily for all sea states in which the installation is intended to be operable. Drainage systems for the process systems shall be designed to operate satisfactory for all sea states in which the process system is intended to be operable.

12.7 Emergency re-positioning The need for quick re-positioning of the floater in case of specific emergency situations shall be evaluated. Important factors in this evaluation are number and types of risers, riser pressures, sub sea ESDV and mooring arrangement. Anchor moored or dynamically positioned installations located above well(s) shall be able to move 150m from the normal position in 10 minutes, or as specified through adequate risk analyses.



12.8 Topside/floater interface All interfaces between the typical maritime floater technology and offshore petroleum technology shall be clarified at an early stage of the design process, and be monitored during the project to ensure compatibility and consistency in the total design.

12.9 Escape and evacuation For floating installations it shall be verified that effective escape and/or evacuation can be performed at dimensioning heel angles and motions

13 NORMALLY NOT MANNED INSTALLATIONS

13.1 General This section outlines the safety design principles to the design of process, safety and auxiliary systems for production installations which are normally not manned. The design principles only apply to installations which are designed as remote-controlled units with no requirement for permanent manning. The personnel will usually only be present during daytime. It is recognised that a large variety of designs can be developed. Specific design. requirements will have to reflect the special conditions. Examples of design is given in annex B.

13.2 Common requirements

13.2.1 Risk evaluations Risk evaluations shall take into consideration drilling and process data, weather conditions, ship traffic and the environmental acceptance criteria.

13.2.2 Design principles Simple, reliable and sturdy concepts for the purpose of minimising maintenance activities on the installation shall be emphasised. The following special activities related to manned operations onboard shall be evaluated during design: Weather conditions for boarding and departing of the installation. Allowable weather and sea state conditions and weather monitoring while the installation is

manned. Arrangement for boarding and departing the installation. Activities that may take place during production or need a shut-down of the installation. 13.2.3 Supporting structure The minimum requirements to the design concerning resistance to impact from collisions with ships, shall be based on an individual evaluation of each concept. This evaluation shall take into consideration the types of vessel expected to be in the vicinity of the installation, boarding procedures (boarding zone, weather restrictions, loading requirements, call frequency, anchoring philosophy etc.) and the layout and arrangement of the installation.



13.3 Well head system

13.3.1 Well head system The well head system includes the wells, the X-mas trees and the flow lines up-stream to and including choke valves. The well head system shall be designed to withstand the highest load combination of pressure and temperature occurring during operation, shut-down and maintenance of the wells. In addition to local operation, wing control valves may be controlled from the remote control centre, allowing remote shut-down and restart of the production. Blocking of remote start-up of production shall be possible while the installation is manned.

13.3.2 Piping systems and pressure vessels While allowing for safe operation, piping systems and pressure vessels shall be designed to minimise the instrumentation and control equipment. Piping systems designed to withstand the highest load combination of pressure and temperature to which the systems are expected to be exposed, need not be provided with full flow pressure relief valves. If the total inventory cubic content of process pipes and pressure vessels between X-mas tree and the riser emergency shut-down valve does not exceed 6m3, automatic depressurization is not required. In that case, personnel safety shall be ensured by proper evacuation procedures in case of fire. The need for thermal relief of piping systems and pressure vessels as well as the need for an automatic depressurisation system for systems with an inventory of more than 6m3 shall be considered in the individual design.

13.3.3 Drain and vent systems Drain for liquid hydrocarbons either to supply boat or to a drain tank shall be installed. Manual depressurisation of all pressurised systems shall be possible. Vent pipes from systems containing hydrocarbons shall be terminated at a minimum of 3m above or outside decks. The location of vent pipe termination shall take into account helicopter operations. Vents on atmospheric vessels which are not dimensioned to withstand a full inside explosion pressure shall be provided with adequate flame arrestors.

13.3.4 Risers Production and lift gas risers shall normally be equipped with a riser emergency shut-down valve. On risers for stable fluids which may be depressurised from the main installation, omission of riser emergency shut-down valves may be considered.

13.4 Auxiliary systems Engines shall be certified for operation in hazardous areas.



13.5 Escape routes Muster areas and the primary escape routes shall have radiation shielding from fire in the well head and process areas in order to allow evacuation of the installation.

13.6 Life-saving appliances When the installation is manned, life-saving appliances with a capacity of 2x100% of the crew on board shall be available. Life-saving appliances may be lifeboat(s), life raft(s) to be lowered into the water or motor-driven rubber dinghies operated from standby vessel.

