inherently safer design – case study of rapid blow down on .../media/documents/subject...

SYMPOSIUM SERIES NO. 155 Hazards XXI # 2009 IChemE

INHERENTLY SAFER DESIGN CASE STUDY OF RAPID BLOW DOWNON OFFSHORE PLATFORM

Volton Edwards bpTT

Angus Lyon DNV Energy

Alastair Bird DNV Energy

INTRODUCTIONA term now in common usage within the oil & gas industryis inherently safer design. The objective of this phrase isto promote designs for hydrocarbon extraction and proces-sing facilities that, where practicable, eliminate hazardscompletely or reduce the magnitude of the consequencesof hazard scenarios sufficiently to eliminate the need forelaborate safety systems and procedures.

This paper presents a case study where the principlesof inherently safer design were used to challenge the nor-mally accepted interpretation of the requirements fordepressuring (blow down) systems as set out in the standardAPI STD 521, Pressure-relieving and depressuringsystems, (API 2007).

Offshore oil and gas extraction platforms have hydro-carbon containing equipment onboard. The hydrocarboncontaining equipment has maximum design operating par-ameters, such as a maximum design pressure. Hydrocarbonextraction is a dynamic process. The hydrocarbon contain-ing equipment is generally equipped with sensors whichmonitor the value of parameters, such as pressure. Thesensors often have associated alarms which notify theplant operator that pressure is increasing. The operator canthen take actions to return the parameter to its normalvalue. If the operator intervention fails there is often anexecutive action also attached to the sensor which initiatesa shutdown of the plant before the design limits arereached. In case the shutdown system fails there is often asecondary protection system. In the case of overpressurethis is generally a relief valve that dumps excess pressureto a vent or flare.

As well as the protection systems described above, ablow down system is also generally installed. It has twomain purposes:

1. to reduce the pressure in the hydrocarbon containingequipment to atmospheric pressure to allow for thebreaking of containment for maintenance and otherreasons, and

2. To get rid of hydrocarbon inventory and reduce thepressure in the equipment in the event of an emergencyon the facility.

It is this latter design intent that is the subject ofthis paper.

BACKGROUNDWhen designing pressure-relieving and depressuring (blowdown) systems reference is generally made to API STD 521.

349

API STD 521 is intended primarily for oil refineries; itis also applied to oil and gas production facilities. It givesguidelines examining the principal causes of overpressure;determining individual relieving rates; and selecting anddesigning disposal systems, including such components aspiping, vessels, flares, and vent stacks.

Section 5.20 of API STD 521 which covers vapourdepressuring states:

Depressuring systems can be used to mitigate

the consequences of a vessel leak by reducing

the leakage rate and/or inventory within thevessel prior to a potential vessel failure. More

often, depressuring systems are used to

reduce the failure potential for scenarios invol-

ving overheating (e.g. fire).

If vapour-depressuring is required for both

fire and process reasons, the larger require-

ment should govern the size of the depressuring

facilities.

For pool-fire exposure . . . this generally

involves reducing equipment pressure from

initial conditions to a level equivalent to 50%

of the vessels design pressure within approxi-

mately 15min.

Depressuring to a gauge pressure of 100PSI is

commonly considered when depressuing to

reduce the consequences from a vessel leak.

In addition, BP has a series of engineering technicalpractices with which new platform designs are required todemonstrate compliance. Two which have requirements rel-evant to the subject of this paper are:

1. Guidance on Practice for Inherently Safer Design,(BP 2008), and

2. Fire and Explosion Hazard Management (FEHM) ofOffshore Facilities, (BP 2009)

The inherently safer design technical practice requiresa process to be followed which assesses all hazards and pro-duces a design which, as far as possible, eliminates hazardsor reduces the magnitude of hazard scenario consequencessufficiently to eliminate the need for elaborate safetysystems and procedures.

The fire and explosion hazard management practiceshas a similar intent by requiring a fire and explosionhazard management (HEHM) document to be developedwhich delivers a strategy for each hazard such that major


accidents1 are prevented or adequately managed to assistdemonstrating that sufficient thought has gone into theFEHM the practice defines three hazard categories:

1. Controllable hazards2

2. Evacuation hazards3

3. Catastrophic Hazards,4

and requires that every fire and explosion hazard scenario onthe facility is categorized as above. Clearly the desiredoutcome is that where practicable all Fire and Explosionhazard scenarios are categorized as Controllable hazards.This is in line with the intent of Inherently Safe Design.

BPTT has recently commissioned a series of smallnormally unmanned installations (NUIs) (46 wells). Theinitial platforms had their blow down systems deigned toreduce the operating pressure to 50% within 15 min. in com-pliance with the perceived requirements of API STD 521.

