Вы находитесь на странице: 1из 493

Issue 1 May 2007

OIL & GAS UK


FIRE AND EXPLOSION GUIDANCE
ISSUE 1 MAY 2007
Whilst every effort has been made to ensure the accuracy of the information contained in this
publication, neither Oil & Gas UK, nor any of its members will assume liability for any use made thereof.
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system,
or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or
otherwise, without prior written permission of the publishers.
Crown copyright material is reproduced with the permission of the Controller of
Her Majestys Stationery Office.
Copyright 2007 The United Kingdom Offshore Oil and Gas Industry Association Limited trading as Oil
& Gas UK

ISBN: 1 903003 36 2
PUBLISHED BY OIL & GAS UK
London Office: 2nd Floor, 232-242 Vauxhall Bridge Road, London, SW1V 1AU.
Tel: 020 7802 2400 Fax: 020 7802 2401
Aberdeen Office:
3rd Floor, The Exchange, 2 Market Street, Aberdeen, AB11 5PJ.
Tel: 01224 577250
Email: info@oilandgasuk.co.uk
Website: www.oilandgasuk.co.uk
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 2 of 493

Foreword
This guidance has been sponsored by Oil & Gas UK and the UK Health and Safety Executive,
to provide a source of good practice on designing against fire and explosions on offshore
installations.
The guidance focuses on setting a philosophy for design and assessment in a realistic and
simplified manner. It distils the latest thinking, based on research and practices, contributed by
acknowledged and reputable experts and consolidates the research and development effort
from over 300 projects carried out since 1988 to the present day.
It is intended that the guidance will provide an accepted common base from which to support
design decisions by designers and duty holders for both new installations and in making
operational modifications to existing installations.
Topics addressed by the Guidance include fire and explosion hazard types, fire and explosion
management, the derivation of fire loadings, heat transfer and explosion loads and the
response of equipment and systems to fires and explosions.
Information is also included on legislation, standards and other initiatives, a summary of key
issues related to man-machine interfaces and a review of available fire and explosion models.
This Guidance establishes a new benchmark and will assist all sections of the industry in their
evaluation of the risks from hydrocarbons arising from the components of the offshore
infrastructure.
The Guidance does not have the force of a Standard and contains information on good
practice, which will always require clear justification in the context of specific hazards.
Alternative methods to those presented may be used so long as they are justified by a risk
assessment and provided their use leads to reducing risks to As Low As Reasonably
Practicable (ALARP).
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 3 of 493

Acknowledgements
It is appropriate to acknowledge the many contributors to this project. The Guidance was
created in two major phases with different teams involved in each phase.
Many thanks are due to our co-sponsors, the HSE for supporting this project since 2001. Many
technical specialists in both HSE and UK oil and gas member companies have contributed to,
provided information for and reviewed the Guidance as it has developed.
For the project management, technical contributions and editorial responsibilities in general,
thanks are due to fireandblast.com limited for their role in managing the project, collating and
editing contributions from others and filling-in some of the technical gaps in the guidance.
The first stage of the project covering the accumulated guidance on explosions was developed
by a consortium headed by MSL Engineering Limited with other members being Aker-
Kvrner, Century Dynamics, Genesis Oil and Gas, Imperial College Consultants, Morgan
Safety Solutions and WS Atkins inc. (Houston). The advisory panel to the consortium and the
peer reviewers gave freely of their time and relevant background information to assist during
this phase, many thanks are due to them for helping to hone the presentation of some of the
more novel aspects of the guidance.
The second stage of the project covered the accumulated guidance on fires and was prepared
by acknowledged industry experts from MSL Engineering, Loughborough University, Health
and Safety Laboratory, Steel Construction Institute, Risk Management Decisions, Aker-
Kvrner, Natabelle Technology, TBS Cubed, Shell Global Solutions and Mustang Associates.
Thanks are also due to many individuals who contributed informally via the workshops and
presentations undertaken during the development of this Guidance. Their contributions were
invaluable.
A full list of contributing individuals can be found in Annex H.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 4 of 493

Contents
1 Introduction..........................................................................................................13
1.1 History...........................................................................................................13
1.2 Objectives .....................................................................................................14
1.3 Fire and explosion events .............................................................................15
1.3.1 Identification.......................................................................................................... 15
1.3.2 Causes.................................................................................................................. 16
1.3.3 Consequence severity .......................................................................................... 17
1.4 Safety management systems (SMS) .............................................................18
1.4.1 Purpose of the SMS.............................................................................................. 18
1.4.2 SMS Content ........................................................................................................ 19
1.5 Hazard management systems.......................................................................26
1.5.1 General ................................................................................................................. 26
1.5.2 Policy .................................................................................................................... 27
2 Aims and principles of fire and explosion hazard management .....................30
2.1 Aims of fire and explosion hazard management ...........................................30
2.2 Reasonable practicability ..............................................................................31
2.3 Performance standards.................................................................................32
2.4 Safety critical elements .................................................................................34
2.5 Fire hazard management philosophy ............................................................34
2.5.1 Introduction........................................................................................................... 34
2.5.2 Hazard philosophy................................................................................................ 35
2.5.3 Prescriptive vs. performance based design.......................................................... 36
2.5.4 The application of fire hazard management ......................................................... 36
2.6 Understanding the fire and explosion hazard................................................38
2.6.1 Understanding the fire hazard .............................................................................. 38
2.6.2 Understanding the explosion hazard .................................................................... 38
2.6.3 Identification and classification of fire and explosion hazards .............................. 40
2.6.4 Likelihood.............................................................................................................. 43
2.6.5 Fire hazards: understanding the source ............................................................... 44
2.7 Inherently safer design for fires and explosions ............................................51
2.7.1 Introduction........................................................................................................... 51
2.7.2 Goals of inherently safer design ........................................................................... 52
2.7.3 Effective management of residual risk.................................................................. 56
2.7.4 Processes for achievement of inherently safer design goals................................ 58
2.7.5 Constraints and limitations of inherent safety....................................................... 61
2.8 Risk screening...............................................................................................62
2.8.1 General ................................................................................................................. 62
2.8.2 Applying the risk matrix......................................................................................... 62
2.8.3 Risk screening acceptance criteria....................................................................... 65
2.8.4 Low explosion risk installations............................................................................. 67
2.8.5 Medium explosion risk installations ...................................................................... 68
2.8.6 High explosion risk installations............................................................................ 68
2.9 Risk reduction ...............................................................................................71
2.10 The lifecycle approach to fire and explosion hazard management................73
2.10.1 Fire and explosion assessment during the installation lifecycle ....................... 74
2.10.2 Stages of the installation lifecycle..................................................................... 76

FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 5 of 493
3 Assessment of and protection from fires and explosions...............................81
3.1 Introduction ...................................................................................................81
3.1.1 Constraints on hazard identification...................................................................... 81
3.1.2 Selection of the representative design accident events........................................ 83
3.1.3 Consideration of escalation .................................................................................. 83
3.2 Fires on offshore installations........................................................................85
3.2.1 Fire types and scenarios....................................................................................... 85
3.2.2 Release events..................................................................................................... 85
3.2.3 Ignition .................................................................................................................. 87
3.2.4 Fire scenarios ....................................................................................................... 87
3.2.5 Transition between fire scenarios......................................................................... 88
3.2.6 Fire prevention methods....................................................................................... 88
3.2.7 Gas and fire detection and control methods......................................................... 92
3.2.8 Methods for mitigating the effects of fires........................................................... 103
3.2.9 Active fire protection methods ............................................................................ 107
3.3 Appropriate performance standards............................................................109
3.3.1 Application of performance standards ................................................................ 109
3.3.2 Functionality issues ............................................................................................ 109
3.3.3 Availability issues................................................................................................ 110
3.3.4 Reliability issues ................................................................................................. 111
3.3.5 Survivability......................................................................................................... 112
3.3.6 Written schemes of examination (WSEs) or verification..................................... 112
3.4 Methods and approaches to structural analysis ..........................................113
3.4.1 General ............................................................................................................... 113
3.4.2 Screening analysis.............................................................................................. 115
3.4.3 Strength level analysis........................................................................................ 115
3.4.4 Scenario or performance based strength level analysis..................................... 117
3.4.5 Redundancy analysis.......................................................................................... 118
3.4.6 Ductility level analysis......................................................................................... 118
3.4.7 Assessment of fire barriers................................................................................. 119
3.5 Explosion hazard management ...................................................................120
3.5.1 Common issues with fire hazard management................................................... 120
3.5.2 Detection, control and mitigation ........................................................................ 120
3.5.3 Control systems and safety critical equipment ................................................... 121
3.5.4 Equipment specific performance standards........................................................ 123
3.5.5 Levels of criticality of equipment items ............................................................... 123
3.5.6 Mitigation and consequence minimization.......................................................... 125
3.6 Particular considerations for floating structures, storage and offloading
systems..................................................................................................................135
3.6.1 Introduction......................................................................................................... 135
3.6.2 Marine life cycle considerations.......................................................................... 135
3.6.3 Application of fire and explosion hazard management to floating structures...... 137
3.7 Particular considerations for mobile offshore units......................................139
3.7.1 Introduction......................................................................................................... 139
3.7.2 MODU classification ........................................................................................... 139
3.7.3 Conventions, codes and regulations................................................................... 140
3.8 Particular considerations for existing installations .......................................147
3.8.1 General ............................................................................................................... 147
3.8.2 Early operating phase......................................................................................... 150
3.8.3 Midlife operating phase....................................................................................... 151
3.8.4 Late operating phases ........................................................................................ 152
3.8.5 Aging installations and life extension.................................................................. 152
3.8.6 Particular considerations for accommodation and other areas for personnel..... 154
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 6 of 493
4 Interactions between fire and explosion hazard management ......................156
4.1 General .......................................................................................................156
4.2 Fire and explosion prevention methods.......................................................156
4.2.1 General ............................................................................................................... 156
4.2.2 Minimisation of leakage frequency ..................................................................... 156
4.2.3 Minimisation of ignition probability...................................................................... 157
4.3 Fire and explosion detection and control methods ......................................157
4.3.1 General ............................................................................................................... 157
4.3.2 Significance of area ventilation........................................................................... 159
4.4 Fire and explosion mitigation methods........................................................161
4.4.1 Active fire-fighting systems................................................................................. 161
4.4.2 Fire-proofing systems ......................................................................................... 165
4.4.3 The temporary refuge ......................................................................................... 166
4.5 Combined fire and explosion analysis.........................................................166
4.5.1 Introduction......................................................................................................... 166
4.5.2 Fire response of explosion damaged structures................................................. 166
4.5.3 Explosion response of structures at elevated temperatures............................... 168
4.6 Safety conflicts ............................................................................................169
4.6.1 General ............................................................................................................... 169
4.6.2 Conflicts arising from inherent safety measures................................................. 169
4.6.3 Conflicts arising from preventative safety measures .......................................... 169
4.6.4 Conflicts arising from detection safety measures ............................................... 170
4.6.5 Conflicts arising from control safety measures................................................... 170
4.6.6 Conflicts arising from mitigation safety measures .............................................. 170
4.6.7 Conflicts arising from emergency response safety measures ............................ 171
4.7 Fire and explosion walls..............................................................................171
4.8 Decks ..........................................................................................................172
5 Derivation of fire loadings and heat transfer ..................................................174
5.1 Introduction .................................................................................................174
5.2 Fire characteristics and combustion effects ................................................174
5.2.1 General ............................................................................................................... 174
5.2.2 Gas jet fire .......................................................................................................... 174
5.2.3 Pool fires on an installation................................................................................. 179
5.2.4 Gas fires from sub sea releases......................................................................... 183
5.2.5 BLEVE................................................................................................................ 183
5.3 Fire and smoke loading...............................................................................184
5.3.1 Fire loading to the surroundings ......................................................................... 184
5.3.2 Thermal loading to engulfed objects................................................................... 186
5.3.3 Smoke loading.................................................................................................... 187
5.4 Estimating fire and smoke loadings.............................................................189
5.4.1 Inventories and release rates ............................................................................. 189
5.4.2 Typical values..................................................................................................... 190
5.4.3 Predictive models for fire loading........................................................................ 197
5.5 Heat transfer ...............................................................................................198
5.5.1 Mechanisms for heat transfer ............................................................................. 198
6 Derivation of explosion loads...........................................................................217
6.1 Introduction to explosion load determination...............................................217
6.1.1 General ............................................................................................................... 217
6.1.2 Dynamic pressures and overpressures .............................................................. 218
6.1.3 External explosions............................................................................................. 218
6.1.4 Far field effects ................................................................................................... 219
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 7 of 493
6.2 Tasks for the determination of explosion loads ...........................................219
6.3 Determination of explosion frequency .........................................................220
6.4 Dispersion ...................................................................................................221
6.4.1 General ............................................................................................................... 221
6.4.2 Workbook approach for calculation of gas cloud size......................................... 222
6.4.3 Explosion Handbook approach........................................................................... 224
6.4.4 Equivalent Stoichiometric Clouds ....................................................................... 224
6.5 Ignition.........................................................................................................225
6.5.1 General ............................................................................................................... 225
6.5.2 Estimation of delayed ignition probability Pr
ign
.................................................... 226
6.6 Explosion overpressure determination ........................................................229
6.6.1 Explosion prediction methods and tools ............................................................. 229
6.6.2 Limitations of CFD codes.................................................................................... 230
6.6.3 Explosion code review/selection......................................................................... 230
6.6.4 Summary of main conclusions of HSL report [6.4] ............................................. 231
6.6.5 Practical use of CFD explosion prediction tools ................................................. 232
6.6.6 Validation/calibration of gas explosion prediction tools ...................................... 233
6.6.7 Example overpressure traces............................................................................. 234
6.6.8 Extrapolation of the results of a worst case explosion simulation....................... 235
6.7 Development and application of nominal explosion loads...........................237
6.7.1 Intended use of nominal explosion loads............................................................ 237
6.7.2 Factors influencing the overpressure values ...................................................... 237
6.7.3 Characteristics of a suitable data set.................................................................. 238
6.7.4 Bounding (minimum) overpressures and durations............................................ 238
6.7.5 Other sources of bounding or generic overpressures......................................... 239
6.8 Impulse and duration related to peak overpressure ....................................240
6.9 Design explosion loads ...............................................................................242
6.9.1 Load cases for explosion response .................................................................... 242
6.9.2 Determination of explosion design loads............................................................ 243
6.9.3 The COSAC risk assessment tool ...................................................................... 245
6.9.4 The PRESTO screening model .......................................................................... 245
6.10 Generating exceedance curves...................................................................245
6.10.1 General ........................................................................................................... 245
6.10.2 Exceedance curves for design explosion load case determination ................ 246
6.10.3 Generic exceedance curves ........................................................................... 249
6.10.4 Mobil North Sea methodology for early design blast analysis ........................ 250
6.10.5 Simplified methods for pressure exceedance curve generation..................... 250
6.11 Loads on piping and equipment ..................................................................251
6.11.1 Load cases for piping and equipment response............................................. 251
6.11.2 Dynamic pressure loads ................................................................................. 251
6.11.3 Loads on vessels............................................................................................ 254
6.11.4 Loads on grating............................................................................................. 255
6.11.5 Considerations in the use of CFD................................................................... 255
6.11.6 Estimation of vented gas velocities................................................................. 255
6.11.7 Strong shock and global reaction loads.......................................................... 256
6.12 Reporting template for ALARP demonstration ............................................256
6.13 The NORSOK procedure for probabilistic explosion simulation ..................257
7 Response to fires ..............................................................................................259
7.1 Properties of common materials in use offshore .........................................259
7.1.1 Overview............................................................................................................. 259
7.1.2 Mechanical and thermal...................................................................................... 259
7.2 Effects of fire and nature of failures.............................................................261
7.2.1 Standard hydrocarbon fire test ........................................................................... 261
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 8 of 493
7.2.2 Jet fire test .......................................................................................................... 262
7.2.3 Types of failure ................................................................................................... 262
7.2.4 Escalation issues................................................................................................ 269
7.3 Acceptance criteria......................................................................................270
7.3.1 General ............................................................................................................... 270
7.3.2 Criteria used in standard fire tests...................................................................... 270
7.4 Methods of assessment ..............................................................................272
7.4.1 General ............................................................................................................... 272
7.4.2 Partial factors for fire........................................................................................... 272
7.5 Methods in structural design codes.............................................................273
7.5.1 Introduction......................................................................................................... 273
7.5.2 Member analysis................................................................................................. 274
7.5.3 BS5950-8............................................................................................................ 274
7.5.4 EC3-1-2 .............................................................................................................. 275
7.5.5 Finite element modelling..................................................................................... 276
7.6 Attachments and coat-back.........................................................................279
7.7 Process responses......................................................................................279
7.7.1 General ............................................................................................................... 279
7.7.2 Relief................................................................................................................... 280
7.7.3 Relief sizing ........................................................................................................ 281
7.7.4 Blowdown ........................................................................................................... 281
7.7.5 Blowdown system design ................................................................................... 282
7.7.6 Failure criteria..................................................................................................... 283
7.8 Personnel ....................................................................................................286
7.8.1 General ............................................................................................................... 286
7.8.2 Characteristics of fires relevant to human response........................................... 287
7.8.3 Harm criteria ....................................................................................................... 290
7.8.4 Human response to fire effects........................................................................... 291
7.8.5 Vulnerability/harm criteria ................................................................................... 297
8 Response to explosions ...................................................................................301
8.1 Overview of explosion response .................................................................301
8.2 Information required for explosion response calculations............................301
8.2.1 Information from the explosion load simulations................................................. 301
8.2.2 Other information from non-structural disciplines ............................................... 302
8.2.3 Overpressure load considerations...................................................................... 302
8.3 Response considerations............................................................................303
8.3.1 Elastic dynamic response................................................................................... 303
8.3.2 Idealisation of overpressure time histories for response calculations................. 305
8.3.3 Equivalent static loads........................................................................................ 306
8.4 Material properties for explosion response..................................................308
8.4.1 General ............................................................................................................... 308
8.4.2 Static material properties.................................................................................... 309
8.4.3 Strain rate effects................................................................................................ 311
8.4.4 Strain hardening ................................................................................................. 313
8.5 Structural performance standards ...............................................................313
8.5.1 Introduction......................................................................................................... 313
8.5.2 Criticality categories for SCEs ............................................................................ 314
8.5.3 Deformation limits............................................................................................... 316
1.1 ..........................................................................................................................316
8.5.4 Rupture............................................................................................................... 316
8.6 Structural assessment.................................................................................317
8.6.1 Introduction......................................................................................................... 317
8.6.2 Design criteria..................................................................................................... 317
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 9 of 493
8.6.3 Strength level blast (SLB) ................................................................................... 318
8.6.4 Ductility level blast (DLB).................................................................................... 318
8.6.5 Dimensioning explosion...................................................................................... 318
8.6.6 The simple demonstration of ALARP.................................................................. 319
8.6.7 General remarks on structural response ............................................................ 319
8.7 Response prediction methods.....................................................................319
8.7.1 General ............................................................................................................... 319
8.7.2 Screening analysis.............................................................................................. 320
8.7.3 Strength level analysis........................................................................................ 321
8.7.4 Ductility level analysis......................................................................................... 322
8.7.5 Single degree of freedom idealisations............................................................... 323
8.7.6 Limitations of Biggs method............................................................................... 329
8.7.7 Pressure impulse diagrams ................................................................................ 330
8.8 Non-linear finite element analysis................................................................331
8.8.1 General ............................................................................................................... 331
8.8.2 Choice of NLFEA tools ....................................................................................... 331
8.8.3 Construction of the finite element model ............................................................ 332
8.8.4 Solution techniques in NLFEA............................................................................ 333
8.9 Response of the primary structure ..............................................................333
8.9.1 Introduction......................................................................................................... 333
8.9.2 Global loading scale effects................................................................................ 334
8.9.3 Global received loads ......................................................................................... 334
8.9.4 Plasticity and dynamic effects............................................................................. 334
8.9.5 Modified code checks ......................................................................................... 335
8.9.6 The use of NLFEA in global response................................................................ 336
8.9.7 Global response considerations ......................................................................... 337
8.10 Response of equipment, pipework and vessels ..........................................338
8.10.1 General ........................................................................................................... 338
8.10.2 Response of equipment and vessels to explosion loading............................. 339
8.10.3 Response of pipework to explosion loading ................................................... 340
8.10.4 Strong vibration............................................................................................... 341
8.11 Areas of uncertainty ....................................................................................342
9 Systems for fire and explosion management .................................................343
9.1 Common issues...........................................................................................343
9.2 Selection and specification..........................................................................343
9.2.1 Overview............................................................................................................. 343
9.2.2 The definition of a system................................................................................... 344
9.2.3 The role of a system........................................................................................... 345
9.2.4 The suitability of a system.................................................................................. 345
9.2.5 The applicability of a system............................................................................... 345
9.2.6 Types and variations........................................................................................... 346
9.2.7 Interaction and limitations................................................................................... 346
9.2.8 Functional parameters........................................................................................ 347
9.3 Impact of fire and explosion type characteristics.........................................347
9.3.1 Requirement ....................................................................................................... 347
9.3.2 Response time and duration............................................................................... 347
9.3.3 Logic ................................................................................................................... 347
9.3.4 Sensitivity/preset values ..................................................................................... 348
9.3.5 Flow/application rates/concentration .................................................................. 348
9.3.6 Environmental conditions.................................................................................... 348
9.3.7 Failure criteria..................................................................................................... 348
9.3.8 Survivability......................................................................................................... 348
9.4 Availability and reliability .............................................................................349
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 10 of 493
9.4.1 Underlying principles .......................................................................................... 349
9.4.2 Design and build quality...................................................................................... 350
9.4.3 Maintenance, inspection and testing .................................................................. 350
9.4.4 Non-availability (downtime)................................................................................. 350
9.5 Actuation and initiation ................................................................................351
9.5.1 Manual vs. automatic.......................................................................................... 351
9.5.2 Duplication.......................................................................................................... 351
9.5.3 Diversity.............................................................................................................. 351
9.5.4 Over complexity/operability................................................................................. 352
9.5.5 False and spurious alarms.................................................................................. 352
10 Detailed design guidance for fire resistance...............................................353
10.1 Introduction .................................................................................................353
10.2 Minimising fire hazards throughout the design............................................354
10.2.1 Introduction..................................................................................................... 354
10.2.2 Project appraisal & concept selection............................................................. 354
10.2.3 FEED stage .................................................................................................... 359
10.2.4 A methodology for an initial fire QRA.............................................................. 360
10.2.5 Detailed design............................................................................................... 361
10.2.6 Construction/commissioning phases .............................................................. 368
10.2.7 Operational phase .......................................................................................... 368
10.2.8 Plant modifications.......................................................................................... 368
10.3 Best practice for fire protection systems......................................................369
10.3.1 Introduction..................................................................................................... 369
10.3.2 Fire protection design ..................................................................................... 370
11 Detailed design guidance for explosion resistance ...................................383
11.1 General .......................................................................................................383
11.2 The design sequence..................................................................................383
11.2.1 Introduction..................................................................................................... 383
11.2.2 Project appraisal and concept selection ......................................................... 383
11.2.3 Sub-sea layout ................................................................................................ 385
11.2.4 Process engineering....................................................................................... 385
11.2.5 Pipework......................................................................................................... 386
11.2.6 Power requirements and electrical systems ................................................... 387
11.2.7 Instruments and controls ................................................................................ 387
11.2.8 ESDV, blowdown, pressure relief devices and isolation systems................... 387
11.2.9 Utilities requirements ...................................................................................... 388
11.2.10 Layout ............................................................................................................. 388
11.2.11 Structural arrangement topsides.................................................................. 389
11.2.12 Structural arrangement substructure ........................................................... 390
11.2.13 Explosion & fire hazards review...................................................................... 390
11.2.14 Brown field modifications: survey, hook-up and commissioning..................... 391
11.3 Best practice in explosion hazard design ....................................................391
11.3.1 Introduction..................................................................................................... 391
11.3.2 Management of the explosion hazards........................................................... 392
11.3.3 Derivation of explosion loadings..................................................................... 392
11.3.4 Response to explosions.................................................................................. 392
11.3.5 Specific considerations for blast walls ............................................................ 393
11.3.6 Integration with fire hazard management ....................................................... 395
11.3.7 Operations, inspection and maintenance issues ............................................ 395
11.4 Industry and regulatory authority initiatives .................................................396
11.4.1 ATEX directives .............................................................................................. 396
11.4.2 Bolted pipe joints ............................................................................................ 396
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 11 of 493
11.4.3 Small bore pipework, tubing and flexible hoses.............................................. 396
Annex A References..........................................................................................398
A1 - References Chapter 1..................................................................................398
A2 - References Chapter 2..................................................................................400
A3 - References Chapter 3..................................................................................402
A4- References Chapter 4...................................................................................405
A5- References Chapter 5...................................................................................406
A6- References Chapter 6...................................................................................409
A7- References Chapter 7...................................................................................413
A8- References Chapter 8...................................................................................415
A9- References Chapter 9...................................................................................417
A10- References Chapter 10...............................................................................418
A11- References Chapter 11...............................................................................419
Annex B Glossary of terms...............................................................................420
Annex C Acronyms............................................................................................443
Annex D Human factors man/machine interface .........................................450
D1 - Introduction.....................................................................................................450
D2 Overview of assessment techniques .............................................................450
D2.1 - Commonly applied techniques include; .......................................................451
D2.2 - Task analyses..............................................................................................451
D2.3 - Human error analyses .................................................................................451
D3 - Awareness and competence ..........................................................................452
Annex E Legislation, standards, guidance and other initiatives...................453
E1 - Legislation in the UK.......................................................................................453
E1.1 - Legislation background................................................................................453
E1.2 Offshore legislation .....................................................................................453
E2 Documents/guidance issued by the HSE.......................................................454
E2.1 - Assessment principles for offshore safety cases .........................................454
E2.2 Fire and explosion strategy.........................................................................454
E2.3 Other internal HSE guidance ......................................................................455
E3 - Codes, standards and guidance .....................................................................456
E3.1 - Introduction..................................................................................................456
E3.2 - Recent developments..................................................................................456
Annex F Review of models ..................................................................................462
Annex G Checklists ...........................................................................................472
Annex H Acknowledgements ...........................................................................492

FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 12 of 493

FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 13 of 493
1 Introduction
1.1 History
Following the Piper Alpha disaster a large Joint Industry Project called Blast and Fire
Engineering for Topsides Structures (Phase 1) was carried out between May 1990 and
July 1991. The main deliverable from this project was the Interim Guidance Notes (IGNs) [1.1]
and 26 background technical reports written by the participants and published by the Steel
Construction Institute (SCI) in November 1991. At about this time the Fire and Blast
Information Group (FABIG) was set up and has subsequently issued a number of Technical
notes on specific aspects of fire and explosion engineering [1.2, 1.3, 1.4, 1.5, 1.6, 1.7 and 1.8].
The Phase I JIP [1.9, 1.10 and 1.11] also included a review of open hydrocarbon pool fire
models. Three types of model (current at the time) were evaluated, semi-empirical proprietary
models, field models (e.g. CFD models) and integral models (falling between semi-empirical
and field models). Compartment fire modelling looked at two types of code, zone models and
field models. At that time, the zone models (typically used for modelling fires within buildings)
encountered severe limitations in the modelling of large offshore compartment fires.
Three further phases of the Blast and Fire Engineering Project JIP were conducted from 1994
to 2001, Phase 2 [1.12], Phase 3a and Phase 3b [1.13] consisting mostly of experiments to
define and determine explosion overpressure load characteristics and to provide a basis
against which load simulation software may be validated, however, some fire related
experiments were also undertaken.
The Phase 2 JIP also focussed on horizontal free jet fires of stabilised light crude oil and
mixtures of stabilised light crude oil with natural gas and the main findings are listed below.
The free flame releases, of crude oil only, were not able to sustain a stable flame and
one of the mixed fuel releases was also unstable.
All the flames were particularly luminous compared with purely gaseous jet flames and
generated large quantities of thick black smoke, mainly towards the tail of the flame.
All the flames were highly radiative, with maximum time averaged surface emissive
powers (SEPs, heat radiated outwards per unit surface area of the flame) ranging
between 200 kWm
-2
to 400 kWm
-2
.
The incident total heat fluxes (radiative and convective) measured on the pipe target
were significantly higher for the mixed fuel tests than for the crude oil only tests, by a
factor of two in many cases. Typical values were in the range 50 kWm
-2
to 400 kWm
-2
.
Phase 2 of the JIP included a fire model evaluation exercise. This considered three jet-fire
scenarios, but no pool-fire scenarios. However it did generate high quality data that were
considered suitable for future pool fire model evaluation.
The main source of detailed information on the characteristics of jet fires covered in the reports
on the programme of jet-fire research was co-funded by the European Community. This
programme studied single fuel natural gas and propane jet fires (Bennett et al, 1990) [1.14].
A further project funded by the CEC, looked at the hazardous consequences of Jet Fire
Interactions with Vessels (JIVE), this project covers the modelling of jet fires, large scale
natural gas/butane jet fires and taking vessels to failure in jet fires and some results of jet
flame impingement trials are reported in OTO 2000 051 [1.15].
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 14 of 493
Other valuable work on explosions, mostly executed in Norway and following the probabilistic
approach, has resulted in the new NORSOK guidance documents [1.16 and 1.17] which are
amongst the source documents for this Guidance. The results of these and other major
investigations are summarised in the new Engineering Handbook published by CorrOcean
[1.18].
During the same period, the HSE and others have funded approximately 300 individual
projects and a number of Joint Industry Projects (JIPs) at a cost of 31 million, which have
contributed significantly to the understanding of the key issues. The relative maturity of the
subject has enabled a better defined approach to be adopted in this Guidance document
relying more on good practice which has been developed and implemented over the
intervening years.
1.2 Objectives
The primary objective of this document is to offer guidance on practices and methodologies
which can lead to a reduction in risk to life, the environment and the integrity of offshore
facilities exposed to fire and explosion hazards.
Risk is defined as the likelihood of a specified undesired event occurring within a specified
period or resulting from specified circumstances.
Preventative measures are the most effective means of minimising the probability of an event
and its associated risk. The concepts of Inherently Safer Design or Inherent Safety are
central to the approach described in this document both for modifications of existing structures
and new designs.
This document consolidates the R&D effort from 1988 to the present day, integrates fire type
and scenario definition, fire loading and response development and provides a rational design
approach to be used as a basis for design of new facilities and the assessment of existing
installations.
This Guidance is intended to assist designers and duty holders during the design of, and in
making operational modifications to, offshore installations in order to optimise and prioritise
expenditure where it has most safety benefit.
An additional intent of this Guidance is to move the decision-making processes within the fire
and explosion design field as much as possible towards a Type A process from Type B or C
as defined in UKOOAs document on decision-making, the key figure of which is illustrated in
Figure 1.1 below [1.19].
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 15 of 493

Figure 1.1 - The UKOOA Risk Based Decision Making Framework
The framework defines the weight given to various factors within the decision making process,
ranging from decisions dominated by purely technical matters to those where company and
societal values predominate.
Design decisions required for a number of installations will lie in Areas A or B of the chart
resulting in an approach which involves codes and Guidance based on experience and best
practice as described in this document and supplemented by risk based arguments where
required.
This Guidance will look to build past experience of the development of fire and explosion
scenarios and the prediction of design load cases and their timelines as part of a developing
Type A approach.
1.3 Fire and explosion events
In order to manage the fire and/or explosion hazard and apply risk judgements, it is necessary
to identify the initiating events which may lead to a fire or explosion.
1.3.1 Identification
Projects must identify major safety and environmental hazards as early as possible in the
project so that they can be understood, assessed and acted upon as necessary in a timely
manner.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 16 of 493
The means by which hazards are identified may be by formal processes such as:
hazard identification studies (HAZIDs) and environmental hazard identification
studies (ENVID)
hazard and operability reviews (HAZOPs)
layout review
hazardous area review
safety studies
Formal reviews should be attended by all relevant disciplines, including operational personnel,
in order to obtain as broad an understanding as possible of potential hazards.
Hazards may also be identified by the individual in the course of his work. A key element in the
management of hazards is the establishment of an action tracking system. A log should be
kept of all actions arising from hazard identification studies, reports and project concerns so
that they can be formally held in a single data-base, tracked and eventually closed out, thus
ensuring that none is forgotten or ignored. This is called the Safety & Environmental Action
Monitoring System, or similar title, and is generally managed by the Safety Group within the
project.
Additionally, it may aid the management of hazards to compile a hazard register listing all
significant hazards, their cause, and how each is handled.
1.3.2 Causes
Causes of a release may be dropped objects, ship impact, intervention, fatigue, vibration,
extreme environmental conditions, imperfections, escalation from a fire, exceedance of design
conditions and human error. These causes are often referred to as initiating events.
Generic release scenarios based on historical evidence in the Gulf of Mexico [1.20] and the
UK sector of the North Sea [1.21] are listed below starting with the most credible:-
1. Pump Seal or Gasket Leak: Often represented as a 5 mm orifice or the annular space
between the flanges without a gasket or between the pump shaft and the case-less seal.
2. Small Fitting or Line: Often represented as a 20 mm orifice or the typically installed
diameter for an instrument connection, or sample/drain line.
3. Medium Line or Partial Large Line: Often represented by a 50 mm orifice and evaluated as
a possible credible release scenarios especially when considering dropped objects.
4. Large Transfer Line & Vessel Nozzle Failure: Full pipe diameter. Rarely considered as
credible for design although frequently appears in loss databases. Evaluated usually for
off-facility or facility separation distance determination and emergency response planning
purposes.
5. Vessel Failure: Some suggestions by failure mode propagation or vessel de-inventory
within 10 minutes. Rarely considered as credible for design although occasionally appears
in loss databases usually as a result of inappropriate vessel materials selection
(e.g. hydrogen embrittlement, chloride/caustic stress corrosion cracking), inadequate relief
sizing, relief plugging, mechanical impact as well as incomplete inspection.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 17 of 493
1.3.3 Consequence severity
The direct and indirect effects of explosion overpressure should be identified. This should be
achieved by assessing parameters such as;
the vulnerability of Safety Critical Elements to dynamic pressure, overpressure, missiles,
and strong shock response
occupancy of area immediately affected
vulnerability of people in adjacent areas
the relative location of the TR
levels of congestion and confinement
the suitability of the layout
the dimensions of potential explosive gas clouds
hazardous inventories, both isolatable and non-isolatable
the operating and control philosophy, influencing manning levels and occupation
frequency the operating and control philosophy influencing extent of operator intervention
and the potential for human error and inventory loss.
The following gives some guidance on the assessment of consequences:
Low consequence outcomes would be predicted where the overpressure level is predicted to
be relatively low and immediate and delayed consequences are also low. The equipment
count would probably be low, being limited to wellheads and manifold with no vessels (i.e. no
associated process pipework) resulting in low congestion and inventory. Confinement should
also be low, with no more than 2 solid boundaries including solid decks. Manning would be
consistent with a normally unattended installation with a low attendance frequency, less
frequent than 6-weekly, a 6-weekly visit by a maintenance/intervention crew results in
occupancy of a little over 1 %.
A medium consequence installation would be typically a platform or compartment where the
congestion and confinement exceeds that defined for the low consequence case but with still a
low manning level consistent with a normally unattended installation. Congestion, typified by
the amount of equipment installed, will be greater than for the low case. Manning would be
consistent with a normally unattended installation with a moderate attendance frequency, more
frequent than 6-weekly.
Alternatively, a medium consequence installation may be a processing platform necessitating
permanent manning but with low escalation potential to quarters, utilities and control areas
which are located on a separate structure.
A high consequence installation would encompass remaining installations and compartments
where there is significant processing on board leading to significant congestion and potential
confinement with populated areas within the consequence range of escalation scenarios. This
may typically be characterised by a PDUQ/PUQ installation (jacket, semi-sub, F(P)SO or
jack-up) with quarters on the same structure as the process.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 18 of 493
Where there is doubt regarding the category into which an installation should fall, it is
recommended that the category with next higher consequence is used.
1.4 Safety management systems (SMS)
Safety Management Systems will have common features for dealing with fire and explosion
hazards, or any other accidental loads which can be envisaged. The system described in this
section is generic in this respect.
1.4.1 Purpose of the SMS
A Safety Management System provides a framework whereby an organization can be assured
that So Far As Is Reasonably Practicable (SFAIRP) its operations can be undertaken in a
demonstrably safe manner.
The SMS will demonstrate the means by which the organizations safety policy is put into
effect. The structure of the SMS should comply generally with accepted standards from the
regulator and industry [1.22].
Effective safety management requires a structured approach to the identification of hazards,
the assessment of those hazards and their elimination or minimisation, their control and
mitigation. The means of achieving this are encapsulated in the Safety Management System
(SMS) of the Duty Holder and designer and more specifically the HS&E Plan for the project.
The safety management system SMS should specify the need for an HS&E Plan for all
projects where significant risk to personnel or the environment is possible. The HS&E Plan(s)
will define how health, safety and environmental issues will be handled throughout the life of
the project. More than one plan may be in place, covering different parts or phases of the
project. If this is the case an overall, bridging plan should be available to cover the interfaces
between the individual plans.
When hazards are identified with potential to give rise to risk to personnel or the environment,
in the first instance the aim should be to eliminate or minimise the hazard and the risks
associated with it. Thereafter the aims shall be (in order):
remove personnel from the consequences of the explosion or escalating events;
inherently minimise the potential size/severity of the explosion event;
use detection and control systems to warn personnel and to minimise the explosion
event;
install mitigation measures to reduce escalation and otherwise protect the
workforce, environment and asset
If risks cannot be eliminated and where risk to individuals falls below that which is
unacceptable but above the level of broad acceptability, then risks shall be reduced to As Low
As Reasonably Practicable (ALARP).
This Chapter provides the engineer with the means of managing the various factors which
contribute towards;
the probability of explosion occurring;
the overpressure experienced once the explosion has occurred;
the control and mitigation of consequences of explosion.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 19 of 493
Further guidance on health and safety management can be found in the Basis Document
covering management systems [1.23].
1.4.2 SMS Content
Each management system will have the same basic elements, these will include systems
relating to:-
Policy and objectives
Organization resources and procedures
Risk identification and evaluation
Planning of work activities (including emergency response)
Implementation and monitoring (including means of measuring performance)
Audit to assess the operation of the SMS in practice
Review of the system implementation of the audit process and review of the
targets based on feedback from the monitoring system.
All of the above elements need to be underpinned by a commitment to safety from the
organizations management at the highest level, with effective leadership to ensure that the
above elements are diligently carried out. The management needs to be aware of the safety
policy and aims and provide the necessary resources to ensure that these aims are fulfilled.