13.7 Emergency shut-down Provisions shall be made for emergency shut-down and operational shut-down of the installation to be made both locally at the installation and at the remote control centre. The emergency shut-down signal from the remote control centre shall be by a fail-safe signal (e.g. by means of a radio link) which on disconnection shuts down the normally not manned installation. A possible time delay in shut-down due to a link failure shall not exceed 5 min. Emergency shut-down of the remote control centre or plant shall result in operational shut-down of the not normally manned installation. It shall not be possible to inhibit a local emergency shut-down system from the remote control centre. The emergency shut-down system shall be in operation when the installation is unmanned.

Technical safety S-DP-001 Annex A Rev. 2, January 1996


ANNEX A NORMALLY NOT MANNED INSTALLATIONS (INFORMATIVE)

A1 TYPE A OF NORMALLY NOT MANNED INSTALLATIONS General This paragraph defines the design principles to safety systems on type A installations. Example of Type A installation Type A covers installations which are manned only during daylight and under weather conditions that allow safe access and escape by boat. The requirements for this type of installation are based on the assumption that the installation will be manned only occasionally. A type A installation will typically be arranged with means of access from the sea, an access deck for the X-mas trees and a helicopter winch deck, primarily intended for materials handling. The process equipment will typically include X-mas trees, production manifold and a removable spool for pigging. The safety equipment will typically include an inflatable life raft, fire detectors, portable gas detectors as well as portable fire extinguishers. The main power source may be a battery pack with recharging and by a small diesel generator or by a power cable from the service installation. A hoist may be installed. When manned, shut-down of the installation shall be made on the installation. The installation will be manned in connection with scheduled maintenance jobs, well monitoring and start up of production following an emergency shut-down. Access to the installation will typically be by boat. Fire and gas detection Fire detection shall take place by means of fusible plugs or similar simple systems and shall results in automatic shut-down. Gas detectors with alarm functions shall be in operation when personnel is onboard the installation. If portable detectors with built-in alarm functions are used, these shall be placed in fixtures on approved locations by the crew when ascending the installation.



Alarm systems Upon gas detection an audible alarm shall be activated. This alarm may be provided by portable gas detectors themselves. When the installation is manned, an APS signal shall be operable, which can be perceived by all on board. Communication equipment An emergency shut-down link between the remote control centre and the not normally manned installation shall be established. Voice communication between the installation and the remote control centre and directly between the installation and standby vessel shall be possible when the installation is manned. If voice communication is based on portable radios, a minimum of two radios shall be available on the satellite installation. Active and passive fire protection Primary protection of personnel in case of fire, shall be effective evacuation. As a minimum, the fire fighting equipment shall consist of portable carbon dioxide and powder extinguishers. Escape routes A primary escape route to the boat landing via stairs shall be established. However, ladders can be accepted, if warranted by special circumstances. A secondary escape route to the boat landing shall be established if it can be provided at a distance from the primary escape route that effectively make a contribution to the evacuation options in an emergency situation. Life-saving appliances The installation shall be provided with at least one inflatable life raft to be lowered into the sea and which shall hold the maximum foreseeable crew on the installation. During manning of the installation a motor-driven rubber dinghy shall be available for evacuation of the installation crew. The dinghy shall be in the immediate vicinity of the installation in order that mobilisation of the dinghy will not increase the total time of evacuation. The rubber dinghy shall be able to hold the entire crew on board the installation at any time. Shelter The installation shall have a place at which the crew can take shelter from the rain. A lavatory shall be available.



Helicopter hoisting deck A deck allowing emergency evacuation of personnel to hovering helicopter shall be arranged. Standby vessel A standby vessel shall be available near the installations when it is manned. The vessel shall be equipped with two motor-driven rubber dinghies. The vessel shall have minimum firewater monitor capacity of 2400 m3/h with throw length of 120 m. (Corresponding to DNV Class requirement for Fire Fighter I. )

A2 TYPE B OF NORMALLY NOT MANNED INSTALLATIONS General This section defines the safety system requirements to type B installations. Example Type B Type B, which includes installations with heli deck and which will be manned only under weather conditions that allow safe access to the installations by helicopter and evacuation of the installations by lifeboats. Type B installation will typically be designed with a well head area and manifolds in the well head side of the installation and a utility/shelter area to the opposite side. This area will normally function as a barrier and protect the lifeboat area. The installation will typically be equipped with X-mas trees, a production manifold, a test manifold, a test separator and a pig launcher. The installation will also have a sheltered area with resting facilities. The contr

s-dp-001r2

Documents

safety requirements

general requirements

process safety

safety systems

safety aspects

safety management

common requirements

functional requirements