CHALLENGE TO THE BLOW DOWN

SYSTEM DESIGNThe perception that designing the blow down system toachieve 50% reduction in operating pressure in 15 min. isoptimum was challenged for the most recent platformdesign in the series. The challenge was based on:

1. It ignores the fact that the platforms are producing gasand not oil and pool fires are not therefore a crediblefire scenario,

2. It ignores the possible benefits of depressuring on redu-cing the consequences of unplanned process releasesfrom whatever cause.

3. Does it meet the principle of inherently safe design? and4. Have the maximum number of fire and explosion

hazard scenarios been categorized as controllable?

To assess whether the challenge was justified the fol-lowing questions were addressed:

1An ev2Hazar

Precau3Hazar

ual imp

after a

area).4Hazar

cannot

be con

perform

Does a more rapid blow down system produce

an inherently safer design?

Does a more rapid blow down system signifi-

cantly impact the number of controllable

hazard scenarios?

Is a more rapid blow down system

practicable?

ent that can lead to multiple fatalities.

d scenarios that allow personnel to remain safely on the facility .

tionary evacuation may take place if it is safe to do so.

d scenarios which have the potential to escalate and cause event-

airment of the protected muster area and evacuation facilities

period of time (e.g. endurance period of the protected muster

d scenarios which preservation of life of personnel on facility

be demonstrated and the effects of the hazard scenario cannot

trolled or mitigated such that controlled evacuation can be

ed.

350

ASSESSMENT METHODThe assessment was based on evaluating the impact on theconsequences of leaks from the process equipment ratherthan protecting the equipment from overpressure in a firescenario. In particular, the impact on the escalation potentialof fire and explosion hazard scenarios was evaluated as thisis the primary criterion for distinguishing controllable fromevacuation hazard scenarios.

If a process release on the platforms under studyignites early, it is characterized by a jet fire and if theignition is delayed, a vapour cloud explosion will occur,possibly followed by a jet fire.

Escalation can be through failure of other processequipment or structures with the explosion.

There are many references which give details ofimpacts of fires on components, characteristics of jet firesand rules of thumb regarding the time taken for items tofail under fire loading and explosion overpressure. The fol-lowing is typical and reproduced from Spouge 1999.

Figure 1 demonstrates that steel loses it strength atelevated temperatures.

A point in time is reached when the heat absorbed bythe steel component reduces its strength to the point atwhich the stress in the component5 is greater than theremaining strength of the steel and the component fails.The greater the heat flux from the fire the quicker it will fail.

The heat flux at the boundary of a gas jet flamedepends on the composition of the gas and other factorsbut is of the order of 200300 kW/m2. This value dropsof dramatically with distance from the flame as shown inFigure 2.6

Figure 1. Steel strength v. temperature (Spouge 1999)

5Either from a structural load or internal pressure.6The heat flux at the flame boundary of a liquid pool fire is significantly

less, approximately 150 Kw/m2.

Figure 2. Scale diagram of heat flux from a gas jet fire


Typical failure time for components is presentedin Table 1.

From Table 1 it can be seen that the failure times ofcomponents are significantly shorter if engulfed in theflame. For example, pipes and vessels can be expected tofail after 5 minutes if engulfed in a jet fire, but would lastfor 60 minutes if the flame is very close but not engulfing.

This information was used to establish a simple esca-lation rule set as follows7:

7Assum8The le

point in9Flame

Escalation to process equipment and struc-

tures occurs if the component is engulfed in a

jet flame for more than 5 minutes

When a system containing pressurized gas leaks isisolated, the leak release rate and associated jet flamelength decay exponentially. If the system is equipped witha blow down system its activation removes gas from thesystem, reducing the system pressure, and thus reducingthe leak release rate8 and associated jet flame length. Thisis shown diagrammatically in Figure 3.

A simple spreadsheet was prepared to model leakrelease rate versus time for given blow down rates andleak holes sizes using the Chamberlain flame length corre-lation.9

Leaks can vary in equivalent hole size and are oftencharacterized under the titles of small, medium and

ing no passive fire protection or active water cooling.

ak release rate is a function of the pressure in the system at any

time.

length (m) 11.14Q0.447 Q release rate (kg/sec).

351

large10 for the purpose of risk assessments. Statisticallythe chance of small leaks predominates. The modelingwas based on the most likely hole size (small).

Screens shots of the spreadsheet model are presentedin Appendix A.

Figure A1 displays the spreadsheet with the systemoperating pressure and inventory volume of the platformsdiscussed in this paper. The blow down is modeled basedon reducing operating pressure to 50% in 15 minutes.

Figure A2 is the same spreadsheet with the same blowdown characteristics and a 10 mm dia. leak. From Figure A2it can be seen that with blow down11 the flame length startsat approximately 10.8 m in length, after 5 mins. It is 9.3 mand after 20 mins. It is still 6m in length. This is a significantflame size.