Policy & Objectives
Organisation
Resources
Porcedures
Risk
identification
evaluation
management
Planning
Implement
Monitor
Review
Audit
Leadership &
Commitment

Figure 1.2 - Industry Standard SMS
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 20 of 493
1.4.2.1 Policy & objectives
The organization must define and document its HSE policy and objectives. These should;
be focused to the activities of the organization
be consistent with other sectors of the organization
be publicly stated and accessible
be consistent with or improve upon current legislation
have at least the same level of importance as other policies of the organization
commit the organization to improving safety performance
Senior management should provide strong, visible leadership and commitment to HSE issues
and ensure that this commitment is translated into the provision of the necessary resources to
ensure that all the elements of the SMS as described above can be carried out effectively.
There should also be a driving force from management to achieve a continual improvement in
HSE performance. Project management should maintain a high profile for HSE issues
throughout the life of the project, with HSE issues featuring prominently at regular project
progress meetings and at meetings to all levels within the management hierarchy.
Effective leadership should also encourage involvement and participation in the HSE
management process at all levels. This should seek to promote each member of the design
team to look at the work he/she is doing and understand the effect it has, or may have, on the
overall HSE performance of the project and the end product. This should further encourage
each member of the design team to air any concerns they might have with regards to HSE
performance.
1.4.2.2 Organization, resources & procedures
Project HSE Plans
It is general practice within the Offshore industry (for all but minor projects) to have specific
HSE Plans drafted at the earliest practicable stage, usually at the Front End Engineering
Design (FEED) stage. This HSE plan defines how safety and environmental aspects of the
project will be managed. Typical contents will include:
an introduction to, and outline of the project;
a declaration of projects specific HSE policy statement and of the organizations
HSE policies;
a summary of the safety criteria and targets set for HSE design;
the projects organization and reporting structure specific to HSE issues, from
board level downwards;
details of the roles and responsibilities of those persons named in the safety
organizational structure, including all levels within the project;
details of how the technical competency of the operational and design personnel is
guaranteed;
details of the HSE activities on the project needed to ensure the appropriate level of
safety and environmental integrity;
a schedule of HSE deliverables (i.e. documentation to be produced);
the control of quality regarding bought-in items, services and sub-contracts;
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 21 of 493
relevant legislation and procedures available to undertake the above activities;
an audit plan.
The issues noted above are also important when dealing with bought-in items and services,
the quality of work carried should match the standards expected from the company system.
The high standard of design and product may be compromised by the input of others.
Inputs from external organizations may include:
CFD modelling of natural ventilation and gas dispersion
simulation of the explosion to give overpressures and exceedance curves;
the design and manufacture of pre-assembled units (PAUs), e.g. process skids;
construction activities;
the installation of the facility;
hook-up and commissioning.
Poor standards of workmanship, checking or other incorrect procedures are potential
contributing factors in receiving a sub-standard product. All reasonable efforts therefore need
to be made to confirm that the supplied goods and services are of an appropriate standard.
To achieve this, as a minimum, prospective suppliers should be required to provide:
a copy of their safety and environmental policies;
evidence that they have a functioning safety management system;
details of their safety and environmental performance, including accident history
and details of any prosecutions or improvement notices served;
evidence that they have a quality management system complying with an
acceptable modern standard.
If the supplier cannot give satisfactory information on these topics, they should be excluded
from the supplier approval process or be subjected to an audit to identify shortcomings and
preferably be coached to improve.
The Plan should reinforce the premise that HSE is a line management responsibility, that each
discipline and each individual is responsible for the safety and environmental impact aspects
of his work. The role of the Safety Group to police the work of others beyond the usual inter-
disciplinary review of outputs cannot be relied upon. Where hazards or potential benefits are
identified it is the individuals responsibility to identify the scenario and ensure that it is
resolved.
The Plan should be approved by the appropriate representative of management and circulated
to all disciplines for them to cascade to individual worker level. All personnel should be aware
of the standards required with respect to safety and environmental issues and what their role
is in achieving this.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 22 of 493
Resources
In order to carry out the work in a timely manner and with the necessary degree of
competence sufficient resources must be made available. With respect to explosions the
definition of the hazard must be identified at the correct time in the design process such that
actions can be taken to accommodate it, So Far As Is Reasonably Practicable (SFAIRP).
Resources in the context of competent personnel must be available during the following
project stages:
concept selection stage, to have safety and environmental input to ensure that the
option chosen is the one with the lowest risk, as far as is reasonably practicable;
FEED stage, to ensure that layout issues are handled to minimize explosion hazard
and risk;
detailed design stage, to ensure that control and mitigation systems are
incorporated as necessary;
throughout the design period to quantify as necessary the explosion overpressures
or fire loadings that may be encountered and the resultant risk.
Personnel undertaking the work should be suitably trained or experienced in the methods that
need to be used. With respect to explosions, suitable training is particularly important as new
research is continually developing fundamental information on the mechanism as well as
innovative means of control and mitigation.
Procedures
It is one function of the SMS, to ensure that activities are carried out in a correct and
consistent manner and at the correct stage.
It is a requirement that procedures and design guides will be available for engineers to follow
and consult at all stages of the project. They should state the methods by which the activity
should be carried out, by whom the work should be done and any Performance Standards or
criteria that should be met. Procedures for dealing with bought-in services should include the
assessment process for prospective suppliers and the acceptance criteria required to qualify
for the work.
Procedures should be available at key locations (for instance in the design office and with the
QA engineer) for consultation at any time. They should be regularly reviewed and updated as
necessary to include new systems or as a result of the findings from audits undertaken.
1.4.2.3 Risk reduction options through the lifecycle
The exploitation of offshore hydrocarbon reserves may be considered to consist of the
following phases:
Block bidding and license application
Exploration and drilling
Feasibility studies
Concept selection
Concept definition
Front end engineering design (FEED)
Detailed design
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 23 of 493
Fabrication/construction
Installation/hook-up & commissioning/start-up
Operation
Modifications, maintenance and repair
Decommissioning and removal
The concept selection and definition phases are traditionally the time in which the most
significant project decisions with respect to major accident hazards are taken. The majority of
these decisions have a significant influence on the hazards which must ultimately be
addressed by the engineering work and subsequently during the operational phase of the
project.
Figure 1.3 below shows that:
Maximum safety leverage is available during the selection and definition phases.
The cost effectiveness of safety effort expended during the selection and definition phases
is significantly better than during the later phases.
The impact on project schedule of safety effort expended during the selection definition
phases is significantly less than during the later phases.
Unsuccessful safety performance during the selection and definition phases may result in
failure to attain the maximum safety potential, or if it were to be attained it would be at the
expense of significant cost and schedule penalties.

Attainable
Safety
Performance
Cost (CAPEX & OPEX)
Maximum Attainable Safety Performance Level
Define
Execute
Select
Define
Execute
Successful Safety
Input During Early Phases
Unsuccessful Safety
Input During Early
Phases
Select

Figure 1.3 - The cost of safety performance by design phase
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 24 of 493
By not robustly addressing the explosion hazard early in the phase of a project, the
incremental costs of dealing with the hazard later in the project life increase significantly. In
many cases a late design/construction change can be a magnitude greater in cost than had
the feature been incorporated in the design basis of the project. This can result in a measure
that becomes grossly disproportionate to the risk reduction achievable, whereas had the
measure been introduced earlier in the project life this would not have been the case.
The demonstration of ALARP is issue specific; it is recommended that the following general
philosophy be applied for addressing fire and explosion hazards on offshore facilities:
1. Establish and apply nominal explosion overpressures if available and fire loads as
appropriate to the potential fire types.
2. Utilize this Guidance to manage the fire and explosion hazards during the FEED and
detailed engineering phases.
3. For high and medium risk installations, develop an explosion simulation model and
continually update this model in line with design development.
4. For high and medium risk installations, develop a fire area assessment based on fire
types and platform vulnerabilities and continually update this model in line with design
development.
5. It should be noted that small bore pipework added late in the project may increase the
severity of the explosion overpressure. This may not be apparent until late in the
project.
Table 1.1 below summarizes the factors affecting fire and explosion risks by project phase
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 25 of 493
Table 1.1 - Summary of life-cycle factors
Project stage Design factors affecting fire and explosion hazards and risks
Concept selection and
definition
Offshore processing content (amount of equipment and potential leak
and ignition sources)
Offshore structure type
Location of living quarters (may be carried over to FEED)
Equipment layout
Decks plated or grated
Operation and manning philosophy (exposure of personnel to fire and
explosion risk)
FEED
Philosophy for engineering, piping, etc.
Deck sizing
Nominal explosion loading
Fire area sizing, firewall blast wall location
Determination of constructability
Element specific or low level performance standards set
Safety Critical Element (SCE) categorisation identification of high
criticality items
Detailed design
Design for overpressures, dynamic pressures
Finer points of layout
Firewater and vent piping, location and schedule
Supports for safety critical elements determined
Control systems designed
Verification of constructability
Assembly/writing of maintenance and inspection procedures
Construction
Small bore piping runs located
Changes to ensure constructability
Competence of construction
Assembly of Decommissioning procedures and assurance of integrity
during decommissioning.
Operation
Maintenance
Inspection
Change control
Hot work procedures
Decommissioning
Implementation of decommissioning procedures
Implementation of disposal procedures

FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 26 of 493
1.5 Hazard management systems
1.5.1 General
A structured approach to the management of fire and explosion hazards shall be put in place
by all organisations responsible for the design or operation of offshore facilities. This structure
shall ensure that the hazard management principles are implemented throughout the lifecycle.
The proposed structure shall fit within the overall safety management system for that company
and shall show the company safety policy is to be implemented.
The management of fire and explosion hazards is a complex process and requires
contributions from a very wide range of people, plant and processes. These may be required
to prevent, detect control, protect or evacuate. It is not acceptable simply to manage each
aspect in isolation to default standards and to presume that this will give an effective hazard
management system. It is necessary to have a fully integrated process that ensures that all
hazards have the necessary components in place and that these components all work
together effectively.
The approach may be based upon the generic frameworks outlined in HSG 65 [1.22],
API RP 75 [1.24] or ISO 14001 [1.25]. These all use the standard 5 step hazard management
process.
All of these elements need to be underpinned by a commitment to safety from the
organizations management at the highest level, with effective leadership to ensure that the
above elements are diligently carried out. The management needs to be aware of the safety
policy and aims and provide the necessary resources to ensure that these aims are fulfilled.
In summary, the following steps should be taken within the hazard management system;
Management responsibilities need to be accurately defined and clear boundaries for roles
and responsibilities set out.
All fire hazards shall be identified, analysed and understood by everyone with a part to
play in their management.
Every opportunity to minimise fire risks at source shall be identified, considered and
where practicable, implemented. This shall cover minimising the likelihood, severity and
the exposure of people and plant.
A practical strategy to manage each of the hazards shall be identified, documented and
implemented.
An appropriate combination of prevention, detection, control and mitigation measures
shall be put in place to implement the chosen strategies.
A strategy should take account of sensitivity of the installations overall risk profile to fire
hazards and should weight the mitigation and control measures accordingly.
All of these measures, including people, processes and plant shall be documented, have
clear ownership and shall have minimum performance standards
All causes shall be identified, understood and sufficient effective prevention measures
shall be implemented.
Where the effects of failure could require evacuation of overwhelm the installation, these
measures shall be specifically identified and shall be of high integrity.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 27 of 493
The operating limits for the whole facility shall be identified and clear instructions as to
the continued operation of the facility or use of additional controls whenever they are
exceeded.
The systems provided to detect fires shall be suitable for the hazard types and the
environmental conditions.
They shall provide sufficient information to warn personnel and to allow an assessment of
the hazards to be undertaken without hazardous personnel exposure.
There shall be effective isolation of all major external sources of hydrocarbons including
pipelines and the reservoir. This isolation shall be designed to survive all reasonably
foreseeable fire hazards on the facility.
The characteristics of those hazards which may require evacuation shall be carefully
studied so that the severity and potential for escalation may be reduced, thereby
minimising the need to evacuate.
Personnel shall be located so that their exposure to fire hazards is minimised
The systems provided to protect personnel, plant, structures and safety system shall be
suitable for the fire hazard effects.
Areas required to shelter personnel from fire effects and their supports shall remain
viable until either the incidents have been brought under control or full controlled
evacuation has taken place.
A minimum provision of routes, systems and arrangements to allow evacuation shall
remain viable under the effects of every incident which may require them
All reasonably practical steps to reduce the risks from fires shall be taken, concentrating
first on prevention and thereafter in descending order on control, the prevention of
escalation and evacuation.
1.5.2 Policy
Each company should have a coordinated set of policies which cover the principles listed
above and the means by which they are implemented and assured. Policies may be
considered at four levels of increasing detail and specific application:
Corporate policies: These should set the overall ethos of the company, its overall stance with
respect to HSE and its public expression of commitment to the protection of its personnel and
those with whom it interacts. It should set an overall standard of risk tolerability. This may be
an expression of individual risk covering all types of exposure including occupational and
major hazards risk. The organisation may also choose to set tolerable risk criteria for major
hazards which may result in multiple fatalities. Most organisations should also demonstrate a
commitment to continuous improvement. Corporate goals may also be set stating how the
business should be organised and run in pursuance of their risk criteria. It may also set
minimum standards relating to design and operations such as the requirements for the use of
codes and standards.
Regional and/or business policies: These should apply the overall corporate criteria to that
business or region and set minimum standards. This will relate to the development of risk
assessment processes and the criteria for acceptance in a wide range of activities from
discipline engineering applications such as structural assessments and instrument criticalities
to operations. The regional and/or business policies should set the framework for applicable
management systems, and set the minimum technical and operational standards which apply
across that region of business.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 28 of 493
Facility: specific policies and standards: These may be required for an individual facility. This
would result from the assessment of the facility and would apply controls or set minimum
technical requirements so that the risks are kept within the criteria. This may apply to
operational or technical limits
Other specific requirements: These would be the minimum standards for specific items of
plant, competence, or any systems needed to manage hazards effectively.
1.5.2.1 Planning
Planning covers five specific items and these apply both in design and in operation;
1. The identification of the hazards and the analysis to give the understanding outlined in
the hazard management principles;
2. The development of strategies to manage each of the hazards, identification of the
people, plant and procedures needed to manage them and the setting or confirmation
of the minimum standards for those elements;
3. The assessment of the risks from the hazards based on the chosen strategies and the
performance of the elements chosen to reduce risks to ALARP;
4. The assessment of the business infrastructure and resources needed to implement the
strategies both initially and thereafter to maintain them;
5. The documentation and communication of the hazard knowledge, the strategies and
the measures needed to implement them;
The planning process must be organised so that the understanding of hazards is in place
before key decisions are made rather than using it to retrospectively justify them. In design,
this requires the early development and resourcing of the risk assessment and management
process through the use of an HSE plan. It also needs commitment from the project managers
to ensure that this proactive culture flourishes and that everyone uses this information to
optimise the design. This includes the discipline engineers, particularly process and layout
who have the greatest opportunities to maximise the inherent safety. The specialist risk and
safety engineers should act in support of these disciplines in furtherance of a safer design
rather than as a discrete and independent group providing data for regulatory compliance.
Operations should be represented both to provide their knowledge of the causes and risks and
to agree the hazard strategies.
Typically the HSE plan will include each of the following activities for each of the project
stages:
Concept development and selection:
Identification of the primary generic risk drivers; i.e. those that will apply whichever
concept is chosen;
Identification of different viable concepts;
Hazard identification and qualitative risk ranking;
Comparison and selection of the concept.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 29 of 493
Front end engineering design, (FEED):
Update and more thorough hazard identification;
Initial characterisation of the hazards; their cause, severity, consequence and potential
for escalation;
Use of the hazard knowledge to optimise the inherent safety during the early process and
layout design;
Selection of the strategy and associated primary systems to manage each hazard;
Selection of scenarios and detailed hazard characterisation (HAZOP, fire and explosion
risk analysis, escalation analysis, vulnerability studies, evacuation and emergency
response analysis);
Setting of the Performance Standards for each system;
Risk assessment (This may be quantitative where required but is not essential).
Detail design:
Design of the systems to meet the Performance Standards;
Preparation of the operational procedures.
1.5.2.2 Implementation
Putting the hazard decisions into practice and maintaining the minimum standards throughout
the lifecycle requires the provision of a suitable and supportive business infrastructure. The
infrastructure applications should include but not be limited to design engineering, integrity
management, procurement, HSE, training, emergency response. The requirements arising
from the planning process should be embedded into each business process. This should
include the identification or cross referencing of elements critical to hazard causation and/or
management and the correct documentation of the applied hazard management process.
The operational procedures and controls developed at earlier stages of project development
should be developed in conjunction with the designated operating team. The procedures
should cover the prevention of accidents and management of incidents. The emergency
response plans should acknowledge the potential hazards and their escalation.
1.5.2.3 Measurement
Measurement should include the verification that the hazard identification, analysis and
management process has been thorough, is complete and of adequate quality. Thereafter,
there should be confirmation that it is working, that there is a widespread understanding of
risks and hazards, that the linkages between hazards and critical elements are in place and
that the resourcing and infrastructure are sufficient. At a more detailed level, there should be
confirmation that the design of the plant is appropriate and that the proposed standards of
performance for people, processes and plant are being met.
1.5.2.4 Review and improvement
The review should examine trends from the measurement processes. It should be consider
how the overall risks are changing including the specific performance history of plant, changes
in personnel and their acquired competence. It should give structured proposals for investment
in future risk reduction.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 30 of 493
2 Aims and principles of fire and explosion hazard
management
2.1 Aims of fire and explosion hazard management
Aims define what the philosophy requires of the end product. The top level goals define what
is required from the overall process. These should confirm that:
all fire and explosion hazards have been identified, analysed and are understood;
overall risk from all major accidents including fires and explosion are assessed, and
are "as low as reasonably practicable" (ALARP);
fire and explosion risks are defined as the risks from the initiating event and
subsequent escalation;
an appropriate combination of prevention, detection, control and mitigation systems
are implemented and maintained throughout the lifecycle of the installation;
the systems provided to protect personnel from the effects of fires and explosions
are suitable for these hazardous events and have Performance Standards
commensurate with the required risk reduction;
the design, operation and maintenance of the systems will be undertaken by
competent staff who understand their responsibilities in the management of the
hazards and possible hazardous events;
any changes to the installation which may effect the likelihood or consequences of
fires and explosions are identified, assessed and the systems revised to take the
changes into account as necessary.
These are achieved by;
the identification of all areas of the installation where there is potential for fire or
explosion events to occur;
the elimination of the potential for fire or explosion events to occur, or if the
previous step is not achievable,
the minimisation of the probability of occurrence of fire or explosion events,
the minimisation of the consequence of fire or explosion events
the implementation of a safety management system which ensures that the above
goals are consistently achievable;
the implementation of operational management systems to minimise the potential
for fire or explosion events to occur throughout the lifetime of the installation
including decommissioning and removal.
the minimisation of exposure of personnel to fire or explosion events and to
subsequent escalation events;
the minimisation of the environmental impact from fire or explosion events;
the minimisation of asset loss from fire or explosion events;
the determination of key fire or explosion hazard parameters;
suitable and sufficient assessments of the consequences and risks associated with
the defined fire or explosion hazards;
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 31 of 493
A further set of more specific goals ensure that personnel will reach a safe location in the
event of a major accident event:
that one escape route to the Temporary Refuge (TR) remains functional at all
times;
the TR and its supports will maintain their integrity in all design explosion events;
that a means of evacuation to be available at all times;
that all large off-site inventories are isolated in the event of a design explosion
event.
the ability of personnel to escape from, and to shelter safely from the effects of an
explosion event and the ability to evacuate to a safe location where recovery can
take place is not compromised.
Effective, economic FEHM depends on the appropriate timing and use of resources This can
be achieved by following the principles for identification and assessment of the foreseeable
hazardous events, see Section 3.1, and for selection and specification of safety systems see
Section 9: This approach is structured around the life cycle concept described in Section 2.10.
The following summarise the main principles:
fire and explosion assessment should commence very early in the design and should be
used as one of the bases of hazard management throughout the installation lifecycle;
everyone involved in the design, commissioning, operation, maintenance and
modification of the installation should have sufficient knowledge of the hazards and their
contribution to the overall risks;
the principles of inherent safety should be applied early in the design so as to eliminate or
reduce hazards so far as is reasonably practicable;
safety systems should be selected based on the hierarchy of prevention, detection,
control and mitigation;
resources should be assigned to systems taking account of the risks from the hazardous
events and the role of the system in reducing them;
the hazard management process should be documented and communicated to
operations personnel so that they have adequate information about both the hazards,
hazardous events and safety systems provided to manage them;
the principles of industry adopted quality management systems should be followed.
2.2 Reasonable practicability
Operators/Owners of offshore installations must demonstrate that the risks to personnel from
all major accidents have been reduced to a level which is as low as reasonably practicable.
ALARP can be demonstrated by quantification or qualitatively by using experienced
judgement. For all hazardous events including fires and explosions a more formal
demonstration of quantified risk assessment is required.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 32 of 493
In weighing the costs of risk reduction measures the principle of reasonable practicability
applies so that there should be no gross disproportion between the cost of preventative or
protective measures and the reduction of the risk that they would achieve to those already in
place.
In endeavouring to reduce risks to ALARP, resources should be concentrated on the primary
risk contributors and on the areas or systems where the greatest risk reduction can be
achieved for the expenditure. This must be a top down process starting with the hazard
identification and consideration of areas for improvement and not a bottom up process
starting with the safety systems. It should be based on the need for improvements or
enhancements and not on the ready availability of particular systems.
Appropriate standards and accepted industry practice are tools to achieve and demonstrate
reasonably practicable risk reduction. These should be appropriate to the hazards and
hazardous events on the particular installation so that they contribute significantly to the
reduction of risk.
When concentrating on the primary risk contributors, care should be taken not to miss
reasonably practical ways of reducing the risk from apparently less serious events.
Unacceptable region
10 3 P
The ALARP or tolerability
region (risk is undertaken
only if a benefit is
desired)
Broadly acceptable
region
Risk cannot be justified
except in extraordinary
circumstances
Tolerable only if further
risk reduction is
impractical, or the cost is
not proportionate to the
benefit gained
Negligible risk
Risks closer to the unacceptable region merit a closer examination of potential risk
reduction measures

