Embed Size (px)
Citation preview
Fire Safety Journal 58 (2013) 160–169
Contents lists available at SciVerse ScienceDirect
Fire Safety Journal
0379-71
http://d
n Corr
E-m
journal homepage: www.elsevier.com/locate/firesaf
A risk-based method for determining passive fire protection adequacy
Arshad Ahmad n, Siti Ayesah Hassan, Adnan Ripin, Mohamad W. Ali, Saharudin Haron
Institute of Hydrogen Economy, Faculty of Chemical Engineering, Universiti Teknologi Malaysia, 81310 Johor Bahru, Malaysia
a r t i c l e i n f o
Article history:
Received 11 May 2012
Received in revised form
18 October 2012
Accepted 20 January 2013
Keywords:
Risk-based design
Passive fire protection
QRA
Emergency evacuation time
Offshore platform
12/$ - see front matter & 2013 Elsevier Ltd. A
x.doi.org/10.1016/j.firesaf.2013.01.020
esponding author. Tel.: þ607 5535610; fax:
ail address: [email protected] (A. Ahma
a b s t r a c t
A risk-based approach to determine the adequacy of designed safety barriers in process plants is
proposed and implemented to an offshore gas production platform. The scheme employs quantitative
risk assessment method to assess the impact of selected process hazards and the adequateness of safety
barriers based on a selected ALARP threshold value. The results obtained are further verified using
emergency evacuation response analysis. Evaluations carried out on the designed fire/blastwalls for the
selected case study confirmed the suitability of the proposed method.
& 2013 Elsevier Ltd. All rights reserved.
1. Introduction
Firewall and blastwall are examples of important layers ofprotection in offshore facilities that must be made adequate tosatisfy the robust design requirement. This is important becausehydrocarbon fires can elevate the temperature of unprotectedloaded steel structures to 1100 1C within minutes, leading tostructural collapse due to loss of strength. In addition to directdamages such as injuries, fatalities and asset losses, accidentsescalation into severe scenarios can have more detrimental effects[1,2]. Typically, fire resistance can be established by adding fire/blastwall with suitable insulation materials or coatings on struc-ture surfaces to reduce the rate of heat transfer to steel surfacesand minimize flame propagation [3].
As part of the safety best practices, API RP 14J recommendedthat a firewall or adequate space should be considered to separateliving quarters from areas containing hydrocarbon sources and ifhigh risk process spaces are confined, blast protection should beconsidered. However due to limitations such as availability ofmaterials according to the desired specifications as well as timeand budget constraints, direct application of the worst casescenario requirement is often found to be impracticable to theoverall cost benefit, and some forms of risk assessment arerequired. Owing to this need, various risk assessment methodol-ogies have been used throughout the planning and design period[4,5] assisted by commercial software [6].
While a full blown QRA provides all the necessary insightsrequired to guide the design, the level of details needed for a QRA is
ll rights reserved.
þ607 5588166.
d).
often not available until the project is well into the detailed designphase. This entailed simplified and less complex methods so thatsafety concerns can be identified earlier and embedded inherentlythroughout the project phases. Krueger and Smith [7] proposed asimplified scenario-based methodology for fire risk analysis thatcan be applied early in the design cycle, but their analysis is onlyuseful for preliminary purposes. Shetty et al. [8] described ascheme that integrates the structural reliability analysis withQRA. In this work, models and tools on fire and blast loading arepresented and method for estimation of failure frequencies ofcomponents and systems for which historical data are not availableis proposed. More detailed analyses using finite elements forstructural analysis [9], and CFD to study impact of fire andexplosions [10–12] on offshore facilities have also been reported,but the approach is far too demanding for smaller projects.
More recently, a seven step risk-based method to allow a moredetailed identification of the reference accident scenarios consideredfor the identification of fire protection zones has been proposed [13].However, while their conclusion was positive for on-shore facilities,the application to offshore structures with limited space availabilityis still uncertain. The aim of this paper is to provide a methodologyfor making a quick judgment required especially for fast trackprojects. The approach of Dey [14] is adopted with modificationsto accommodate the needs of offshore facility as opposed to thenuclear industry. The methodology is demonstrated using a casestudy involving an offshore gas platform.
2. Framework of coarse risk-based method
The proposed framework applies QRA concept to provideanalysis-matching-the-needs requirement for fast-track projects.
Fig. 1. Study methodology (Reproduced from [15]).