In an ideal world, provided that isolation and blowdown are successful, all escalations due to fires would beavoided. In reality this requires reducing the jet fire lengthto less than, says, 1m after 5 minutes.12 To achieve thisrequires an initial blow down rate of 41 Kg/sec (seeFigure A3).

The larger the initial blow down rate, in general, thefurther the tip of the blow down vent needs to be to theboundary of the platform to ensure that:

. flammable gas clouds cannot be blown back onto theplatform during a blow down and,

. If the vent discharge ignites the level of thermal radi-ation at the boundary of the platform is within accepta-ble levels.

In practice, achieving an acceptable vent design for41 Kg/sec proved impracticable, primarily because the plat-form design was one of a series of clone designs and therequired location of the vent tip would have required a com-plete structural redesign of the topsides. A compromise wasreached which reduced system pressure as quickly as poss-ible, commensurate with an initial blow down rate thatallowed a vent to be designed without a total topside struc-tural redesign. The initial blow down rate selected wasapproximately 16 Kg/sec which reduces flame length toapproximately 5 m after 5 mins and 1 m after 15 mins (seeFigure A4).

EVALUATION OF INCREASED SAFETY

ASSOCIATED WITH THE INSTALLED

BLOW DOWNAlthough not ideal, the compromise initial blow down ratereduces the severity of process fires associated withsmall releases measurably. What impact does this haveon safety?

One of the main driving forces behind this initiativewas to influence the decisions that the offshore installation

10Small leaks 10 mm dia.; medium: leaks 25 mm dia.; large

leaks 100 mm dia.11It is assumed that isolation has occurred.12The actual desired flame length is dependent on the distance of critical

equipment to leak sources.

Table 2. Hazard scenario totals

Hazard scenario

category

Slow blow

down

Rapid blow

down

Controllable 28 42

Evacuation 95 71

Total 113 113

Figure 3. Leak Release rate with Blow down

Table 1. Typical component failure time from fire loading (Spouge 1999)

Component Type of failure

Times to failure (minutes)

Jet flame Pool flame 37.5 kW/m2

Steel plate Yield 1 3 20

Steel plate Fire penetration 5 10 60

Steel beam Yield 1 2 60

Steel beam Collapse 5 10 120

Jacket leg Buckling 15 30 150

Pipe/riser/process vessel Rupture 5 10 60A rated fire wall Fire penetration 15 45 70

H rated fire wall Fire penetration 100 260 400


manager (OIM) must make subsequent to a confirmedprocess release on his/her facility. Soon after the releaseevent the OIM must decide whether to keep personnel onthe facility or carry out a precautionary evacuation.

Evacuation via lifeboat, or other means such as barrelrafts, have their own set of hazards and are not risk free. It isnot a decision to that should be made lightly.

One of the main considerations that the OIM will basehis/her decision on is whether the event is controllable,i.e. are the characteristics of the event such that, providedpersonnel are protected from the immediate effects, theoverall integrity of the facility will not be compromised,in other words the event will not escalate.13

This fits neatly with the BP requirement to categoriseall fire and explosion hazard scenarios as described inSection 2. The difference in the number of controllableand evacuation hazard scenarios was therefore evaluatedas a measure of improved safety.

Quantified risk assessments (QRAs) have beencompleted for the clone design NUI platforms. The QRAsevaluate all14 fire and explosion hazard scenarios. The

13Escalation is the failure of critical equipment e.g. other pipes, vessels,

key structural members or evacuation equipment.14Various leak hole sizes and leak locations within the process area.

352

chance of each of each hazard scenario escalating isassessed as part of the QRA. A sensitivity was run on theQRA model simulating the more rapid blow down. Thechange in risk values and the change in number of fire andexplosion hazard scenarios categorized as controllableand evacuation15 were calculated.

The number of fire and explosion hazard scenariosthat change their category due to the rapid blow down isshown in Table 2.

The Rapid blow down reduces the number of eva-cuation hazard scenarios by 24 representing a reductionof 25%. The increase in the number of controllable fire& explosion hazard scenarios demonstrates a meaningfulcontribution to an inherently safer design.

DISCUSSIONThe initial blow down rate is not the only variable that influ-ences the number of controllable hazard scenarios. Thevolume of the inventory isolated when shut-in also has a sig-nificant impact. If, for example, the isolated inventory wasreduced by one third, the flame length after 5 minuteswould be reduced to 1m rather than the 5 m with therevised blow down rate.16 The reason for discussing thisvolume is because the present design of the NUI platformshas emergency shut-down valves at the wells and exportriser. The topside is effectively a single inventory. There

15Evacuation hazard scenarios include fire & explosion hazard scen-

arios with the potential to escalate.16Based on a 10 mm dia. leak.


are two manifolds which have manual isolation valves sep-arating them from the remainder of the topside pipe-work.17

Both manifolds and the topside pipe-work have blow downvalves installed. If these isolation valves were actuated andtied into the shut-down system there would have been threeisolatable sections each with approximately one third of theinventory.