Figure 2.1 - The ALARP triangle
2.3 Performance standards
For any goal it is usually possible to identify one or more measures whose performance will be
a reasonable indicator of how successfully the goal is achieved. These can be described as
Performance Standards and a general definition is shown below:
A Performance Standard is a statement, which can be expressed in qualitative or quantitative
terms, of the performance required of a system, item of equipment, person or procedure, and
which is used as the basis for managing the hazard - e.g. planning, measuring, control or audit
- through the lifecycle of the installation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 33 of 493
When characterising performance in relation to the activities associated with an offshore
installation, it is helpful to consider a hierarchy of Performance Standards, as a minimum, 2
levels should be adopted;
High level Performance Standards can be applied to the organisation, the installation as
a whole or to the major systems on the installation (e.g. the Temporary Refuge or the
process system).
Lower level Performance Standards may be used to describe the required performance
of individual systems or components (as necessary) which contribute to the high level
Performance Standards.
An important principle to be adopted in setting Performance Standards is that the numbers
developed and the level of detail they contain should be commensurate with the risk being
managed. Thus, setting Performance Standards for systems, sub-systems or components of
systems that contribute little to the management of risk should be avoided.
Performance standards at this level may relate to the principal systems, used to detect, control
and mitigate fires and explosions. However whatever performance standards are selected,
three key characteristics should apply.
1. The selected items should make a significant contribution to the overall acceptability of the
arrangements for managing fire and explosion hazards.
2. The parameters constituting the Performance Standard should be directly relevant to the
overall achievement of the system goal
3. The Performance Standard should be capable of verification.
The process of setting the more detailed low level Performance Standards therefore involves a
review of the required performances under the anticipated emergency conditions of the
systems, sub-systems or equipment that make up the fire and explosion arrangements. The
review should identify those items that make the most significant contribution to the overall
acceptability of the arrangements. It is necessary to identify those items where significant
performance deviation would jeopardise the arrangements to the extent that the strategic
objectives set for the installation would not be satisfied. It is also important when undertaking
this review to determine what effective barriers to the occurrence of a particular hazard are
provided. The number and integrity of these should take into account the magnitude of the
hazardous event and the likelihood of the initiating event in the absence of these barriers. The
assessment should indicate the most important factors contributing to the success of the
system.
For engineered systems, these can be expressed in terms of functionality, availability,
reliability, survivability and the degree of interaction with other safety systems. The low level
Performance Standards should relate to the overall ability of a system to fulfil its role, the
probability of the system operating successfully when required and its ability to continue to
function during a fire or following an explosion.
One such hierarchy of Performance Standards that has been used in the industry is;
1. Risk-based Performance Standards (describing the high level goal in terms of a statement
of risk);
2. Scenario-based Performance Standards (describing the generic fire and explosion
scenarios that could occur on the installation);
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 34 of 493
3. System-based Performance Standards (describing the arrangements and performance
described for equipment, sub-systems etc. as for the low level descriptions above).
Performance Standards are particularly important and are a UK statutory requirement for
defining the performance of elements that contribute to the management of a specific hazard.
2.4 Safety critical elements
The Safety Critical Element (SCE) is defined as any structure, plant, equipment, system
(including computer software) or component part whose failure could cause or contribute
substantially to a major accident, and thus includes any measure which is intended to prevent
or limit the effect of a major accident. SCEs should have fulfilled their function or remain
operational. For example, plastic deformation of the structure is acceptable provided collapse
does not occur thus allowing other barriers to hazards to remain in-place and adequately resist
any subsequent fires or other hazards.
It may also be helpful to consider a hierarchical approach to the identification of SCEs. It is
suggested that the number of SCEs (systems, equipment or functions) requiring detailed
assessment are classified into three levels of criticality, these are illustrated with respect to the
explosion hazard as below, using the Ductility Level Blast (DLB) and Strength Level Blast
(SLB) defined later in this document.
Criticality 1 Items whose failure would lead direct impairment of the TR or emergency
escape and rescue (EER) systems including the associated supporting structure.
Performance standard These items must not fail during the DLB or SLB, ductile response
of the support structure is allowed during the DLB.
Criticality 2 Items whose failure could lead to major hydrocarbon release and escalation
affecting more than one module or compartment. (Indirect impact on the TR is possible
through subsequent fire).
Performance standard These items must have no functional significance in an explosion
event and these items and their supports must respond elastically under the strength level
blast (SLB)
Criticality 3 Items whose failure in an explosion may result in module wide escalation, with
potential for inventories outside the module contributing to a fire due to blowdown and or
pipework damage.
Performance standard These items have no functional significance in an explosion event
and must not become or generate projectiles.
2.5 Fire hazard management philosophy
2.5.1 Introduction
In general terms a release of hydrocarbon with immediate ignition will result in a fire; release of
an inflammable vapour or gaseous mixture followed by later ignition (i.e. when the cloud of
vapour or gas is adequately large) may result in an explosion. Consequently some of the
probabilities, causes, methods of prevention and control of releases are identical for both the
fire and explosion hazard. Indeed, many of the hazard management principles and practices
apply to both hazards. This aspect is explored more in Section 4.2.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 35 of 493
In this section the goals which should be achieved in designing for and managing fire hazard
are identified, the legislative basis is reviewed and some high level Performance Standards
are given.
The features of an effective Safety Management System (SMS) are identified and the choice
and management of detection, control and mitigation systems is discussed. The main
characteristics of the fire hazard are also identified. The techniques of inherently safer design
described in Section 2.7 are fundamental to the most effective approach to eliminate, prevent
and mitigate the fire hazard particularly for new designs.
2.5.2 Hazard philosophy
The advantage of an inherently safer design or the Inherent Safety design approach is that it
attempts to remove the potential for hazards to arise. It does not rely on control measures,
systems or human intervention to protect personnel.
In order to focus effort where it is most needed, a risk screening method is described in
Section 2.8 which classifies installations and compartments according to the level of their fire
risk. The measures for frequency and consequence severity are based on process complexity
and the exposure potential for people on board. These measures are combined in a risk matrix
to give low, medium and high risk categories. The risk level is an indication of the level of
sophistication to be used in the fire assessment process.
Nominal loads for jet and pool fires have been available since the publication of the Interim
Guidance Notes (IGN) [2.1] in the form of heat fluxes for engulfed objects in open conditions.
A number of alternative values have since been published including nominal fire loads for
confined and ventilation controlled fires [2.2]. Updated guidance on the selection of fire loads
is given in Section 5.4 with recommendations on the limits of applicability.
The overriding requirements for hazard management philosophy are to:
protect personnel in the TR;
minimise injuries and fatalities from the initial event;
provide escape to TR and other means of escape/evacuation.
The philosophy should ensure that:
the hazard scenarios are addressed;
suitable accidental loads are developed (either risk based and/or prescriptive);
plant and equipment minimises escalation, personnel within the TR do not continue to be
threatened by the incident, until such time as the hazard has dissipated to a safe level via
shutdown, blow down, or other means;
personnel are able to escape to a safe location away from the hazard.
The identification of key SCEs and corresponding Performance Standards provide the
demonstration that such a philosophy has been met.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 36 of 493
2.5.3 Prescriptive vs. performance based design
Prescriptive design against the fire hazard can be a valid alternative, for example for low risk
installations. This method is based on standardized guidance or requirements, without
recognition of site-specific factors. The size of the facility, hazards posed or specific water
demand is not considered. Prescriptive approaches to fire design generally are a result of
compliance with regulations, insurance requirements, industry practices, or company
procedures. These are generalized approaches largely based on past incidents.
Performance or scenario based design adopts an objective based approach to provide a
desired level of fire and explosion performance. The performance based approach presents a
more specific prediction of potential fire hazards for a given system or process. This approach
provides solutions based on performance measured against established goals or performance
standards rather than on prescriptive requirements with implied goals. Solutions are supported
by a Fire Hazard Analysis (FHA) or, in some cases, a fire risk assessment.
2.5.4 The application of fire hazard management
A fire risk assessment takes account of the consequences and the likelihood or frequency of
the fire and explosion scenarios occurring. A performance based approach looks at
determining the need for fire and explosion design on a holistic basis.
Performance objectives and measures allow the designer of fire systems more flexibility in
meeting requirements and can result in significant cost-savings compared with the prescriptive
approach. Conversely, for small projects, the cost of performance based design may not be
cost-effective.
In a scenario or performance based approach release scenarios are postulated and their
consequences and probabilities of occurrence determined. For existing installations, reliable
estimates of fire loads, extents and durations may be available from previous assessments.
The most severe fires from the point of view of initial rate of release may be less frequent and
less durable than fires of lesser severity and hence may present a smaller risk. Although the
initial extent of the engulfed region may be greater, the lower duration may result in lower
quantities of heat being delivered to those equipment items and structural members within the
affected region. However, it is important to account for apparently small fires that on initial
evaluation do not appear to have the potential for escalation. Dismissing such small events
can distort the Installations risk profile.
The scenarios considered, should be sufficiently varied to cover the following:
severe, but unlikely cases which give short duration fires with the potential for the
maximum number of immediate fatalities
small long duration scenarios which still have sufficient size to cause local escalation.
intermediate scenarios which have the greatest potential for escalation or platform
impact whilst lasting long enough to realise this potential.
Design or Dimensioning fire scenarios are selected on the basis of the risk they present and
should be accommodated by the safety critical elements (SCEs) of the installation which will
include parts of the structure, piping and equipment.
It will be necessary to consider the effect of non-availability of mitigation measures such as
shut-down, blow-down, venting, deluge or barriers in the construction of design scenarios.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 37 of 493
Some scenarios may also assume a prior explosion has occurred with fire being an escalation
event. The identification of the common-cause failure modes that may defeat several
mitigation measures needs to be carried out in a rigorous manner. Multiple or coincidental
failures can lead to events moving from Minor or Controllable to Extreme, for example, fires
that disrupt the UPS or auxiliary power supplies or common Installation air supplies.
It is suggested in this Guidance, that the number of SCEs which need to be considered in
detail is reduced by classification into criticality categories with respect to the fire hazard.
The direct consequences of fires are immediate fatalities or delayed fatalities by the blockage
of access ways by radiation or the development of a hot gas layer, smoke and fume
generation, structural weakening and possible collapse. Further escalation through
subsequent release of inventory may occur.
The consequence measures of relevance to fires are:
intensity, that is heat flux and temperature;
extent, that is the area or volume occupied by flame, affected by radiation or by
combustion products;
duration;
frequency, that is the probability of occurrence depending on the probability of
immediate or delayed ignition;
mitigation effectiveness will depend on detection, inventory isolation and deluge
activation together with the probabilities that these measures will be initiated;
radiation thresholds for personnel safety and escape, the integrity of equipment and
supporting structure.
Reducing risks to ALARP must be demonstrated in all cases, both through the justification of
the choice of design scenarios and from a determination of the impairment frequency of the
SCEs under the fire loads.
An acceptable level of risk can be identified within the ALARP framework, which identifies the
acceptable frequency of exceedance of the severity of the design or dimensioning scenarios.
Typically this frequency of exceedance will be of the order of 10
-4
to 10
-5
per year depending
on the risk to people on board, the impact on the SCEs and the overall individual risk including
that from other hazards.
Following NORSOK [2.3], ISO [2.4] uses a threshold probability of exceedance level (10
-4
per
year) below which individual contributing scenarios need not be considered further if the
impact on personnel is low enough (i.e. numbers of personnel affected). Events with
probabilities above this level are considered to be Dimensioning, and require further analysis
to determine the size and extent of the resulting loading and subsequent effects.
This Guidance proposes a similar approach, albeit couched in different terms. An event will be
considered depending on whether the event impinges directly on the Temporary Refuge with
probability of exceedance > 10
-5
per year. Events directly affecting other regions where a
barrier may be present to prevent impingement on the TR are considered if the probability of
exceedance is greater than 10
-4
per year.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 38 of 493
2.6 Understanding the fire and explosion hazard
2.6.1 Understanding the fire hazard
Understanding the risks from fire hazards is the key to their minimisation. This applies at all
levels of an organisation from the directors to those designing and operating the facilities. This
knowledge should be used to inform people making critical decisions both in design and
operation. It should not be acquired after these decisions have been made in order to
retrospectively justify them. In other words, the knowledge should be used proactively to
reduce risk. The type of understanding differs according to the level of people in the
organisation and the responsibilities that they hold, some examples are listed below.
Senior Management: They need to know the overall level of risk for the facilities to decide if
the design is viable or if existing operations may continue.
Project or Facilities Management: They need to know the pattern of risk by facility and the
proportion of that risk which comes from different hazards such as fire. This will allow them to
decide how the facilities are to be designed and operated. It will also allow them to provide
sufficient resources.
Discipline Engineering and the Supervision of Operations: They need an overall understanding
of all the hazards for which they have responsibility. The understanding of the causes, severity
and consequences will allow them to decide how each of the hazards will be managed and the
measures needed to do so.
Designers, Operators and Technicians: They need to understand the hazard characteristics so
that they may design, operate and maintain critical elements to suit the needs of the hazards.
It is essential that the information gained from hazard and risk studies is distilled, documented
and communicated so that every level and person is kept informed. It must also be kept up to
date. It is a living picture which becomes progressively more detailed and accurate as the
design progresses. It also changes throughout the life of the facilities as different activities take
place and the fields mature.
2.6.2 Understanding the explosion hazard
Gas explosions can be defined as the combustion of a premixed gas cloud containing fuel and
an oxidiser that can result in a rapid rise in pressure. Gas explosions can occur in enclosed
volumes such as industrial process equipment or pipes and in more open areas such as
ventilated offshore modules or onshore process areas.
For an explosion to occur a gas cloud with a concentration between the upper flammability
limit (UFL) and lower flammability limit (LFL) must be ignited and amongst other contributing
parameters, the overpressure caused by the explosion will depend upon:
1. The gas or gas mixture present
2. The cloud volume and concentration
3. Ignition source type and location
4. The confinement or venting surrounding the gas cloud
5. The congestion or obstacles within the cloud (size, shape, number, location)
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 39 of 493
6. Cloud density non-homogeneity
7. Ignition timing
Confinement is defined as a measure the proportion of the boundary of the explosion region
which prevents the fuel/air mixture from venting which is the escape of gas through openings
(vents) in the confining enclosure.
Congestion is a measure of the restriction of flow within the explosion region caused by the
obstacles within the region.
Gas explosions in more open environments can also lead to significant overpressures
depending on the rate of combustion and the mode of flame propagation in the cloud. All of the
above points from 1 to 5 can affect the explosion overpressures in this type of environment.
Two types of explosion can be identified depending on the flame propagation rate:
A deflagration is propagated by the conduction and diffusion of heat. It develops by feedback
with the expansion flow. The disturbance is subsonic relative to the un-burnt gas immediately
ahead of the wave. Typical flame speeds range from 1-1000m/s and overpressures may reach
values of several bars. The overpressures are not limited to the 8 bar maximum typical of
completely confined explosions.
A detonation is propagated by a shock that compresses the flammable mixture to a state
where it is beyond its auto-ignition temperature. The combustion wave travels at supersonic
velocity relative to the un-burnt gas immediately ahead of the flame. The shock wave and
combustion wave are coupled and in a gas-air cloud the detonation wave will typically
propagate at 1500-2000 ms
-1
and result in overpressures of 15-20 bar.
Most vapour cloud explosions offshore would fall into the category of deflagrations.
A typical vapour cloud explosion on an offshore installation would start as a slow laminar flame
ignited by a weak ignition source such as a spark. As the gas mixture burns, hot combustion
products are created that expand to approximately the surrounding pressure. As the
surrounding mixture flows past the obstacles within the gas cloud turbulence is created. This
turbulence increases the flame surface area and the combustion rate. This further increases
the velocity and turbulence in the flow field ahead of the flame leading to a strong positive
feedback mechanism for flame acceleration and high explosion overpressures.
Large components of the structure such as solid decks or walls experience loads due to the
pressure differences on opposite sides of the structure. Typically within an explosion there will
be a strong variation of pressure in space and time. There will typically be localised high
regions of overpressure with lower values of average pressure acting on large components.
The overpressure at a location within a gas explosion will typically rise to a peak value and
then fall to a sub atmospheric value before returning to zero overpressure.
The duration of the positive phase in an explosion can vary greatly with shorter durations often
associated with higher overpressure explosions. Typical durations range from 50 to
200 milliseconds with longer durations common in large open areas such as the decks of
Floating Production, Storage and Offloading vessels.
For smaller objects, such as piping, the overpressures applied to the front and reverse side of
such items will be of approximately the same magnitude at any moment in time and in this
case the overpressure difference will not be the only load component on the object. For this
type of object the dynamic pressure associated with the gas flow in the explosion will
dominate.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 40 of 493
Small objects may be picked up during the explosion, creating secondary projectiles. The peak
energy for typical projectiles may be calculated from the dynamic pressure load time history
and their mass.
Secondary, external explosions may result as the unburnt fuel/air mixture comes into contact
with the external (oxygen rich) atmosphere. These can affect the venting of the compartment
and enhance the overpressure within.
A blast wave will be generated which will propagate away from the explosion region and may
impinge on adjacent structures.
2.6.3 Identification and classification of fire and explosion hazards
It may be helpful to classify fire hazards according to their potential for harm. This may be
done by assessing what is in place either in a design or an existing facility and determining the
classification. It is preferable to actively manage the fire hazards such that steps are taken to
actively lower their classification by reducing the severity of the effects. This may be done by
following the principles for inherently safer design (see Section 2.7) or by applying or
optimising hazard management measures to minimise the size of releases, their location,
effects on the facility, the rate of release and the duration. One method of classification
follows.
Catastrophic: As the name suggests, these events would overwhelm an installation and it
would be impractical to counteract the effects such that the lives of those on board could be
saved. This type of event should be designed out or very high integrity preventative measures
provided such that the likelihood is minimised.
Evacuation/Extreme: This type of event would have a major impact upon a large part of the
installation such that the effects upon people, both physical and psychological, would be such
that evacuation would be necessary. It would also apply to those events where the potential
for escalation is widespread including structural, process, safety systems or the impairment of
muster and escape routes. Typically these events are those which would give prolonged
effects beyond the source module, in particular external flaming and dense smoke effects. In
some cases it may be possible to suppress the widespread effects of these fires reducing the
categorisation to the lower, controllable, level. If not, the effects must be fully understood and
premature catastrophic escalation delayed, and personnel protected from smoke and heat
until evacuation has been completed. By their nature these are inherently low frequency
events, requiring a significant sized release from a major inventory and/or its combination with
safety system failures such as ESD.
Controllable: These events have the potential for local fatalities and may also be capable of
escalation to a scale requiring evacuation. However, the moderate scale of the effects should
allow these events to be controlled such that further escalation is prevented and evacuation is
not essential to preserve life. Typically, the prolonged effects of these events will be limited to
one module or process area and will be of finite duration. They would be associated with
smaller releases from moderate inventories. In these cases effective control of the source
inventory and the prevention of escalation will be critical. It may be practical to extinguish
some of these events but in other cases, this may not be possible or may be dangerous in
which case, they should burn out under controlled conditions.
Minor: These events are of a very small scale. They may cause local injuries but would not
have either the scale or duration to cause critical escalation. They may lead to damage to
plant causing financial loss but not major loss of life. These events can be managed by limiting
the size of the event and allowing it to burn out. Protection would only be needed for asset
protection.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 41 of 493
2.6.3.1 Causes and likelihood of hydrocarbon releases
The causes of hydrocarbon releases are numerous and it is essential that a full causation is
carried out so that effective preventative measures can be put in place. These causes can
generally be broken down into three categories:
1. human or procedural error;
2. plant or equipment failure;
3. systemic failure; i.e. inherent weaknesses in the business processes and infrastructure
supporting design and operation.
Lack of maintenance, particularly over long periods may distort the understanding of the
underlying causes of failures. Effective maintenance regimes are essential to determining the
likelihood of plant failures.
The likelihood of an event is a function of the propensity of the causes; e.g. the corrosivity of
the fluids, the number of times containment is deliberately breached or the number of weak
points such as flanges or tappings. It is also a function of the understanding of those causes
and the effectiveness of measures which are put in place to manage them.
Statistical data form a good start point from which to list causes and to determine likelihood.
This should then be augmented with the knowledge of engineers, technicians and operators to
give a more accurate picture for each facility. HAZOP procedures will give a rigorous
identification of process causes but the overall examination should be sufficiently broad to
address external and human effects. This examination should be fully documented so that
there can be assurances that preventative measures are suitable and sufficient.
For statistical data, the most frequent sources of the hazard as given by the history of releases
experienced to date are documented as follows.
The HSE document OTO 2001 055 [2.5] states that for the UK sector of the North Sea:
61 % of all releases are from pipework systems
11 % of all releases are from small bore piping
15 % of all releases are from flanges
14 % of all releases are from seals and packing
Of the causes;
11 % are due to incorrect installation
26 % from degradation of materials (excluding corrosion and erosion)
11 % of all releases are due to vibration/fatigue
19 % of all releases are due to corrosion and erosion
It is considered that 40 % of equipment related releases are attributable to poor design and
38 % to inadequate inspection and condition monitoring.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 42 of 493
Avoidance of potential leak sources in design therefore needs to consider these above issues
in particular. The importance of operational aspects is also shown in proportion of leaks
attributable to poor inspection and monitoring.
Sources of release data include WOAD [2.6], OREDA [2.7] release statistics published
annually by the HSE and UKOOA [2.8, 2.9, 2.10 and 2.11]. The Minerals Management Service
(MMS) of the US also publishes data on incidents on the Gulf of Mexico.
2.6.3.2 Ignition causes and probability
The probability of ignition will depend upon the following factors.
The rate and duration of the release and the size of the consequent gas cloud
The location of the release
The type of fuel and the proportion of gas or volatile vapours which is generated in the
short term
The nature of the release; whether high or lower pressure. The turbulence caused by
high pressure gas releases will cause effective mixing with the air to give a well defined
flammable cloud. High pressure liquid releases will encourage fine droplet formation
and increase the vaporisation of any light ends.
The flammability characteristics of the gases and vapours. Each different gas or vapour
has a specific flammability range, from a lower flammability limit; through stoichiometric
and rising to a higher limit above which ignition should not occur. Very large releases
may have a non flammable rich core but will be surrounded by a flammable region
which may engulf ignition sources as it spreads away from the point of release. Each
gas or vapour will also have a specific auto ignition temperature ranging from
200 - 550 C. such that contact with hot surfaces such as an exhaust turbocharger
would cause ignition
The dispersion characteristics; whether there are heavy vapours which will descend or
lighter gases which should rise.
The confinement of the escaping vapours and gases by floors, ceilings or walls. These
may also cause flammable gases to be directed towards areas without flameproof
equipment
The ventilation characteristics in the areas, whether forced or natural and the variation
of those characteristics with wind strength and direction
The characteristics of the fluid and its release, where this might build up static
The presence of sulphurous impurities in the fluids which might lead to the formation of
pyrophoric scale
The number of fixed ignition sources and the standard of their maintenance, if
designed for use in flammable atmospheres, including the presence or not of Ex
equipment.
The proximity of the release to areas which are classified as safe and therefore are
not fitted with flameproof equipment.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 43 of 493
The gas detection philosophy and the local and wider shutdown of ignition sources
upon detection
The detection of gas ingress at the air intakes to enclosures such as accommodation
or equipment rooms and the closure of dampers.
The hot work philosophy on the facility, the number of these activities and the
effectiveness of their control.
The possibility of ignition being caused by the action of personnel carrying out
emergency response actions such as plant shutdown causing sparks at electrical
breakers.
Ignition probabilities have been widely studied and this work is summarised in recent work for
UKOOA studying ignition probabilities [2.12]. The probability of ignition should be determined
using that guidance together with an assessment of the characteristics listed above. As with
the likelihood of release, it is possible to influence the probability of ignition by design, good
maintenance and operational controls.
2.6.4 Likelihood
The likelihood of an explosion will depend upon the likelihood of occurrence of a gas cloud and
delayed ignition. The following parameters will influence the potential likelihood of an
explosion:
hazardous inventory complexity, i.e. the number of flanges, valves, compressors and
other potential gas leak sources;
the type of flanges, valves or pipework, some generic types of flange tend to have lower
leak frequencies associated with them, e.g. hub type flanges;
the number of ignition sources within the potential gas cloud;
the ventilation regime;
the equipment reliability and the maintenance philosophy.
The likelihood considerations tend to align closely with the consequence factors in that the low
consequence installations will tend to be small and therefore less complex. Large installations
will have more potential leak and ignition sources and therefore a greater requirement for
intervention and maintenance.
Low event likelihood installations and compartments will have a low equipment count. The
frequency intervention of 6 weeks or more is also recommended as a criterion as this will be a
surrogate for equipment count and reliability as well as a measure of maintenance risk with
respect to explosion.
Medium event likelihood is suggested by an NUI with equipment count greater than for the
low case. Similarly, where the planned frequency of maintenance/intervention is greater than
a 6-weekly basis then this suggests a higher or less reliable class of equipment with medium
level of potential for explosion.
Where the complexity of the process in a compartment requires a permanently manned
installation this suggests a high equipment level and therefore potentially a high likelihood of
an explosion event, a large number of potential leak sources and high ignition potential.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 44 of 493
Where there is doubt regarding the category into which an installation should fall, it is
recommended the category with next higher likelihood is used.
2.6.5 Fire hazards: understanding the source
2.6.5.1 General
It is essential that the source of the hydrocarbons is examined and fully understood in order to
examine the fire hazard effects resulting from a release.
Key parameters would include the range of release rates and characteristics which can
originate from any part of the plant. Each parameter would be associated with a failure causing
a specific hole size. The release rate would then vary with time depending upon the source
conditions of fluid, pressure, inventory, location within the hydrocarbon system and the
functional characteristics (or the failure) of control systems such as ESD, depressurisation,
and drainage.
A detailed picture of the source terms from each inventory will allow the identification of the
cases requiring analysis of the fire characteristics. If hazards are being classified as described
above, it will give an initial indication which hazards fall into each category. It would show for
example the process events which simply do not have sufficient inventory to realistically cause
escalation, those which should be controllable and the events which require evacuation. For
individual hazardous inventories, it would show the approximate conditions of hole size and
control system operation which would determine whether it was controllable or require
evacuation.
2.6.5.2 Reservoir hazards
Direct releases from the reservoir may occur due to well intervention such as drilling or
workover. In these cases the releases are likely to occur within the drilling facilities; typically at
the bell nipple. These are likely to be of indefinite duration if the primary well control and
blowout prevention systems have failed. Such releases may also contain drilling fluids,
cuttings and other debris. In the case of blowouts from an oil reservoir with delayed ignition,
the oil may build up over much of the top deck leading to a particularly hazardous and
unpredictable situation when it ignites. Reservoir and drilling engineers should be consulted to
identify the fluid composition and calculate the realistic flow rates. In most cases, the releases
should be near the top of the platform with the flames rising above it. This will lead to rapid
collapse of the derrick and severe radiation onto the top deck. It the release is below the
drilling rig structure, this may collapse onto the wells leading to progressive escalation. A
shallow gas blowout is another case in which a pocket of shallow gas is controlled by venting
through a diverter. Diverters can fail due to erosion giving a large gas release of prolonged but
finite duration within or below the drilling facilities with possible escalation as described above.
Again drilling and reservoir engineers should be consulted to determine the possible flowrates
and their likelihood.
Large continuous releases from the Christmas Trees are much less likely due to the multiple
valve isolation. They may occur during wire lining but only if there are multiple failures of the
barriers. A more realistic scenario is a release from the lubricator via leakage through the
valves and wireline BOP. In gas-lifted wells, it is possible that the gas within the annulus could
backflow into the wellbay with typical inventories and pressures of up to 10 tonnes and up to
130 bar. The potential for escalation to other wells should be examined but is unlikely if they
are fitted with effective downhole isolation or have a heavy-duty integrated Christmas Tree
valve assembly. Flowline releases are considered to be part of the process hazards as they
are downstream of the well isolation valves.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 45 of 493
Completion failures may result in leakage from the reservoir into the well annuli or around the
cement such that oil or gas may surface round the outside of the well at the seabed. This may
arise during the initial completion of the well. It may also arise in later life due to seismic action
or the deterioration of the well bore, for example by corrosion. Well completion engineers
should be consulted about the possibility of this occurrence, the potential flow rates and the
locations at which hydrocarbons may be released. The effects of fires on or under the sea are
discussed in Sections 5.2.3.6 and 5.2.4.
2.6.5.3 Process hazards
The process plant can have up to 40 sections which are segregated by ESD valves. Each of
these is a source with individual characteristics of the fluids, pressures and volumes. Typically,
the processing will include;
Production fluids manifolding and mixing: The manifolds collect the reservoir fluids from the
wells via the flowlines, mix the fluids and direct them to the appropriate separators. They
contain well fluids (see below) which may be a mixture of oil, condensate, gas, water and other
materials such as sand. The inventory will be based on the combined volumes of these pipes.
It will range from less than 500 kg in a mature, low pressure gas field up to 5 tonnes of oil for a
new field. In oil facilities running at low pressures or using gas lift, the fluid can be three phase
with a relatively low density. It may also have a high water cut giving small inventories which
may not have the potential for escalation if rapidly isolated. The process conditions,
aggressive nature of the fluids and the complexity of the piping give a relatively high probability
of a release, particularly large bore flowline failures which may be caused by corrosion or
erosion. Potential process backflows of gas and 2-phase fluids from the gas lift inventories into
topside blowdown systems also needs to be addressed when analysing topside hazards.
Water, gas and oil/condensate separation: This takes place in large vessels, generally over
2 3 stages. The liquids have a 3 10 minute residence time. Typically, these vessels have
total volumes up to 100 m3 and operate at pressures from 70 down to 3 barg. The flammable
liquid inventories can be up to 30 tonnes but this may be divided in half by weirs which can
reduce the amount which can realistically be released by half. There are relatively few release
points providing that there is effective isolation at the outlet. Typically these are tappings for
instruments and the possibility of corrosion in the body or welds of the separator vessel. These
liquid inventories have the potential to overwhelm a moderate sized platform with a large fire
lasting long enough to cause major escalation, particularly if the separators are located lower
down in the topsides. They may have less of an impact if located on an open deck such as an
F(P)SO as the smoke and flames can freely rise above the rest of the facility. The potential for
harm is governed by the release pressure; see below under liquid fires. If these vessels are
depressurised, the fires become much more controllable and the time to depressurise is
critical. If they can brought below this pressure before escalation can occur or evacuation is
required, this may reduce the classification of these hazards to the controllable level, at least
for moderate sized holes.
The free gas inventory will range from 200 kg for a very low pressure vessel to 5000 kg for a
very high pressure vessel with high molecular weight gas. Typically it will be in the
1000 - 2000 kg range. However this may be doubled by additional gas released from the
liquids as the vessel depressurises. This inventory has the potential to cause local escalation
but is unlikely to overwhelm a medium sized facility. Its potential for harm may be minimised
by depressurisation.
Stabilisation and final dewatering: Some oil production platforms have a final stage of
stabilisation or dewatering. These require large vessels which are filled with virtually stable oil
plus a small quantity of water in the bottom. They operate at 2 6 bar and can contain up to
200 tonnes of oil. These lower pressures would result in a pool fire which would only be a
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 46 of 493
threat to the platform if there were no arrangements to bund the release, minimising the size of
the fire and further arrangements dispose of the oil and firewater.
Oil/condensate pressurisation for export: Export pump arrangements may use one or two
pumps in series. These pumps are usually duplicated with manifold arrangements. These
complex piping arrangements can give an isolated inventory of up to 15 tonnes for a field with
large throughput. The most likely releases are at the pumps themselves but the study of
available inventory should carefully examine how much could realistically be released, taking
into account the operating philosophy standby arrangements for off line pumps and the
provision of valves and check valves. The pump pressures will range from 40 120 bar
depending upon the pressures within the pipeline infrastructures. Transfer pumps to export
tankers will run at much lower pressures. These pressures will drop to the vapour pressure of
the oil on shutdown, giving a continuous rate of release until the available inventory is
exhausted.
The pump seals and the complex jointed piping lead to a high likelihood of a release. The
inherent design of the plant requires the pumps to be located close to the lowest level of the
platform, often beneath the separators. This will lead to a low level source with the potential for
low level external flaming, smoke affecting most of the topsides and escalation to the
inventories above. Shutdown of the pumps and careful management of the inventory which
can be released will help to reduce the impact but it may still require evacuation in some
cases.
Gas compression including gas liquids condensing and knockout. Gas from the various stages
of separation is progressively compressed and cooled allowing liquids such as ethane,
propane, butane and water to be condensed and returned to the liquids system. Typically
several compressors will be required with the final discharge pressures of 50 - 60 barg. It is
likely that the compressor sections and their associated condensers and knockout pots will be
sectionalised with ESD valves. This reduces the gas inventories to 1000 - 2000 kg. As with
separation, this has limited potential for local escalation and this can be minimised with
depressurisation. The major risk is that to personnel in the immediate area from flash fires or
from explosions if the area is congested. There is a moderately high possibility of a gas leak
arising from the compressors and associated vibration.
The liquids which are condensed and collected in the gas knockout pots may be either
liquefied gases or water. The gas-liquid inventories should be less than 2 tonnes and in many
cases, just a few hundred kg. Only the larger inventories will have the potential for escalation.
However, there is a major exposure to flash fires or explosions as these liquids are very
reactive, will have a high release rate and the vapours may not disperse easily. The likelihood
of release should be low as there are few release points in the liquid sections of these process
plants.
Gas drying: This will use either glycol units or molecular sieves and can operate at up to
60 bar. The largest inventory is likely to be a contactor with up to 3 tonnes of gas. Again, this
has a limited potential for local escalation and can be minimised using depressurisation.
High pressure export, gas lift and reinjection compression: A typical pressure for these
systems is 150 barg. However it can be as high as 400 barg for some reinjection
requirements. Again, the inventories will be moderate; typically 1 3 tonnes with the potential
for local escalation. However, the high pressures can give high release rates from moderate
hole sizes, increasing the risks from flash fires and explosions.
Oil and gas metering: Metering is generally carried out using inline flow meters. From a
hazards point of view, they are equivalent to piping with additional potential release sites at
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 47 of 493
the instruments. The hazards are similar to the export pumping and compression respectively
and may be part of the same inventory.
Identification of the inventory of each process section should be carried out to determine the
conditions and inventory during operation and immediately after shutdown. The behaviour of
each section should be modelled using simple calculations to determine the gas and liquid
release characteristics from a range of hole sizes. The intent is to build up a picture of the
types of events that can occur in each part of the platform. These scenarios and associated
hole sizes should reflect the failures which have been identified during the causation analysis.
They should be sufficiently varied to cover the following; those large but unlikely cases which
give short duration fires with the potential for the maximum number of immediate fatalities;
those small long duration cases which still have sufficient size to cause local escalation; and
those intermediate cases which have the greatest potential for escalation or platform impact
whilst still lasting long enough to realise these effects typically a 10 minute duration.
2.6.5.4 Import and export risers
Risers may contain any of the fluids mentioned above, from well fluids to stabilised oil or dry
clean gas. They may be connected to a major pipeline infrastructure or be small infield flow
lines from satellite wells or for gas lift. The risers may be rigid steel or flexible. The releases
may range from pinholes due to corrosion up to a full shear. The location of a release may be
as follows:
Immediately under the platform;
Closer to sea level where they may be exposed to ship damage or chafing and
corrosion;
Sub sea or at the sea bed where it may be subject to internal corrosion.
The location will affect the release characteristics and the ignition probability. Release rates
from these pipelines may initially be modelled using simple calculations, the Sintef and
Scandpower fire calculations for the process industry [2.13] or using more sophisticated
methods. They should be based upon the hole sizes which could realistically occur as
identified in the causation analysis. The modelling should cover cases with and without the
operation of subsea isolation valves or confirm where these are fitted or considered. They
should take into account time delays in the operation of ESD valves and their operability with a
high differential pressure following a major riser failure. Data such as valve closure times and
internal leak rates should be derived from platform specific datasets. Information from
incoming ESD valve trips, routine tests and maintenance will give a more accurate picture of
equipment performance than generic information from generally available databases. ESD
valves would not respond quickly enough to prevent the immediate fatalities rising from a
major gas riser failure unless there was delayed ignition. The characteristics of pipeline
releases from two phase fluids or liquids with dissolved gases should take into account the
variation in release characteristics caused by; gas and liquids separation, slug flow, the
elevation of the release point relative to the main inventory on the sea bed, and effervescence
as gas separates carrying with it liquids in aerosol form. In some cases such as subsea
releases, the fires may burn on the sea surface, see Section 5.2.4.
2.6.5.5 Types of fire hazard: - Liquids
Liquid fires generally have a greater potential for harm than gas fires for the following reasons:
They have greater isolated process inventories arising from the higher densities of between
600 and 850 kg/m3. Typically these can be up to 20 30 tonnes in separators.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 48 of 493
The release rates will be much greater than gases for the same hole sizes and pressures.
The heat fluxes from pool fires will be lower than gas jets but pressurised oil or gas liquids,
particularly with dissolved gas can give the same or greater radiative heat flux.
A moderate sized oil leak of 20 mm at 20 barg would have a flame volume of 4500 m3 and this
has the potential to completely engulf a medium sized process module and cause some
external flaming. A 20 tonne inventory would sustain this fire for 30 minutes assuming a
constant release rate.
This confinement with a roof and/or walls will also cause high radiative heat fluxes, even with
pool fires.
Liquid fires can also be the source of overwhelming quantities of smoke.
Liquids tend to be located at the lower levels of a platform which causes the fire source to
have a greater impact on the facility, engulfing the levels above and to the sides in flames and
smoke and also leading to the exposure of structures, people and plant above it.
Liquid releases can be difficult to detect if there is only a small gas content and this can lead to
a build-up of oil on the floor, possibly spreading to lower levels prior to ignition. This can
exacerbate the effects by increasing the total fuel quantity, the initial fire size and its spread
into more vulnerable locations.
The effect of increased water cut of the hydrocarbon from the reservoir on fire hazards should
be considered carefully to avoid over-conservatism in the fire risk analysis. For example, some
researchers consider that water cuts above 60% make the oil very difficult to ignite.
These potential effects can give liquids the potential to overwhelm a platform giving many
cases which could be classified as evacuation/extreme, even with moderate pressures and
hole sizes on a poorly laid out facility.
The fire characteristics will vary according to the release pressures and the fuel type. Most oil
is only partially stabilised; i.e. it will have some dissolved and liquefied gas within it. It will also
be pressurised; by the inherent state of the fluid (its own vapour pressure); by the pressurised
gases above the liquid as in separators; or through pumping. The pressure will determine the
release rate and the management of that pressure after the fire is detected is a key component
of managing these hazards. This may be achieved by isolating the pumps or by
depressurisation. The release rate is proportional to the square root of the pressure and will
reduce as these actions come into effect. Equations for calculating release rates are given in
the Handbook for Fire Calculations and risk assessment in the process industry, by Sintef and
Scandpower [2.13], reference should also be made to the Phase 2 Blast and Fire Engineering
for Topside Structures [2.14]. The pressure will also determine how the liquid will burn, for
example, as a spray or a pool. The heat fluxes will drop with the pressures and this allows
deluge systems to become more effective both in protecting exposed plant and in suppressing
the fire itself, this is discussed further in Section 10.3. Lighter liquids such as condensate will
have lower transition pressure. Gas liquids; ethane, propane and butane will be pressurised
and it is unlikely that their operating temperatures will ever be low enough to allow them to
burn as a pool. They are only likely to be found in moderate quantities of 1 2 tonnes within
the gas compression and drying facilities. An additional issue to be considered is the potential
escalating effect of flaming rain out; this can occur at ambient temperatures, especially with
butane (also propane) and especially for the scenario of jet flame impingement on an
obstruction, the next section discusses further detail of jet fires.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 49 of 493
2.6.5.6 Types of fire hazard: Gas jet fires
Gases will give rise to an intense jet flame with high localised convective and radiative heat
fluxes. The radiative content will increase both with the molecular weight and as the jet
encounters obstructions. They are generally not large enough or sustained by a sufficiently
large inventory to be significantly affected by confinement within a roofed module except
where they directly impact the ceilings or walls. This makes their potential for escalation highly
directional and this is likely only to affect a small number of critical items such as a single
structural member, part of a vessel or some piping. Only very large inventories would have the
potential for more widespread simultaneous failure. These large inventories require both high
pressures and large volumes within the process plant or an isolation failure to a primary
source such as a riser or well.
Gas jets have moderate release rates unless there are very large hole sizes and/or high
pressures. A 20 mm hole at 20 barg would give a methane jet of approximately 10 - 12 m and
a flame volume of 100 m
3
. With a source of 40 m
3
in volume, typical of the gas content in a
separator, this would reduce to a jet of 7-8 m and a flame volume of 25 m
3
within 10 minutes of
the ESD operating. If the separator was depressurised, this would decay even faster but this
may be offset by the disassociation of dissolved gas in the oil.
2.6.5.7 Types of fire hazard: Confinement and ventilation control
The presence of walls, ceilings, floors and obstructions will significantly affect the way in which
air can mix with the fuel. They will also affect the flame shape. These two factors will change
the heat fluxes, the efficiency of combustion and the density of smoke.
The air requirements for stoichiometric burning of hydrocarbon fires are between 15 and 17
times the mass burn rate of the fuel. In most cases, this is the release rate unless there is
containment of a pool fire to reduce the burn rate. Most modules have good ventilation and
venting to minimise gas build-up and explosion overpressures respectively. The air input rate
through a single opening in a wall is calculated using the formula M
a
= A H where M
a
is the
air input rate in kgs
-1
, A is the area of the opening in m
2
and H is the height of the opening in
m. With openings in the floors and ceilings or multiple openings in the walls of different
heights, this becomes a complex calculation. Typically the fuel burn rate that can be sustained
by a module with one open wall of 30 m by 8 m is 21 kg s
-1
. It is unlikely that severe ventilation
limitation will occur unless there is a very high release rate and this is sustained for several
minutes. If it does occur it is likely to involve a major liquid inventory rather than gas fires. If the
ventilation is severely limited, then the combustion characteristics within the modules will be
affected with reduction in heat flux, reduced liquid vaporisation rates, combustion instability,
very dense smoke with high concentrations of carbon monoxide. Unburnt vapours may also be
ignited as they leave the module giving the external flaming described below. It can take a few
minutes before the fire becomes ventilation controlled as the air inside is consumed.
It is more likely that a large fire will not be ventilation controlled but that its size will simply
exceed that of the module. Once the flame volume reaches
1
/
3
of the free volume in a module
(i.e. that volume up to the top of the highest opening and excluding the volume in between the
ceiling beams), then the flames will spread across the ceiling and begin to extend beyond the
module. In the initial stages of these fires, the flames build up across the ceilings with a hot
flame layer slowly descending across the whole module. This is the neutral plane at which air
entering the module mixes with the vapours. This can descend to
2
/
3
of the way down the
openings in the walls with significant flame velocities as they travel towards the openings.
These areas will have high radiative and moderately high convective heat fluxes. These will be
highest near to or above the source of the fire but will provide a relatively uniform heating of all
structures, piping and upper parts of vessels above the neutral plane. This is likely to lead to
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 50 of 493
multiple failure of this equipment. These high fluxes will occur both with pool and spray fires
but gas jets are less likely to develop this form of module engulfment for the reasons described
above. The area between the ceiling beams becomes stagnant with high radiative but lower
convective heat fluxes.
External flaming will occur if either the fire is ventilation controlled or the fire size reaches that
described above. With large external flame volumes the width of the base of the flame can be
much wider than the opening. If it originates from the lower modules, it can engulf the whole
side of the platform with wind causing it to tilt, possibly towards the accommodation or TR.
This effect is graphically illustrated in the Piper Alpha Inquiry Report Part 2 [2.15], (see
plates14b through to 18a). This will have a major impact upon the whole installation and it is
likely to require evacuation if it is sustained for more than a few minutes. There is only limited
understanding of this external flaming and there are limited predictive tools to quantify it
accurately. Its characteristics may be similar to a large pool fire, with the flames subject to tilt
in high winds.
2.6.5.8 Fires on the sea
Fires on the sea will be affected by a number of factors; the fuel, release characteristics,
release rate, the sea and weather conditions. It requires a fairly large release and benign sea
and weather conditions before the fire has a major impact on the facility. This could lead to
structural or riser failure, smoke engulfment of the topsides or the impairment of evacuation.
All of the contributing factors must be examined to determine the risk of failures and benign
conditions occurring simultaneously. This may be very low in the North Sea but not in other
parts of the world.
Some development information was prepared in 1992 for the HSE and amongst the treatment
of other fire types; a review of pool fires on liquid was undertaken [2.16].
2.6.5.9 Developing a set of representative scenarios
There is an almost infinite range of events which can occur on an offshore facility. A
representative selection of scenarios should be selected from each of the hazards which are
considered to have the potential for a major accident. An initial hazard identification and expert
judgement will identify those hydrocarbon sources with the greatest potential for harm and
those with a high probability. These should be subject to more intense scrutiny than lesser
risks and any modelling should be based on platform specific parameters not generic fire
scenarios with particular attention paid to the uncertainty surrounding two-phase releases.
The events chosen for analysis should reflect the installations design features as much as
possible and encompass the following cases
Those with the greatest potential for escalation; i.e. the largest events with sufficient
duration to cause failure
Those events which could realistically occur; i.e. those with clearly identified causes
giving failures of an identified maximum size; e.g. the largest tapping size or the
dimensions of typical corrosion failures
Those events of a critical duration such as the time to cause evacuation
The characteristics of the events whenever critical control systems such as ESD fail to
operate
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 51 of 493
The examination of these hazards should be used to build a complete picture of causes,
probability, the range of sizes, location, duration, the possible rates and timings to escalation
and the effects when such escalation does occur. This should be documented so that
everyone with a part to play in their management can understand the full implications of all
design and operational decisions. Once the full hazard assessment is in place, the
effectiveness of systems to counteract the effects can be evaluated and the future
management of these hazards can be planned as described in Section 1.5.2.1. The analysis is
a living process and should be capable of future use to examine different cases or the
optimisation of control systems such as depressurisation both during design and operation.
2.7 Inherently safer design for fires and explosions
2.7.1 Introduction
Once the installation concept has been confirmed, it will be necessary to manage fire and
explosion risk within the constraints imposed by the subsequent offshore layout.
The advantage of an inherently safer design or the Inherent Safety design approach is that it
attempts to remove the potential for hazards to arise. It does not rely on control measures,
systems or human intervention to protect personnel.
All control systems have the potential for failure to operate as intended, generally expressed
as the probability of failure on demand. Critical loops are designed according to their criticality
in mitigating personal, environmental or commercial risk by setting a Safety Integrity Level
(SIL). In setting a SIL, it is acknowledged that there is failure potential although this is
designed to be inversely proportional to the importance of the loop in risk mitigation.
There is always the potential for the systems to be damaged in a hazardous event. Inherent
safety avoids this potential by aiming for prevention rather than protection and the preference
for passive protection over active systems.
It is particularly important to follow Inherently Safer Design principles where the consequences
of process release or system failure are high. Where it is possible to reduce the reliance on
engineered (active or passive) safety systems or operational procedures this should be done.
The Inherently safer design approach contrasts with the process design spiral in Figure 2.2.
The result of the application of the Inherently Safer Design approach is reduced complexity
and a reduced requirement for human intervention, resulting in a simpler more robust system.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 52 of 493
Enhanced monitoring
requirements
More maintenance
intervention
More instrumentation
/automation
More safety
systems
Duplication to
increase redundancy
More complexity,
more leak sources
Reduced monitoring
requirement
Less instrumentation,
less automation
Reduction,
reduced inventories
Attenuation,
substitution
Increased
robustness
Less maintenance,
less intervention
Reduced complexity,
fewer leak sources
The process design spiral
Inherently safer design cycle
Enhanced monitoring
requirements
More maintenance
intervention
More instrumentation
/automation
More safety
systems
Duplication to
increase redundancy
More complexity,
more leak sources
Reduced monitoring
requirement
Less instrumentation,
less automation
Reduction,
reduced inventories
Attenuation,
substitution
Increased
robustness
Less maintenance,
less intervention
Reduced complexity,
fewer leak sources
The process design spiral
Inherently safer design cycle