A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169 161
The method demonstrates the use of ALARP region as one of thedesign decision tools in evaluating the safety layer proposed. Theframework is as summarized in Fig. 1. The steps include [15]:
�
System definition with regards to fire and explosion crediblehazards on the installation that may be capable of threateninglife or platform integrity; � Identification of areas and isolatable segments of hydro-carbon inventory in process piping and equipments, i.e. iso-lated inventories between the Emergency Shutdown Valves(ESDVs);
� Release or discharge calculation according to probable leaksizes (categorized into ‘Small’, ‘Medium’ and ‘Large’);
� Frequency assessment to estimate the initial frequency (i.e.,hydrocarbon leak/release frequency), which will be used askey inputs to Event Tree Analysis (ETA);
� Consequence modeling to analyze fire and explosion impactson topsides and riser/pipeline;
� Carry out fire and explosion probabilistic analysis and EventTree Analysis (ETA);
� Carry out probabilistic impairment assessment against fireand blast rating (i.e. J15, H60 and 0.4 barg) using second levelof Event Tree Analysis (ETA); and
� Results and recommendations of the analysis suggestingalternative approach of analysis.
The results of the analyses are further verified using the Escapeand Evacuation Response (EER) methodology. The indicator, theEER time is defined as the required travel time from the workingarea to a ‘safe place’ during major accident event.
3. Case study: offshore gas platform
The objective of the case study is to demonstrate the use of theproposed framework in a real case situation. As an example, theadequacy of a proposed fire/blastwall in an offshore gas produc-tion platform is investigated. The platform is located in a gas fieldwith 60 m water depth, and is meant to export gas and con-densate to an onshore reception facility located more than100 km away. The platform is equipped with living quarters and
fitted with process facilities and utilities system. The processingunits include:
�
Separation system; � Gas compression system; � Fiscal metering facility for sales gas and condensate; � Pig launcher; � Condensate export pumps; � Fuel gas treatment system; � Seal gas system; � Flare system; and � Diesel storage and distribution system.3.1. Basis of fire/blastwall impairment criteria
The following impairment criteria of fire/blast are laid for theanalyses:
�
Fire wall (J15 and H60 rated)1) Criterion ‘‘FW1’’: The wall is impinged by jet fire forcontinuous 15 min; or the wall is exposed to pool firecontinuously for 60 min;
2) Criterion ‘‘FW2’’: The impairment frequency of the firewall(i.e. the total escalation frequencies of the fire events thatcan impinge onto the firewall) is not exceeding 1�10�4
per year [16].
�
Fire/blast wall (J15, H60 and 0.4 barg explosion rated)1) Criterion ‘‘FBW1’’: The wall is impinged by jet fire forcontinuous 15 min; and the wall is exposed to pool firefor continuous 60 min; and the wall is exposed to anexplosion overpressure of more than 0.4 barg;
2) Criterion ‘‘FBW2’’: The impairment frequency of thefire and blastwall (i.e. the total escalation frequencies ofthe fire and explosion events that can impinge or exposeonto the fire and blastwall) is not exceeding 1�10�4 per
year [16].
Table 1Release hole sizes.
Release type Hole sizes (mm) Representative hole sizes (mm)
Process equipment
Small 3–10 10
Medium 10–50 30
Large 50–150 100
Riser/pipelines
Small 0–20 10
Medium 20–80 50
Large 480 350
A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169162
The acceptance criterion of the fire wall and blast wall is eitherCriterion 1 or Criterion 2 is met, which in turn, concludes the firerating and blast rating on the fire wall and blast wall as adequate.
3.2. Accidental event process releases
The statistic report published by UK HSE [17] gives distribu-tion for 7 hole size groups (i.e. o10 mm, 10o25 mm,25o50 mm, 50o75 mm, 75o100 mm, Z100 mm and ‘‘NotApplicable’’), while CMPT [15] suggests that the typical hole sizesare approximately 5 mm, 25 mm and 100 mm for small, mediumand large releases respectively. For the analysis to be conserva-tive, calculation for process accidental releases is performed usingthe representative hole sizes listed in Table 1. In determining thevolume and duration of hydrocarbon releases from isolatablesegments, Emergency Shut Down Valve (ESDV) closure time isincorporated.
3.2.1. Release duration
During an accidental release of a leak scenario, pressure insidethe vessel or segment is anticipated to reduce with time. Hence,the release of hydrocarbons is modeled as a time-varying dis-charge taking into consideration pressure drops and the effect ofblowdown. In order to accurately calculate the release durationthat can give significant impact to personnel, releases below2 barg are neglected. The limit of 2 barg is selected in line withrelief valve back-pressure nominal setting based on API RP 520.