As can be seen form the above when developing thehazard management strategy for process fires there isvalue in considering variations in both blow down character-istics and isolation philosophy.

One item not discussed so far which should not beoverlooked when developing the design of a blow downsystem is the effect that rapid blow down has on the temp-erature of the hydrocarbon, both upstream and downstreamof the blow down valves. Very low temperatures can be gen-erated at high blow down rates and appropriate pipe and

17Used to isolate a manifold for maintenance purposes.

353

vessel materials must be selected. The previous ventdesign used material good for 2208F. During a rapidblow down the gas temperature was calculated to drop to2608F. However detailed heat transfer calculationsdetermined that the steel wall temperature never droppedbelow 2408F. Material suitable for 2408F was procuredfor the vent.

REFERENCESAPI 2007, Pressure-relieving and Depressuring Systems, Stan-

dard 521

BP 2008, Inherently Safer Design bp Group GP 48-04

BP 2009, Fire and Explosion Hazard Management (FEHM) of

Offshore Facilities GP24-20

Spouge, John 1999, A guide to Quantified Risk Assessment for

Offshore Installations CMPT publication 99/100a


APPENDIX A: BLOW DOWN SPREADSHEET

SCREEN SHOTS

Figure A1. Blow down to 50% of Operating Pressure in 15 mins.

354

Figure A2. Blow down to 50% of Operating Pressure in 15 mins. 10 mm dia. leak


355

Figure A3. Rapid blow down


356

Figure A4. As installed blow down


357

INTRODUCTIONBACKGROUNDCHALLENGE TO THE BLOW DOWNSYSTEM DESIGNASSESSMENT METHODEVALUATION OF INCREASED SAFETYASSOCIATED WITH THE INSTALLEDBLOW DOWNDISCUSSIONREFERENCESAppendix A: Blow down spreadsheet screen shotsFigure 1Figure 2Figure 3Figure A1Figure A2Figure A3Figure A4Table 1Table 2

/ColorImageDict > /JPEG2000ColorACSImageDict > /JPEG2000ColorImageDict > /AntiAliasGrayImages false /CropGrayImages true /GrayImageMinResolution 300 /GrayImageMinResolutionPolicy /OK /DownsampleGrayImages true /GrayImageDownsampleType /Bicubic /GrayImageResolution 300 /GrayImageDepth -1 /GrayImageMinDownsampleDepth 2 /GrayImageDownsampleThreshold 1.50000 /EncodeGrayImages true /GrayImageFilter /DCTEncode /AutoFilterGrayImages true /GrayImageAutoFilterStrategy /JPEG /GrayACSImageDict > /GrayImageDict > /JPEG2000GrayACSImageDict > /JPEG2000GrayImageDict > /AntiAliasMonoImages false /CropMonoImages true /MonoImageMinResolution 1200 /MonoImageMinResolutionPolicy /OK /DownsampleMonoImages true /MonoImageDownsampleType /Bicubic /MonoImageResolution 1200 /MonoImageDepth -1 /MonoImageDownsampleThreshold 1.50000 /EncodeMonoImages true /MonoImageFilter /CCITTFaxEncode /MonoImageDict > /AllowPSXObjects false /CheckCompliance [ /None ] /PDFX1aCheck false /PDFX3Check false /PDFXCompliantPDFOnly false /PDFXNoTrimBoxError true /PDFXTrimBoxToMediaBoxOffset [ 0.00000 0.00000 0.00000 0.00000 ] /PDFXSetBleedBoxToMediaBox true /PDFXBleedBoxToTrimBoxOffset [ 0.00000 0.00000 0.00000 0.00000 ] /PDFXOutputIntentProfile () /PDFXOutputConditionIdentifier () /PDFXOutputCondition () /PDFXRegistryName () /PDFXTrapped /False

/Description > /Namespace [ (Adobe) (Common) (1.0) ] /OtherNamespaces [ > /FormElements false /GenerateStructure false /IncludeBookmarks false /IncludeHyperlinks false /IncludeInteractive false /IncludeLayers false /IncludeProfiles false /MultimediaHandling /UseObjectSettings /Namespace [ (Adobe) (CreativeSuite) (2.0) ] /PDFXOutputIntentProfileSelector /DocumentCMYK /PreserveEditing true /UntaggedCMYKHandling /LeaveUntagged /UntaggedRGBHandling /UseDocumentProfile /UseDocumentBleed false >> ]>> setdistillerparams> setpagedevice

inherently safer design – case study of rapid blow down on .../media/documents/subject...

Documents