Figure 2.2 - The process design spiral and the inherently safer design cycle
2.7.2 Goals of inherently safer design
The goals of inherently safer design are to avoid the hazard and maintain safe conditions
through inherent and, where appropriate, passive design features; and to minimise the
sensitivity of the plant to potential faults as far as can be reasonably achieved.
This implies that the plant response to the fault should satisfy the following criteria in order:
1. The response produces no operational response or results in a move to a safer
condition;
2. Passive or engineered safeguards should be continuously available and should make
the plant safe;
3. Active engineered safeguards activated in response to the fault should make the plant
safe.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 53 of 493
In Inherently Safer Design the following processes are commonly employed [2.17]:
Reduction reducing the hazardous inventories or the frequency or duration of
exposure;
Substitution substituting hazardous materials with less hazardous ones;
Attenuation using the hazardous materials or processes in a way that limits their
hazard potential, e.g. storage at lower temperature or pressure;
Simplification making the plant and process simpler to design, build and operate
hence less prone to equipment, control failure and human error.
The application of the above principles should result in fewer and smaller hazards, fewer
causes and consequences, reduced severity and more effective management of residual risk.
In order to implement the principles, contributions will be required from all levels of the project
team. Managers should show leadership in the focus on safety; discipline engineers will be
involved in concept choice, plant layout and engineering detail; safety specialists must make
the options visible and available to designers and document the process.
Table 2.1 summarizes the major inherent safety and control features necessary to achieve
the goals stated above:
Table 2.1 - Inherent safety features to achieve goals
Safety goal Inherent safety features
Benefits of good layout (including
partitioning effects or not)
place equipment, utilities and personnel areas along a
clear hazard gradient
where possible use as much segregation as possible to
limit escalation
avoid congestion in process areas
place safety critical equipment in uncongested areas where
possible (limits vulnerability to high explosion loads)
use height between floors to provide ventilation space
(cheap volume)
identify measures required by fire and explosions and
balance benefits from measures for each hazard category
Minimisation of potential leak
sources/release potential
minimise number of pipe joints
maximise welded pipe joints
minimise invasive instrumentation
eliminate/minimise small bore pipework
minimise offshore processing and process complexity
minimise vibration
minimise corrosion/erosion
ensure effective inspection
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 54 of 493
Safety goal Inherent safety features
Minimisation of ignition potential ensure there are no naked flames in live plant
audit and review safety management system with respect
to hot work procedures
insulate hot surfaces (where inspection is not critical)
ensure effective earth bonding
implement hazardous area zoning (area classification)
ensure an effective maintenance regime
Minimisation of POB exposure to
fire effects
separate quarters and non-operational personnel from
process areas
minimise maintenance requirements
remote operation of processes
simplify the offshore process
introduce separate accommodation platforms
use fully rated fire barriers and protect non-redundant
primary structure
provide multiple escape routes from each hazardous area
introduce structural redundancy
Minimisation of hazardous
inventory
simplification/minimisation of offshore processing
use of small isolatable inventories
effect isolation from large inventories upon gas/leak
detection
ensure effective blowdown of inventories
Minimisation of potential release
mass and severity of
consequences
minimise inventory pressure and potential leak rate
minimise hazardous inventory
minimise module size, segregation of release sites from
ignition sources and personnel compartmentalisation
Minimise congestion and the possibility of obstructed fires
Improve natural ventilation (to reduce ignition probability,
avoid re-circulation and external flaming)
Consider the use of subsea completions
Minimisation of congestion simplification/minimisation of offshore processing
optimisation of module layout
segregation of congestion and explosion leak sources
Minimisation of confinement grated decks
open sided modules
blow-out panels/louvres
optimisation of module layout
Maximisation of ventilation minimisation of confinement
platform orientation to make maximum use of prevailing
wind direction
equipment layout to avoid dead spots
platform aspect ratio to maximise ventilation
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 55 of 493
Safety goal Inherent safety features
Limitation of potential flame front
length
limit module size
minimise offshore processing
add partitions to limit maximum dimensions
review of aspect ratio of module dimensions
Monitoring and maintenance of
SCE integrity/functionality
implement an effective inspection programme
introduce effective maintenance procedures
minimise the exposure of the TR and SCEs to smoke and
heat
improve SCEs resistance to thermal effects
protect SCEs from severe vibration effects
protect SCEs from structural displacement effects
separate process areas from critical non-hazardous areas
Maintain effective management of
residual risk
safety leadership and focus
implement an effective safety management system
pursue prevention rather than protection
use passive systems of control and mitigation in preference
to active systems