3.2.2. ESDV closure time
It is assumed that the ESDV’s in process lines will close (i.e.isolation successful) and isolate the hydrocarbon event inventoryon confirmed fire or gas detection. The time required for anysafety device to affect component or platform shutdown shouldnot exceed 45 sec. Whenever, ESDV is activated, process inputsare shut-off at the primary source (wells, pump, compressor, etc).This would be repeated for each component back through theprocess until the primary source is shut in, i.e. via a cascadingflow [18]. In practise, actual timings are expected to be quicker.
3.2.3. Release calculations
Most of potential jet fire releases in the category of ‘Small’leaks could result in hydrocarbon discharge at t¼15 min, whilethe ‘Large’ releases at t¼15 min only lead to ‘Flare’ and ‘Riser’segments. For the liquid segment, the discharge pressure of theaerosol is according to pumping pressure until the last drop ofliquid, as such, there would be no difference in discharge condi-tions at 15 or 60 min.
The size of explosion corresponds to the congestion varies tothe leak module. The volume discharge is taken to be instanta-neous at ‘delayed’ scenarios. This is defined as ‘Used of FlammableMass’, i.e. mass the will be burned out between UFL and LFL.
3.3. Consequence assessment
3.3.1. Assumptions
The potential accidental scenarios included in the assessmentare jet fire, pool fire and vapor cloud explosion. Since Closed/OpenDrain System has minimal hydrocarbon inventories compared tolarge vessels such as separators and fuel gas scrubbers duringnormal operations, it is not assessed in this study. The flaresystem is included since it is normally filled up with large amountof hydrocarbon in the event of upset or emergency depressuriza-tion condition, but is limited to the section from the flare KOdrum to the flare tip. All drain and vent piping from the processareas are also excluded as they have significantly lower inventorycompared to the KO drum. For the Diesel Storage & DistributionSystem, since it is a stand-alone system, used for crane operationonly consequences from the diesel storage tank are assessed toprovide late pool fire consequence to firewall (H60 rating).
The hydrocarbon fire and explosion outcomes (i.e. flame durationsand blast effects) are assumed equivalent to the rating of fire proofingmaterials established by Underwriter Laboratory (UL), which is anindependent certification body accredited by the US OccupationalSafety & Health Administration (OSHA), the American NationalStandards Institute (ANSI), and the Standards Council of Canada(SCC). Exceptional to J class division (i.e. jet fire outcome), fire testis performed based on UK HSE established document (OTI 95634) asthis test is more appropriate for intense severe hydrocarbon fires.
The following conditions are used in all analyses:
�
Isolation and/or blowdown is successful. � Leaks from both the gas and two-phase segments (e.g. wellfluids) are treated as vapor releases as the lighter hydrocarbonhas a higher molar volume.
� Jet fire at immediate ignition. If the jet impinges on asufficiently large object, e.g. a solid deck/equipment, themomentum in the jet will be wholly or partially lost and adiffusive fire will occur. If delayed ignition occurs and the gasrelease is allowed to accumulate, there is a potential for a flashfire or explosion. However, no flash fire has been specificallymodeled as the effects of explosion would be more dominantin term of consequences due to higher degree of confinementbetween the decks.
� Late pool fires at delayed ignition, in which a bigger pool isformed. The pool fire center is assumed to be located at therainout point.
� Multi-Energy explosion at delayed ignition, in which considersdegree on confinement.
3.3.2. Results
The well fluid produced at the facility contains 0.99 gaseousfractions of mixture Methane and Ethane components at approx.22 1C and 92 barg. All the deck floors are plated except at thelowest level reaching Splash Zone area. The potential fire andexplosion scenarios takes into account the well fluid compositionand equipment arrangement on the platform. The results of theconsequence analyses are summarized as follows:
�
Large hydrocarbon leak from the topside riser produces thelongest jet flame on the facilities; � Due to the relatively low inventory within the segment(exceptional to Riser events), the fire only lasts for less than5 min for medium and large releases;
� Most of the medium and large jet fires can lead to 37.5 kW/m2heat radiation level during initial release. However, it should
TabFire
P
M
M
M
M
M
M
T
T
M
C
C
SC
M
C
M
M
C
SC
SZ
T
Not
‘‘S’’
‘‘–’’
Exp
A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169 163
be noted that these events are located within the process area,where there is a firewall and/or fire/blastwall that separatesthe living quarter, enclosure area and process area. Althoughthere may be escalation within the local area, escalation to thearea behind the firewall and fire/blastwall is not anticipated tooccur immediately;
� The hazard range for 15 min of jet fires from the gas segmentsdrops significantly due to the effect of blowdown, thereforemost of these releases do not lead to 37.5 kW/m2 heatradiation level at 15 min;
� Condensate releases from the bottom of Production Separatorand condensate piping are modeled as jet fires due to largepressure difference between the pressure inside vessel andatmospheric pressure, which leads to the flashing of condensateinto vapor form and subsequently turn into jet fire when ignited;
� Pool fire is only anticipated when there is an ignition of dieselnear to the diesel storage tank;
� Immediate ignition due to the rupture of riser or duringblowouts can result in fireballs, which give significant hazardrange and impact to the facilities;
� Explosion due to delayed ignition of large gas releases arepossible. Rupture of the riser at the topside gives the worstoverpressure hazard range on the process facility due to thehigher degree of confinement on topsides, and its largehydrocarbon inventory.