The above table details inherent safety and control features that either minimise the potential
for fire and/or explosions to occur, or if they occur, to minimise the consequences and
subsequent risk to personnel. These features should ideally be built into the early design of the
installation, rather than being included as mitigation measures at a later date.
Inherent safety practices must be maintained throughout the life of the installation continuing
through the operational phase by adherence to effective inspection and maintenance regimes
and by ensuring that management systems and related procedures are followed.
The benefits of the inherently safer design approach are that hazards and risks are tackled at
source. There is an opportunity for cost effective risk reduction (at an early project phase). The
approach will normally result in easier and more reliable plant and often results in reduced
through life costs.
There may be some conflict between the various features of inherent safety. For example,
increased compartmentalisation will reduce the size of a potential explosive gas cloud
however this will also decrease the potential for natural ventilation and increase confinement.
The balance between such features is discussed later in this Guidance.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 56 of 493
2.7.3 Effective management of residual risk
The risk which cannot be eliminated or prevented by the application of inherent safety
methods is referred to as residual risk. Inherent safety methods can also be applied to the
management of the residual risk by consideration of the general principles indicated below:
CONTROL is better than
MITIGATION is better than
EMERGENCY RESPONSE.
As regards systems to reduce risk;
PASSIVE systems are more reliable than
ACTIVE systems are more reliable than
OPERATIONAL systems are more dependable than
EXTERNAL systems

This indicates that the use of passive rather than active control and mitigation systems is
preferred and that reliance should not be placed on personnel to prevent, control or mitigate
hazards if avoidable. This process is illustrated in Figure 2.3 below.

FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 57 of 493

Figure 2.3 - Risk reduction flowchart
Table 2.2 below defines and expands upon some of the terms used above [2.18].

Exposure
Understand
Hazards
Strategy
?
System
Choice?
System
Performance?
Is it good
enough?
Risk
Proceed with
Detailed Design
Prevent
Control
Mitigate
Evacuate
Cause &
Likelihood
Severity Escalation
Minimise each at source
Passi ve
Acti ve
Operational
External
No
Yes
Role, Functionality, Criticality, Survi vability
Exposure
Understand
hazards
Strategy
?
System
choice?
System
performance?
Is it good
enough?
Risk
Proceed with
Detailed Design
Prevent
Control
Mitigate
Evacuate
Cause &
Likelihood
Severity Escalation
Minimise each at source
Passi ve
Acti ve
Operational
External
No
Yes
Role, Functionality, Criticality, Survi vability
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 58 of 493
Table 2.2 - Systems to minimise the consequences of accidental events
Type Description
Passive Systems that act upon the hazard simply by their presence.
They do not need to react to the hazard or need operator input at the time of occurrence
in order to be effective.
Modes of failure are long-term deterioration, physical damage or removal. Preferred
because they are inherently the most reliable, requiring only inspection and maintenance,
reducing the need for people to be in hazardous locations.
Typical examples are corrosion allowances, layout, welded connections, relief panels,
natural ventilation, separate accommodation platforms, fully rated
pipework/vessels/primary structure/barriers and subsea completions.
Active Systems that may require mechanical or electrical facility, or control signals in order to
work.
Susceptible to mechanical/electrical/software failures and downtime. Less reliable,
particularly where their failures may not be visible.
Inspection, testing and maintenance required, and thus susceptible to human error or
omission.
Can cause increased numbers of personnel and activity on the facility. Typical examples
are, depressurization systems, fire and gas detection and active fire and blast
suppression systems.
Operational Systems that depend primarily upon people to initiate the system or to carry out the whole
function.
Can be less reliable and requires sufficient procedures and trained people on the facility
to ensure their operation.
Effectiveness is wholly dependent upon the operator, who should agree to be dependent
on these measures. Typical examples are maintenance, inspection and condition
monitoring.
External Systems that depend on the correct reaction of people beyond the
company/asset/installation and its direct workforce.
Potential for error due to the longer communication lines and frequent changes of the
people involved.
May be dependent upon effective contracts and audit.
Examples are the competence of a supply boat master to avoid riser impact, and isolation
of a third party feeder pipelines.

2.7.4 Processes for achievement of inherently safer design goals
Table 2.3 below details some of the processes which should be used to achieve the goals of
inherently safer design. The project phases at which these processes are most appropriate are
also identified
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 59 of 493
Table 2.3 - Achievement of goals
Goal
Means of
achievement
Phase Key processes
Minimise offshore
processing
Conceptual Concept analysis, risk ranking.
Selection of lowest risk option
unless cost is grossly
disproportional to risk gain.
Conceptual Concept selection Simplify the process
employed
FEED Process review, HAZOP, HAZID
Conceptual Concept selection
Fewer hazards
giving rise to fire
and explosions
Less maintenance
burden
FEED Process review, HAZOP
Less piping joints FEED Piping philosophy to promote
welded connections
Less small bore
piping
FEED Piping philosophy, instrument
philosophy
Conceptual Concept selection, minimisation of
process
Less maintenance
FEED HAZOP, corrosion policy (piping
specification), maintenance
philosophy (replacement vs.
maintenance)
Less intrusive
instrumentation
FEED Instrumentation philosophy stating
preference for non-intrusive
instrumentation
Less corrosion FEED / Detailed
Design
Corrosion philosophy, choice of
materials/piping specification
Less vibration Detailed Design Process design, piping supports,
resilient mountings for mechanical
plant.
Conceptual Minimisation of process complexity
Area classification (hazardous
area) designation.
Safety Philosophy - no naked
flames
FEED/Detailed
Design
Insulation specification (hot
surfaces)
All Replacement of light fittings with
flood lights [2.19]
Fewer causes of
fires and
explosions
Fewer ignition
sources
Operation Operation/Maintenance
philosophies. Elimination or
minimisation of hot work at live
plant. No welding/gas cutting at live
plant
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 60 of 493
Goal
Means of
achievement
Phase Key processes
Less congestion FEED / Detailed
Design
Layout minimise piping and small
diameter items. Layout of small
bore items
Less confinement FEED Layout grated decks, fewer
walls/partitions
Lower process
pressures
FEED Design Basis/Process Philosophy.
Seek to minimise process
operating pressures
Smaller inventories Conceptual / FEED Choice of separation options,
location of isolation and other
barrier valves
Smaller potential
explosion zones
FEED Layout (may conflict with
confinement)
Shorter flame path
length
FEED Layout avoid long narrow
modules
Reduced severity
of fires and
explosions
More ventilation
(explosions) or less
ventilation (fires)
FEED Orientation Study, Ventilation
Study. Reduce confinement,
installation orientation. Aim to
achieve greater than adequate
level (> 12 air changes per hour
(ach))
Unmanned
installation
Conceptual Concept selection - minimisation of
offshore processing
Lower manning
levels
Conceptual Concept selection - minimisation of
offshore processing, minimise
Normally Unattended Installation
(NUI) visit frequency, remote
operation, minimise maintenance
Lower exposure of
personnel to the
explosion hazard
and escalating
events
Conceptual / FEED Concept selection - minimise
manning levels, minimise
maintenance, maximise separation
of control and quarters areas from
process areas
Detailed Design Layout & fixing details - fix small
items to robust equipment away
from high blast wind areas.
No missile
generation
Operation Housekeeping - removal of lose
items from module, no storage of
equipment
Fewer
consequences
resulting from
fires and
explosions
Escalation Conceptual/FEED Segregation of explosion risks and
major fire escalation
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 61 of 493
Goal
Means of
achievement
Phase Key processes
Prevention rather
than protection
All HAZID/HAZOP - identify hazards
then use hazard management
hierarchy elimination of hazard
being first goal
Passive systems
rather than active
All Aim for inherent safety rather than
use control systems which have
failure modes
No reliance on
personnel to prevent,
control or mitigate
hazards
FEED/Detailed
Design
Control/Process/ESD Philosophies
- use control systems to make
decisions in structured manner
according to ESD hierarchy.
Minimise number of
safety critical
systems
All Minimise process complexity and
manning levels so that quantity of
safety critical elements are reduced
in number
More effective
management of
residual fire and
explosion risk
No exposure of
safety critical
systems to hazards
All Minimise the process, maximise
separation of control and quarters
areas from process areas

2.7.5 Constraints and limitations of inherent safety
Ideally the inherently safer design approach should be applied throughout the project duration
and continue throughout the life of the installation.
At the concept choice stage the selection of a safer concept should be paramount. At the
preliminary engineering phase layout should be designed with the intention of reducing the
severity and consequences of major hazards. At the detailed engineering stage systems
should be designed to reduce the likelihood and severity of the hazard.
If the method is not applied from the start then it may not be possible, cost effective or
effective in risk reduction terms to modify the plant to conform to the ideals of inherently safer
design. Intervention may give rise to an additional hazard which must be assessed and should
not compromise the gains to be achieved by the modifications.
It may not be reasonably practicable to apply retrospectively to existing plant, what may be
demanded by reducing risks to ALARP for a new plant and what may have become good
practice for every new plant.
The overall individual risk and the TR impairment frequency (TRIF) from all hazards must still
be less than 10
-3
per year. If risks are in this intolerable region then risk reduction measures
must be implemented, irrespective of cost.
There may be some conflict between the various approaches employed to improve inherent
safety. For example, increased compartmentalisation will generally reduce the size of a
potential ignitable gas cloud and the number of potential ignition sources, however this may
decrease the potential for natural ventilation, increase confinement and give rise to obstructed
or ventilation limited fires. The balance between such features needs to be considered.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 62 of 493
Corrosion under insulation is a major cause of line failure and high operational cost; hence
insulation may be inappropriate as an ignition source reduction measure and as a process
protection measure. Insulation may actually increase the temperature of enclosed inventory or
the surfaces being protected.
There will also be a balance to be struck between reduced complexity and
redundancy/duplication of systems. Economic requirements may make such duplication
necessary and may actually reduce the required intervention.
Whilst it is generally beneficial to reduce in-line instrumentation, instrumentation associated
with autonomous systems such as deluge and leak detection systems should not contribute to
the likelihood of a release and hence this instrumentation is bound to be beneficial, unless the
maintenance requirements and instrumentation failure consequences increase the risk. A strict
adherence to the principles of inherently safer design may, in some circumstances, increase
the overall risk.
2.8 Risk screening
2.8.1 General
The higher the life safety risk (or risk to life) on an installation or within a compartment/module
the greater should be the rigor that is employed to understand and reduce that risk.
Where the risk associated with an outcome is low, any inaccuracies in determining that risk will
also be low in absolute terms. The effort expended should be proportional to the risk. It is
important therefore to have a means of early estimation of the risk level of an installation to
determine the appropriate approach to be used in installation fire assessment.
The approach to fire assessment needs to be decided early in the design process when
absolute values for release frequency and detailed consequence analysis are not available.
Risk is the product of consequence and frequency of occurrence. This risk can be calculated
as a numerical value expressed as individual risk (IR) or in terms of a value for the installation
such as Potential Loss of Life (PLL). Where quantitative values are not available a qualitative
measure of risk can be estimated to a degree of accuracy sufficient to make a decision on the
assessment approach to be adopted.
Likelihood is a more appropriate term in this context where a qualitative assessment is being
performed, the terms probability and frequency imply that numerical values are available.
At a later stage in a design project a 5 x 5 risk matrix may be appropriate for risk acceptance.
However at an early project phase the increased number of boundaries between consequence
and likelihood classes may be difficult to identify and assign.
A simple approach which is frequently adopted for qualitative risk assessment uses a 3 x 3
matrix of potential consequence versus likelihood of a fire event is described in this section.
2.8.2 Applying the risk matrix
It is recommended that a screening of an installation or compartment is performed giving a
low, medium or high risk classification for the facility. This may be achieved by using
information gained from previous fire and explosion assessments or by following a prescribed
methodology. This will enable the efficient targeting of resources according to the risk level of
the installation and identify the important safety issues at an early stage of the assessment.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 63 of 493
Installations are subject to different levels of risk, based on the severity of the event, its
potential duration and the installations vulnerability. The severity, duration and location of the
fire or explosion will be functions of process flow rates, pressures and inventory. The potential
vulnerability of the installation will be a function of layout, manning levels, location and age etc.
For existing installations, the individual risk (IR) per annum from fire and explosion events will
have been used in the demonstration of ALARP in the existing Safety Case for the installation.
The total IR will be a good indicator of the appropriate level of sophistication of analysis and
whether the installation is in the low, medium or high risk category. Proposed modifications to
the facility may result in changes to these IR values.
A low potential of loss of life (PLL) for the installation may not be a good indicator for normally
unmanned installations and ageing platforms with extended life, because of low occupancy.
However, assuming the risks to any group of individuals is acceptable, the effort and cost
involved in assessing risks and incorporating risk reduction measures should largely be
justified on the basis of the potential for reducing the overall PLL.
It should be borne in mind that the methods considered adequate for hazard mitigation during
preparation of a previous Safety Case may no longer be adequate or correct, as a
consequence of improved understanding of technical integrity behaviour and loading, or new
research.
Details of the existing Safety Critical Elements should be available enabling their classification
into categories 1, 2 or 3. The high level performance standards for the facility should be
defined or confirmed at this stage. The general approach should be to bring the SCEs up to
the same level of integrity taking into account the criticality or consequences of failure and the
difficulty in achieving the level of performance desired.
The number or proportion of existing SCEs vulnerable to explosion loads is also an indicator of
the risk category for the installation. The risk associated with TR impairment under direct and
indirect explosion loads combined with impairment of means of escape is Key.
A simple approach which is frequently adopted for qualitative risk analysis uses a 3 x 3 matrix
of potential consequence versus frequency or likelihood of an accident or event, and such a
matrix is illustrated below (see Table 2.4).
The overall categories of 3 published documents are shown; the documents are issued by
UKOOA, API and ISO [2.20, 2.21 and 2.21], the notation differs between the three documents
and has been adjusted for comparison purposes.
Other practitioners make use of a 5 X 5 matrix; the choice of preferred level of refinement
should be dependent on the Duty Holders corporate background and their experience with the
use of qualitative risk assessment. A 5 X 5 matrix will obviously offer a greater degree of
refinement, the choice of refinement should be governed by the motive for the analysis, for
example, a ranking exercise for a number of competing feasibility options could easily make
use of a 3 X 3 matrix, whereas, making a decision on a protection option would benefit from
the use of a 5 X 5 matrix.
The higher the risk (likelihood x consequence) in an installation or compartment the greater
should be the rigour that is employed to understand and reduce that risk, this may entail
choosing more comprehensive methods and analysis tools. The solutions and protective
measures for the installation with greater risk should be able to bear greater scrutiny, from
both the Duty Holder and the regulators point of view.
All three documents use risk matrices for risk screening.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 64 of 493
Table 2.4 - Risk matrices from the three documents
UKOOA API ISO
Consequence Consequence Exposure level

H M L H M L L1 L2 L3
H
H H M H H M H H M
M
H M L H M L H M L
Likelihood/
probability
L
M L L M L L M L L

There is a large degree of similarity between the three documents, the differences in notation
and the differing treatment of the outcomes (risk) are summarised in Table 2.5 below.
Table 2.5 - Notation and treatment of outcome of risk matrix by document
Notation UKOOA API ISO
Likelihood/Probability Likelihood Probability of occurrence Probability of
exceedance
H High Higher Risk level 1 (L1)
M Medium Medium Risk level 2 (L2)
L Low Low Risk Risk level 3 (L3)
Outcome UKOOA API ISO
H
Requires high
sophistication analysis
(Higher risk)
Risk level must be
reduced. Assess structure
by considering
scenario/event based
approach
Significant risks which
are likely to require
prevention, control,
mitigation
M
If nominal loads apply,
use them otherwise
high sophistication
analysis
If nominal loads apply, use
them otherwise high
sophistication analysis
Risks require further
study to define
probability,
consequences, cost
L
Use low sophistication
analysis, elastic
analysis (nominal
loads)
Low risk need not be
considered further
Insignificant or minimal
risk which can be
eliminated from further
consideration

It is appropriate to note that uncertainties and/or sensitivities should be considered part of the
level of rigour of analysis chosen (based on the risk ranking). The uncertainties and
sensitivities should also dictate the approach to the ensuing analyses. For example, a
precautionary approach may be adopted where data are limited, the design is novel or
manning levels are higher, (more than say 50, one TEMPSC load).
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 65 of 493
2.8.3 Risk screening acceptance criteria
2.8.3.1 General
The objective of a fire and blast hazard management process is to reduce risks associated
with potential hazards to a level that is ALARP, that is, to a level that is tolerable. Tolerability
can be related to specific quantitative targets as is the case in some legislative regimes, it can
be related in part to cost (risks being reduced to a level that do not incur disproportionate
costs) and an array of other criteria defined by legislation and/or corporate goals as part of
internal safety management systems.
One simple approach to defining risk [2.23] and hence identifying whether risk is tolerable is
the use of risk matrices. These come in a wide variety of forms but provide a simple and
effective means for design teams to assess the likelihood (probability of and event) and the
severity (consequence).
Generic definitions for likelihood and consequence can be easily established. This enables the
risks to be semi-quantitatively defined (positioned) and offers a mechanism for mitigating
measures to be evaluated (i.e. is likelihood or outcome reduced, by how much and what is the
residual risk level).
The method reviewed here utilises logarithmic frequency and severity ratings which are added
together to give a risk rating. These are added rather than multiplied because they are
logarithmic representations of the actual frequency and severity.
Risk rating = Frequency rating + Severity rating
A simple example of the use of risk acceptance matrices is presented here. Risk may be set at
three levels by the matrix:
A - risk is not normally tolerable additional controls/design changes required
B - risk is tolerable with controls evaluate additional controls/design changes
C - risk is tolerable.
Table 2.6 - Risk acceptance matrix Frequency vs. Severity
Frequency
Frequent Occasional Infrequent Unlikely Rare
Severe A A A B B
Critical A A B B C
Substantial A B B C C
Marginal B B C C C
S
e
v
e
r
i
t
y

Negligible B C C C C

FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 66 of 493
FREQUENCY RATING (FR) or Likelihood: Each generalised hazard scenario, taking into
account existing controls and including releases in all directions under all environmental
conditions, ignition times and ignition location, may be ranked using a coarse system based on
the frequency of the cause. It is necessary to consider a generalised frequency in this
calculation as the frequency associated with a particular release direction under particular
ventilation (wind) conditions is likely to be very small. This scenario specific frequency will not
be representative of the general frequency of a late ignited release giving rise to a significant
overpressure and will grossly underestimate the frequency rating and hence the risk.
The frequency rating may be categorised using the following as a guide:
Table 2.7 - Frequency Rating (FR) criteria
Frequency
Category Annual probability of occurrence per year
Score Rating
Frequent
> 10
-1
More than once every 10 yrs 0 5
Occasional
10
-1
10
-2
Once every 10 to 100 yrs -1 4
Infrequent
10
-2
10
-3
Once every 100 to 1,000 yrs -2 3
Unlikely
10
-3
10
-4
Once every 1,000 to 10,000 yrs -3 2
Rare
< 10
-4
Less than once every 10,000 yrs -4 1