3.4. Frequency analysis
Fire and explosion barriers considered in constructing eventtrees for quantifying fire and explosion frequencies are as follows:
i.
r
D
D
D
D
D
D
o
e
,
Ignition probability. The probability of ignition is taken fromthe Ignition Probability Review, Model Development andLook-Up Correlations, IP Research Report [19]. This reportevaluates the UK offshore industry OIR12 data, as a basis todevelop an improved ignition model for use in QRA.
le 2and explosion frequencies.
ocess events Event location—Segments Fire frequenci
S
DP/GMET/G Cellar Deck—Production Manifold 1.37E-06
DP/INPROD/W Main Deck—Production Manifold 1.99E-07
DP/PRODSEP/W Main Deck—Production Separator 5.89E-07
DP/PRODSEP/G Main Deck—Production Separator 8.96E-06
DP/PRODSEP/O Main Deck—Production Separator 5.85E-07
DP/GCOMP1/G Main Deck—Gas Compression Train 1 9.21E-06
/GCOMP1/G Top Deck—Gas Compression Train 1 2.15E-06
/GMET/G Top Deck—Gas Metering Skid 2.49E-06
DP/GMET/G Main Deck—Gas Metering Skid 1.37E-06
P/GMET/G Cellar Deck—Gas Metering Skid 9.62E-07
P/EXPORT/G Cellar Deck—Export pipelines 8.60E-06
D/EXPORT/G Sub Cellar Deck—Export pipelines 1.83E-06
DP/COND/O Main Deck—Condensate lines 1.56E-06
P/COND/O Cellar Deck—Condensate lines 8.90E-06
DP/FUELG/G Main Deck—Fuel Gas Skid 1.12E-05
DP/SEALG/G Main Deck—Seal Gas Scrubber, Filter 1.18E-05
P/FLARE/G Cellar Deck—Flare Header, KO Drum 4.16E-06
D/GRISER/G Sub-Cellar Deck—Gas Export Riser 1.62E-06
/GRISER/G Splash Zone—Gas Export Riser 3.88E-07
tal frequencies 7.77E-05
:
‘‘M’’ and ‘‘L’’ denote ‘‘Small’’, ‘‘Medium’’ and ‘‘Large’’ accidental leak sizes.
is denoted for explosion scenario which are not anticipated in some event scenari
losion scenarios are not anticipated in some of event scenarios due to the open na
ii.
es (p
M
5.
7.
3.
4.
3.
4.
9.
1.
7.
4.
4.
9.
8.
5.
6.
7.
2.
2.
7.
4.
os d
ture
Early detection. It is assumed that all medium and largereleases are successfully detected. The probabilities assumedfor medium and large releases are based on a target SafetyIntegrity Level (SIL) of 2 for the detector system, which is theminimum requirement as according to IEC 61511. SIL 2 impliesan on-demand failure probability between 0.001 and 0.01. Tobe conservative, a probability of 0.01 has been assumed,which is appropriate as it is possible that the release mayoccur at a location where it is not in the line-of-sight to thegas detection, leading in failure to detect the leak.
iii.
Explosion overpressure. The explosion probability given adelayed ignition is calculated by using NOBRA (NOrsokBRAnch probabilities). NOBRA is a spreadsheet tool that isused to provide estimates of exceeding an explosion over-pressure given delayed ignition in offshore installations. Theeffect of key parameters such as release rate, module volume,degree of confinement and degree of congestion are included.iv.
Isolation/blowdown failure. Should a leak be detected, themain process unit will be isolated by closing ESDVs in order tolimit the release of inventories. The ESDVs are normally fail-close; hence it is assumed that if the ESD control system fails forsome reasons, the valve will close automatically. For this reason,no common mode failure is assumed whereby all the ESDV failsclose. However, there is still a possibility having individual ESDVto fail-to-close on demand. The on-demand failure probability ofESDV used in this analysis is based on OREDA [20], i.e. 0.02 for allsizes. The same reasoning applies to the on-demand failureprobability of blowdown valves for all sizes.3.4.1. Leak frequencies
The leak frequencies are calculated for each isolatable segmentcomponents lined-up according to the number and size of valves,flanges, instrument connections, vessel and piping together withdimensions, pressure and phase of the hydrocarbon inventory.The data used for process equipment are based on the UK HSEHydrocarbon Release Database [17], but for riser/pipeline the dataare based on PARLOC 2001 data source. The outcomes leak
er year) Explosion frequencies (per year)
L S M L
83E-07 4.33E-08 – – 6.56E-09
55E-08 1.65E-08 – – 2.90E-09
14E-07 1.87E-08 – – 3.07E-07
56E-06 7.88E-07 – – 1.29E-07
07E-07 - – – –
28E-06 4.74E-07 – – 7.37E-08
94E-07 1.96E-07 – – –
09E-06 1.74E-07 – – –
97E-07 2.04E-08 – – 2.83E-09
17E-07 7.29E-08 – – 7.89E-09
68E-06 6.92E-07 – – 7.78E-08
90E-07 3.53E-08 – – 5.03E-10
21E-07 - – – –
83E-06 – – – –
37E-06 1.19E-06 – – –
61E-06 – – – –
53E-06 – – – –
37E-07 1.62E-07 – – 1.52E-09
42E-08 1.24E-06 – – 8.60E-09
26E-05 5.12E-06 – – 6.18E-07
ue to open nature and limited equipment available on platform’’.
and limited equipment available on the platform.
A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169164
frequencies serve as an input to First Level of Event Tree, which isused for quantification of fire and explosion frequencies.
3.4.2. Fire and explosion frequencies
The fire and explosion frequencies are estimated using ETAand presented in Table 2. For each event, the fire and explosionfrequencies are the summation of frequencies resulting fromIsolation Successful (denotes ‘IO’) and Blowdown Successful(denotes ‘BO’). For example as displayed in Fig. 2, the (Event
4.40E-0Y 0.1
4.40E-06Y 1.00E-03
3.96E-0N 0.9
4.40E-03 4.35E-03Y 0.99
2.81E-07Y 0.2675
4.39E-03 1.05E-06N 9.99E-01 Y 0.0239 7.69E-0
Y 0.1
7.69E-07N 0.7325
4.39E-05N 0.01 6.92E-0
N 0.9
4.29E-05N 0.9761
Lea
k Fr
eque
ncy
Imm
edia
teIg
nitio
n
Ear
lyD
etec
tion
Del
ayed
Ig
nitio
n
Exp
losi
on
Poss
ible
?
Isol
atio
n
Fig. 2. Fire and explosion frequencies (Sample
CDP/INPROD/W Small release) has a fire frequency of 1.08E-06per year. The results show that ‘Small’ leak size are dominatingthe total leak frequencies, and the cumulative leak frequenciesestimated for process/topsides and riser/pipeline events are6.72E-02, 4.02E-02 and 4.56E-03 per year for Small, Mediumand Large leaks respectively.
In this study, the ETA conducted at this stage is referred to asFirst Level ETA. Summing up all events, the total fire frequenciesestimated for the platform are 7.77E-05, 4.26E-06 and 5.12E-06
8.79E-09 8.79E-09Y 0.02
7
4.31E-07 4.31E-07N 0.98
7.91E-08 7.91E-08Y 0.02
6
3.88E-06 3.88E-06N 0.98
4.35E-03 4.35E-03
2.81E-07 2.81E-07
1.54E-09 1.54E-09Y 0.02
8
7.53E-08 7.53E-08N 0.98
1.38E-08 1.38E-08Y 0.02
7
6.78E-07 6.78E-07N 0.98
4.29E-05 4.29E-05
Explosion Delayed
Jet/Flash Fires Delayed
Jet/Flash Fires Delayed
Jet/Flash Fires Delayed
Jet/Flash Fires Delayed
Unignited Release
Unignited Release
Jet Fires Intermediate
Jet Fires Intermediate
Jet Fires Intermediate
Jet Fires Intermediate
Failu
re
Blo
wdow
n Fa
ilure
Out
com
eD
escr
iptio
n
Freq
uenc
y
for Event CDP/INPROD/W Small Release).
Fig. 3. Second level firewall event tree (Sample for Event MDP/GMET/G Small Release).
Table 3Impact assessment results.
‘Target’ Summation of fire
impairment frequencies
Summation of blast
impairment frequencies
Criterion ‘‘FW1’’
(See Section 3.1)
Criterion ‘‘FW2’’
(See Section 3.1)
Fire/blast rating adequate?
Firewall at living quarter and main deck 1.2E-07 0.0Eþ00 N N Y
‘Target’ Summation of fire
impairment frequencies
Summation of blast
impairment frequencies
Criterion ‘‘FBW1’’
(See Section 3.1)
Criterion ‘‘FBW2’’
(See Section 3.1)
Fire/blast rating adequate?
Fire/blastwall at main deck 1.4E-07 1.4E-08 Y N Y
Fire/blastwall at cellar deck 6.1E-07 1.4E-08 Y N Y
Fig. 4. Location of points (A)–(D).
A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169 165
A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169166
for Small, Medium and Large leaks respectively. This is higherthan the expected total explosion frequency, which is in themagnitude of 10�7 per year.
3.5. Impairment assessment
The impairment assessment only takes into account eventswith resulting consequences that exceed the acceptance criteria,i.e. leak duration beyond 15 min and 60 min for jet fire and poolfire events respectively, and event resulting in explosion over-pressure of more than or equal to 0.4 barg. At this step, ETA isused again (referred to as Second Level ETA) to screen events thatmeet the criteria. An example of a Second Level ETA showing theevent (MDP/GMET/G Small Release) is depicted in Fig. 3. It isdeveloped based on information derived from flame length orpool diameter or explosion radii reaching the ‘target’, obstructionof other equipment or decks floor and flame width or diameteraccording to 3601 radius direction of impingement.
Fig. 5. Sequence of evacuation (Reproduced from [21]).
Fig. 6. Top deck (Evacuat
For the blast wall, the Second Level ETA is generated byintegrating an overpressure level of 3 barg where deck flooringand pipe works/supports are considered blown-off, thus creatingmissile effects. The purpose is to estimate the likelihood ofimpairment for the firewall and blastwall and whether or not itmeets the impact assessment criteria laid in Section 3.1. Theresults are presented in Table 3, and based on these values, thefire and blast ratings on fire/blastwall are deemed adequate.
3.6. EER analysis
The proposed simplified QRA based method presented in theabove has proved that the PFP ratings are in line with ALARPrequirements. In this section, the PFP ratings are compared with analternative assessment known as the EER Analysis. The key vari-able, i.e., EER time is defined as the time required to execute safeevacuation operation during emergency. It is the time required toget to a ‘safe place’ from the working area. Depending on thelocation of the event, the ‘safe place’ can be either (see Fig. 4):
�
ion
Point (A)—Firewall segment at Frame 2B
� Point (B)—Fire/blastwall segment at Frame 2A � Point (C)—Firewall segment at Frame 1B � Point (D)—which is at the survival craft muster area (primaryevacuation)
The EER time is computed from the furthest point of manningarea in each deck (i.e. from Helideck, above Air Cooler Top Deck,Crane Cabin, Gas Turbine Package Main Deck, Pigging Area CellarDeck and Drain Area Sub Cellar Deck) to reach primary musterarea within the area of survival craft, identified as (D) in Fig. 4.The EER analysis is simulated according to the flow as depicted inFig. 5 and the EER time is computed according to site specificbasis of emergency system activation, procedural response planand offshore worker movement speed, based on real-time drillexercises. In all cases, conservative estimates that considerpossible congestions during evacuations are used. Note that inmapping the activities to the classification of evacuation phasesas defined in Fig. 5, some of the steps required may involve more
flow No. 1, 2, 3).
Fig. 7. Main deck (Evacuation Flow no. 4) and Continuation of Flow no. 1, 2, 3, 5 and 6.
A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169 167
than one phase, For example, the time required to make the workarea safe involves tA (Awareness Phase) and tEv (EvaluationPhase). The estimations are as follows:
�
0.5 min to sound alarm (i.e. t1); � 3.0 min to make work area safe, i.e. tA and tEv; � 1.0 m/s on level walkways or corridors, i.e. tEv and tEg; � 0.8 m/s on changing decks using stairs, i.e. tEv and tEg; � 0.3 m/s on ladders (allows for the time taken on and off theladder), i.e. tEv and tEg;
� 10.0 min for decision making, roll-call and don lifejackets (onlyapplicable during mustering) i.e. tEv;
� 3.0 min to board the life raft or survival craft and confirmwhether everybody is on-board, i.e. tR; and
� 10.0 min to launch the life raft or survival craft, which includestime release break, lower and release, falls, and move awayfrom the platform, i.e. tR.
The procedural evacuation flow for EER time simulationsusing primary escape routes are strategized on simplified decksdiagram shown below:
i.
Top Deck (see Fig. 6)� Flow no. 1 (from Helideck)—Personnel located helideckwalking down via stairs located southern part of theplatform to reach Main Deck and finally proceed to primarymuster area (D).� Flow no. 2 (from above Air Cooler Top Deck)—For person-
nel who are performing maintenance or inspection aboveAir Cooler Top Deck, they may proceed to escape route atthe southern part of the platform, walking down stairs toMain Deck and proceed to primary muster area (D).� Flow no. 3 (from Crane Cabin)—Crane operator escaping
down via ladder connected to pedestal tower to reach Top
Deck, and proceed to the escape routes at the north part ofplatform area to the stairs reaching Main Deck, and finallyto primary master area (D)
ii.
Main Deck (see Fig. 7)� Flow no. 4 (from Gas Turbine Package)—Personnel locatedat Gas Turbine Package may progress to the escape route ateastern part of the platform, and followed the escape routeat the southern along the perimeter to the primary musterarea (D) located at the west part of platform area.� Flow no. 1, 2 and 3—Continuation of evacuation process
for personnel located at Top Deck, to primary musterarea (D).� Flow no. 5—Continuation of evacuation process for per-
sonnel located at Cellar Deck, to primary muster area (D).� Flow no. 6—Continuation of evacuation process for per-
sonnel located at Sub-Cellar Deck, to primary musterarea (D).
iii.
Cellar Deck (see Fig. 8)� Flow no. 5 (from Pigging Area)—Personnel located atPigging Area within the eastern platform area may proceedto the southern part of platform area, walking up to MainDeck via stairs and finally to the primary muster area (D) atthe western part of platform area.
iv.
Sub-Cellar Deck (see Fig. 9)� Flow no. 6 (from Drain Area)—Personnel located here mayproceed toward southern part of the platform area, to theladder in the midst of the escape path. Then, they mayproceed to upper level decks (i.e. Cellar Deck and MainDeck). From Main Deck, they may just follow the escaperoute perimeter to the western part of platform area(primary muster area (D)).
Fig. 8. Cellar deck (Evacuation Flow no. 5).
Fig. 9. Sub cellar deck (Evacuation Flow no. 6).
Table 4Time to safety from furthest working area at each deck.
No. Work area Total time (min)
Workarea-A
Workarea-A-B
Workarea-A-B-C
Work area-A-B-C-D
1 Helideck 0.0 0.0 0.0 5.2
2 Top of air cooler
(Top Deck)
4.2 4.2 4.4 5.5
3 Crane cabin 4.2 4.2 4.5 5.5
4 Gas turbine
package (Main
Deck)
4.2 4.2 4.4 4.8
5 Pigging area (Cellar
Deck)
3.7 4.2 4.4 5.0
6 Drain area (Sub-
cellar Deck)
4.4 4.8 4.9 5.5
A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169168
Based on the procedural evacuation flows as shown in Figs. 6–9,the simulated EER time are computed and shown in Table 4. Onaverage, 3.7–5.5 min are allowed for the first level firewall failure(i.e. at locations (A) and (B)). This is the maximum duration that thefirewall is able to maintain its integrity as a barrier to the generatedfire event in 15 min jet fire and 60 min pool fire.
This EER analysis also assumed that no escalation from failuresof deck floors and other structural components, safety equipmentand hydrocarbon vessels, i.e. no double jeopardies. Credit is takenas if the deck floors and other structural components, safetyequipment and hydrocarbon vessels managed to fully maintain itsintegrity at minimum of 15/60 min, which is at the firewallexposure rating time due to jet/pool fire.
In order to complete an evacuation process to a place of safetyfrom the survival craft muster area, an amount of additional time
of platform abandonment is needed. Therefore, an additional timeof 23 min (from the maximum 6 min resulted in Table 4) isassumed needed to complete an evacuation process. This gives acumulative of 28.5 min needed for the complete recovery process.With redundancy of another firewall protecting living quarters,additional amount of survival time can be considered. Completeevacuation is therefore successful, assuming no double jeopardyevent and the platform structural integrity is retained.
4. Conclusions
The proposed method is an important tool for designverification to justify the adequacy of safety barriers used inoffshore platforms as well as other similar process facilities.While not involving high degree of complexities, the method
A. Ahmad et al. / Fire Safety Journal 58 (2013) 160–169 169
incorporates important items that influence the safety of theproposed installation. This has been illustrated by the casestudy presented here and can be conveniently adopted forother cases.
The case study presented here shows that the fire rating J15and H60 firewalls located in the facility is deemed adequate basedon EER time of worker to be able to muster at survival craft area atMain Deck assuming no double jeopardy events, i.e. escalationevents due to failure of deck floors and other structural compo-nents, safety equipments and hydrocarbon vessels. This result isalso consistent with ALARP principal applied as an input todesign. The results also proved the adequacy of the proposedcourse risk-based methodology in determining PFP (fire/blast-wall) adequacy.
References
[1] F.I. Khan, S.A. Abbasi, An assessment of the likelihood of occurrence, and thedamage potential of domino effect (chain of accidents) in a typical cluster ofindustries, J. Loss Prev. Process Ind. 14 (2001) 283–306.
[2] V. Cozzani, A. Tugnoli, E. Salzano, Prevention of domino effect: from activeand passive strategies to inherently safer design, J. Hazardous Mater. 139(2006) 209–219.
[3] T.A. Roberts, L.C. Shirvill, K. Waterton, I. Buckland, Fire resistance of passivefire protection coatings after long-term weathering, Process Saf. Environ.Prot. 88 (2010) 1–19.
[4] A. Brandsæter, Risk assessment in the offshore industry, Saf. Sci. 40 (2002)231–269.
[5] A. Falck, E. Skramstad, M. Berg, Use of QRA for decision support in the designof an offshore oil production installation, J. Hazardous Mater. 71 (1–3) (2000)179–192.
[6] S. Lewis, An Overview of Leading Software Tools for QRA, in: Proceedings ofthe 7th Professional Development Conference and Exhibition. March 18–22,2005, Kingdom of Bahrain.
[7] J. Krueger, K.J. Smith, A practical approach to fire hazard analysis for offshorestructures, J. Hazardous Mater. 104 (1-3) (2003) 107–122.
[8] N.K. Shetty, C.G. Soares, P. Thoft-Christensen, F.M. Jensen, Fire safety assess-
ment and optimal design of passive fire protection for offshore structures,Reliab. Eng. Syst. Saf. 61 (1–2) (1998) 139–149.
[9] J.W. Boh, L.A. Louca, Y.S. Choo, Numerical assessment of explosion resistantprofiled barrier, Mar. Struct. 17 (2) (2004) 139–160.
[10] J.K. Paik, J. Czujko, B.J. Kim, J.K. Seo, S.R. Han, C.H. Yeon, P. Janiszewski,P. Musial, Quantitative assessment of hydrocarbon explosion and fire risks inoffshore installations, Mar. Struct. 24 (2011) 73–96.
[11] B.J. Kim, J.K. Seo, J.H. Park, J.S. Jeong, B.K. Oh, S.H. Kim, C.H. Park, J.K. Paik,Load characteristics of steel and concrete tubular members under jet fire: an
experimental and numerical study, Ocean Eng. 37 (13) (2010) 1159–1168.[12] J.K. Paik, B.J. Kim, J.S. Jeong, S.H. Kim, Y.S. Jang, G.S. Kim, CFD simulations of
gas explosion and fire actions, Ships Offshore Struct. 5 (2010) 3–12.[13] A.D. Padova, A. Tugnoli, V. Cozzani, T. Barbaresi, F. Tallone, Identification of
fireproofing zones in oil and gas facilities by a risk-based procedure, J.Hazardous Mater. 191 (2011) 83–93.
[14] M.K. Dey, An evaluation of risk methods for prioritizing fire protectionfeatures: a procedure for fire barrier penetration seals, Nucl. Eng. Des. 232(2004) 165–171.
[15] J. Spounge, A guide to quantitative risk assessment of offshore installations,CMPT, 1999.
[16] UKOOA, Fire and Explosion Guidance Part 2: Avoidance and Mitigation ofFires. Revision 2, 2006.
[17] UK HSE. Offshore Hydrocarbon Releases Statistics and Analysis, UK HSE,2002.
[18] API, Recommended Practice for Analysis, Design, Installation, and Testing ofBasic Surface Safety Systems for Offshore Production Platforms, API RP 14C,
7th Edition, 2001.[19] UKOOA, Ignition Probability Review and Model Development—Phase 2 Look-
Up Correlation Report Look-up Correlations, 2004.[20] DNV, Offshore Reliability Data Handbook (OREDA), DNV, 2002.[21] D.G. DiMattia, F.I. Khan, P.R. Amyotte, Determination of human error
probabilities for offshore platform musters, Journal of Loss Prevention inthe Process Industries 18 (2005) 488–501.