The frequency score is effectively the logarithm of the annual probability of occurrence. The
frequency rating is a normalized representation of the frequency score for use in semi-
quantitative hazard assessment.
SEVERITY RATING (SR) or Consequence: Each release scenario, taking into account
existing controls, the variability from ignition time and position under a range of environmental
conditions may be ranked using a coarse system based on severity of the cause. The
assessment must consider the risk profile from all causes to satisfy the legislative
requirements in particular relating to TR impairment.
Severity is assessed using the following guide.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 67 of 493
Table 2.8 - Severity Rating (SR) criteria
Severity
Category Severity (safety, environment, asset)
Score Rating
Severe
Large scale loss of life
Large scale environmental impact
Large scale loss of asset
+2 5
Critical
Loss of life of several persons
Extensive environmental impact
Major loss of asset
+1 4
Substantial
Loss of single life or serious injury to several persons
Significant environmental impact
Significant loss of asset
0 3
Marginal
Single serious injury or minor injuries to several persons
Minor environmental impact
Minor loss of asset
-1 2
Negligible
Single minor injury
Little environmental impact
Little loss of asset
-2 1

2.8.4 Low explosion risk installations
Where the explosion risk category for the installation is low, the low risk methodology may be
used. It applies not only to the definition of the explosion hazard but also to methodologies in
handling the response of structures, piping, and other SCEs.
A suitable low sophistication means of defining the explosion hazard is the use of valid
nominal overpressures derived from previous assessments of similar structures. They may be
used as the ductility level blast overpressures (DLB).
Another acceptable means of overpressure derivation for low risk installations is comparison
with a specific past cases. Such comparisons should be supported by evidence that a
structured assessment has been undertaken to identify areas of difference and that the
original means of calculation were sound.
Extrapolation of data for the relevant parameters is not generally recommended but may be
valid if a sound basis exists. The comparison process would incorporate consideration of the
following factors:
the validity of the model used in the initial assessment;
the version of the explosion modelling software used;
the resolution and precision of the grids used in the calculation;
substantial physical differences between this and previous cases.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 68 of 493
A comparative assessment method may be used drawing on experience from demonstrably
similar structure geometry and scenarios. The nomination of a typical installation to represent
a fleet of platforms is acceptable.
2.8.5 Medium explosion risk installations
Where valid nominal overpressures are available or past cases exist that are relevant, these
values may be employed. However the premise is that the variables listed would be more
closely analysed than might be the case for a low explosion risk installations or compartments,
and no extrapolation of data allowed unless published data exists.
Where no nominal overpressure has been defined for the installation and there are no suitable
past cases for comparison, then the level of analysis appropriate for high risk installations
should be used for explosion hazard assessment.
Medium risk methods are described in this Guidance which substitute for some of the tasks
defined in the Higher risk methodology. The philosophy recommended in this Guidance is that
for medium risk installations the choice of methodology for any particular task must be justified
where it deviates from the higher risk methodology.
2.8.6 High explosion risk installations
Where the potential risk level on an installation or within a compartment is high, this will
warrant a commensurately high level of analysis. The ability of the installation and the safety
critical systems on it to withstand explosion need to be accurately determined as any error
could have a significant risk impact.
This level of analysis would involve;
A complete set of explosion scenario investigations
A combination of CFD and phenomenological dispersion, fire and explosion simulations
with knowledge of the frequencies of release and ignition (this may include CFD
simulations of gas dispersion, zonal models, the Shell DICE model or the workbook
approach [2.24] as justified).
Determination of equivalent stoichiometric cloud size [2.3].
A combination of CFD and phenomenological explosion simulation with generation of
exceedance curves representing frequency of overpressure exceedance.
Determination and assessment of the structure and SCEs against the SLB and DLB
design explosion loads including blast wind dynamic pressures.
Time dependent and possibly non-linear dynamic modelling of the installation and
systems response.
Explicit consideration of escalation and interaction between fire and explosion scenarios
including the collapse of tall structures and the external explosion.
Consideration of strong shock and missile generation by the explosion.
Annex G gives by way of checklists the issues which should be considered for low medium
and high risk installations. These checklists are taken from reference [2.25] the Genesis
Explosion assessment guidelines.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 69 of 493
Table 2.9 over the following pages, indicates a range of methods sorted by task but which are
appropriate to Low, Medium or High risk installations.
Table 2.9 - Appropriate methods of analysis by risk category
Task Low risk Medium risk High risk
1. Installation
screening
This task determines the risk level of the installation
Consider worst case
scenarios apply practical
limiting factors to arrive
at design credible event.
Consider a number of
release scenarios with
their associated
frequencies.
Consider ingress of gas from
neighbouring modules and
dispersion/ventilation
characteristics.
Consider and justify use
of previous or similar
assessments by use of
design basis checks &
assessments, complete
if satisfactory.
Consider a number of
ignition source positions.
Consider external explosions.
2. Scenario
definition
Calculate release rates and durations.
3. Prevent-
control-
mitigate
Consider the options of hazard elimination, control and mitigation primarily by reduction
of the frequency of an ignited release then by limitation of immediate and escalation
consequences.
Categorise SCEs determine criticality 1 and 2 SCEs
Consider design credible
event. Use appropriate
nominal overpressures
and durations.
Consider design credible
event. Use appropriate
nominal overpressures
and durations
Consider representative leak
directions.
Calculate equivalent
stoichiometric cloud
size.
Calculate equivalent
cloud sizes from
dispersion handbook
approach.
Calculate cloud evolution using
CFD dispersion simulation for
representative wind speeds and
directions.
4. Explosion
load
determination
Determine overpressure
peak and duration
DLB only
Determine overpressure
peaks and durations.
Calculate ignition probability time
history.
Calculate dynamic
overpressures on
Criticality 1 SCEs. Use
1/3 local peak
overpressure if values
not available.
Calculate dynamic
overpressures on
Criticality 1 & 2 SCEs.
Use 1/3 of local peak
overpressures for DLB
Criticality 1 and SLB if
values not available.
Consider intermittent ignition
sources and time history of cloud
geometry giving worst ignition
time at maximum equivalent
stoichiometric cloud size.
Calculate exceedance
diagrams for
overpressure and
dynamic pressures.
(Simplified 1 point
method acceptable).
Calculate exceedance diagrams
for overpressure and dynamic
pressures.
4. Explosion
load
determination
(continued)
Determine SLB and DLB
overpressures and
dynamic pressures.
Determine SLB and DLB
overpressures and dynamic
pressures from exceedance
curves.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 70 of 493
Task Low risk Medium risk High risk
Determine far field, blast
wave effects

Identify and assess
escalation targets.
Identify and assess
escalation targets.

Idealise load time
histories non-triangular
idealisations possible.
Idealise load time
histories non-triangular
idealisations possible.
Use full load-time histories.
Check primary and
secondary structure
response to DLB using
modified code checks.
Check deflection and
rotation limits for DLB.
Equivalent static loads
allowed if justified.
Check primary and
secondary structure
response to DLB and
SLB loads using
modified code checks.
Check deflection and
rotation limits for DLB.
Equivalent static loads
allowed if justified.
Check primary and secondary
structure response to DLB and
SLB loads using modified code
checks. Check deflection and
rotation limits for DLB. Dynamic
analysis required.
Check SCEs barriers
and connections to DLB.
If required check primary
and secondary structure
to DLB using non-linear
dynamic analysis.
If required check primary and
secondary structure to DLB
using non-linear dynamic
analysis.
Non-load bearing
barriers and cladding
may be checked for DLB
using simplified methods
(Biggs).
Non-load bearing
barriers, cladding and
their connections may
be checked for DLB
using simplified methods
(Biggs) if ductilities less
than 5 are expected.
Check integrity of
penetrations.
Non-load bearing barriers,
cladding and their connections
and supporting structure may be
checked for DLB using simplified
methods (Biggs) if ductilities less
than 5 are expected. Otherwise
use NLFEA.
Check SCEs criticality 1
to DLB and SLB using
dynamic pressure loads.

5. Assess
integrity of
structure and
other SCEs
Check SCEs criticality 2
to SLB using dynamic
pressure loads.

Verify that life safety risk
is acceptable.
Verify that life safety risk
is acceptable.
Verify that life safety risk is
acceptable.
Verify that the
installation satisfies high
level performance
standards.
Verify that the
installation satisfies high
level performance
standards.
Verify that the installation
satisfies high level performance
standards.
Determine if the SCEs
satisfy element specific
performance standards.
Determine if the SCEs
satisfy element specific
performance standards.
Determine if the SCEs satisfy
element specific performance
standards.
6. Evaluation
Determine if ALARP has
been satisfied.
Determine if ALARP has
been satisfied.
Determine if ALARP has been
satisfied.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 71 of 493
Task Low risk Medium risk High risk
Notes
1. Medium risk methods which substitute for some of the tasks defined in the Higher risk methodology.
The philosophy recommended in this Guidance is that for medium risk installations the choice of
methodology for any particular task must be justified where it deviates from the higher risk methodology.
2. For high risk installations, all the tasks from low and medium risk methodologies should be
considered in principle in addition to those listed.

2.9 Risk reduction
Risk management and reduction is an integral part of the Health, Safety and Environmental
Management System (HSEMS) of any organisation or project. The HSEMS provides the
overall framework within which all risks (not just fire related) should be managed.
To assess and manage the risks arising from a specific operation especially with respect to a
specific hazard category it is necessary to recognise the requirements of the HSEMS on the
risk management process (e.g. in determining acceptable levels of risk) and to implement the
processes that contribute to the risk management.
As part of the processes contributing to risk management, an assessment and implementation
programme for dealing with risk reduction measures should be in place. The risk reduction
measures include preventative measures (i.e. likelihood reducing) and mitigation measures
(i.e. consequence reducing). The detailed definition and specification of these measures form
significant components of design codes and standards. Where appropriate, risks can also be
significantly reduced by the adoption of inherently safe designs as discussed in Section 2.8.
In identifying candidate risk reduction measures, consideration should be given to the full
range of measures involving inherently safer design, prevention, detection, control and
mitigation.
The risk reduction measures considered may range from items of equipment and physical
systems through to operational procedures, managerial structures and planning.
It is worth emphasising that the UK regulator will expect to see the following demonstrations
for risks lying below the maximum tolerable, but above the broadly acceptable level:
That the nature and level of the risks are properly assessed and the results used to
determine control measures;
That residual risks are not unduly high and have been kept ALARP;
That the risks are periodically reviewed to ensure that they still meet the ALARP
criteria.
Duty holders should not assume that if risks are below the maximum tolerable level, they are
also ALARP. This should be demonstrated through the application of relevant good practice
and sound engineering judgement; and the consideration of further measures that can be
adopted to reduce risks to ALARP. The degree of rigour of the ALARP demonstration should
also be proportionate to the level of risk associated with that hazard category on that
installation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 72 of 493
A number of example risk reduction measures that have been used in submitted safety cases
(data collected up to 2001) has been tabulated in the HSE publication, Fire, Explosion and
Risk Assessment Topic Guidance, Issue 1, February 2003. This table is reproduced below.
For full document see http://www.hse.gov.uk/foi/internalops/hid/manuals/pmtech12.pdf
Table 2.10 - Examples of risk reduction measures implemented on existing installations
Type of
measure
Description of measure
Leak prevention
Removal or strengthening of small bore pipework connections
Isolation of disused wells at production header as well as Xmas tree and venting of
flow lines back to tree
Decommissioning of redundant equipment
Improvements to systems of work
Implementation of competence management and assurance system
Improvements to PTW system
Improvements in integrity assurance
Ventilation
Removal of wind walls
Enhancement of HVAC in process modules
Prevention (i.e.
reduction of
likelihood)
Ignition control
Monitoring of gas turbine exhaust system temperature
Gas detection
Installation of ultrasonic leak detectors
Installation of additional IR beam detectors
Detection (i.e.
transmission of
information to
control point) Fire detection
Installation of additional fire detectors
Emergency shutdown (ESD) systems
Installation of high integrity check valve on gas re-injection header
Blowdown and flare systems
8. Installation of additional blowdown valves
Control (i.e.
limitation of scale,
intensity and
duration)
Explosion control
Initiation of water deluge on detection of gas
Removal of redundant equipment
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 73 of 493
Type of
measure
Description of measure
Active fire protection
Replacement of deluge system piping
Passive fire protection
Uprating of fire walls
Blast protection
Uprating of blast walls
Temporary Refuge
Re-location of Main Control Room to TR
Re-definition of TR
Enhancement of mustering facilities
Protection of external staircase
Provision of airlock doors
Provision of dedicated HVAC system for TR
Mitigation (i.e.
protection from
effects)
Evacuation and escape
Installation of additional emergency lighting on escape route
Provision and maintenance of proper training in the use of evacuation and escape
facilities
Provision of alternative escape routes
Fire-fighting equipment
Installation of new foam monitors
Mitigation (i.e.
protection from
effects)
contd.
Manning
Reduction of POB

2.10 The lifecycle approach to fire and explosion hazard
management
This Guidance has adopted a lifecycle approach to implement hazard management. In this
Guidance, the lifecycle approach has been broadened in scope so that it both highlights
opportunities for enhancing inherent safety and also addresses all safety systems. It
summarises those activities which need to be carried out, the decisions which need to be
taken and the optimum timing in the lifecycle. It can also be used to integrate the work of all
contributors to the risk management process including; the different design disciplines, risk
assessors, fire and explosion specialists, operators and auditors.
Some main feedback loops are shown but other stages also require feedback.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 74 of 493
2.10.1 Fire and explosion assessment during the installation lifecycle
FEHM is an integral part of the SMS throughout the installation lifecycle.
The lifecycle is made up of the general stages of concept selection, detail design, construction
and commissioning, operation, modifications and decommissioning. These are described in
more detail in the next section indicating approximate timing and sequencing of particular
activities.
FEHM is a continuous process rather than a series of discrete steps. There will be overlaps
and iterations between the various stages of the design, commissioning and operation phases
with earlier decisions reviewed and revised as necessary.
Each numbered step of the assessment process for fires and explosions as outlined in Section
4 is linked with the relevant stage of the lifecycle. These steps are shown in Figure 2.4 shaded
in boxes 1, 5, 6, 7, 8 and 11 with the associated activity alongside. The need to revise the
assessment and repeat elements of the lifecycle is identified in boxes 19 and 20. At each step
of the lifecycle where critical decisions are taken, particularly box 11, these should be
reviewed to ensure that all reasonably practicable risk reduction options have been
considered, that the high level performance standards have been achieved and risks are
ALARP.
The lifecycle approach can be applied at any stage of the installation life. With an operating
field or a partially completed design, many or all of the systems will already be specified or in
place and the relevant lifecycle activities will have been completed. In these cases, the steps
of the assessment shown in boxes 5 to 8 and 11 should be carried out as a discrete activity so
that a full picture of the fire and explosion hazardous events can be developed, before the
need for any changes can be determined.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 75 of 493
I dent i f y f i re andexplosion
hazardson
di f f erent concepts
1
Appl y i nherent safe
desi gn principles
New I nstall at io ns
Set t he highlevel
perf ormance standard
2
3
Sel ect concept t aki ng i nt oaccount risksfrom all
possi bl e hazards i ncl udi ng firesandexplosions
Def i ne t he desi gn and operat ional regime-codes,
st andards and saf et y management systems
4
Conf i rm al l hazards
are i dentified
5
Opt i mi se desi gntoimprove
t he i nherent safety
I dent i f y t hecauses
of t he hazardous
events
6
Veri f y t hat t he designcodesare
sui t abl e f or t he hazardouseventsand
sel ect speci f i c preventionmethods
Det ermi ne fireand
expl osi on loadings
7
Sel ect / opti mi se control systems to
l i mi t t he escal at ionof hazardous
events
I dent i f y vul nerableplant,
equi pment , personnel and
rout es t o escalation
8 Sel ect mi ti gati on systems
Def i ne t he rol es andfunctionality,
rel iabi li ty, avai labi li ty and survi vability
paramet ers f or engi neeredsystems
9
Def i ne rol es, manningand
compet ence requi rementsfor
procedural systems
10
Devel op escalation
anal ysi s andrisk
assessment
11
Veri f y t hat al l hazardouseventsare
addressed, syst ems aresuitable, and
t he overal l perf ormanceisachieved
12
Desi gn hardwaretomeet
parameters
13 Pl an f ut ure verification 14
Devel op procedural
saf et y systems
Exi st in g In st al lati ons
Provi de / i dent i f y proceduresandschedulesfor
operat i on, mai nt enenceandtesting
15
16
Veri f y t hat syst ems areeffectiveand
rel i abl e duri ng commissioningand
t hroughout t he i nstallationlife
Ensure personnel are trainedand
compet ent t o i mpl ement / operate 17
Operat e and maintain
systems t o achi eve
cont i nued ef f ectiveness
18
19
I dent i f y and assessany
change / modification/
det eri oration
22
21
Decommi ssion pl ant using
ef f ect i ve safetysystems
Updat e assessment andsafety
syst em provi si ontoaddress
decommi ssi oninghazards
Revi se assessment and
syst em provision
20
C
o
n
c
e
p
t

s
e
le
c
tio
n
C
o
n
c
e
p
t
u
a
l

a
n
d

d
e
ta
il d
e
s
ig
n
C
o
n
s
t
r
u
c
t
i
o
n
a
n
d

C
o
m
m
i
s
s
in
in
g
O
p
e
r
a
tio
n
M
o
d
if
ic
a
t
io
n
A
b
a
n
d
o
n
m
e
n
t
F i re and Explosion
Assessment Process

Figure 2.4 - Hazard management life cycle
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 76 of 493
2.10.2 Stages of the installation lifecycle
The lifecycle of any oil or gas asset comprises a number of stages:
1. block bidding and license application;
2. exploration and drilling;
3. feasibility studies;
4. concept design;
5. front-end engineering;
6. detail design;
7. construction and installation;
8. hook-up and commissioning;
9. operation;
10. modifications and change (maintenance and repair);
11. decommissioning and removal.
Whenever an installation is modified or changes take place, the hazard management process
should be repeated to a level of detail commensurate with the change.
The hazards associated with decommissioning should, so far as reasonably practicable, be
taken into account during detail design.
For the purposes of this guidance the stages from 3 onwards are more important and are
discussed in more detail in the following section.
2.10.2.1 Descriptions of individual steps in Figure 2.4
1
Identify fire and explosion hazards different
concepts
Apply inherent safe design
principles
During the review of the alternative development concepts, an identification and coarse
quantification of the risks from the hazardous events should be carried out. This information
should be used as part of the overall consideration for concept selection and also to optimise
the layout and guide the selection of hydrocarbon processing methods for each concept.
2 Set high level performance standard
This is the statement of the standards of the installation as a whole for the safety of personnel.
At this stage, Performance Standards may also be defined for major systems such as
Temporary Refuge (TR) impairment frequencies, environmental standards and targets for
reducing damage to the platform. These would be relevant if the reduction of fire and
explosion risks contributes to meeting these targets.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 77 of 493
3
Select the concept taking into account risks from all possible hazards including fires
and explosions
The selection process should include consideration of the risks of major accidents of the
different concepts and the particular contribution from fires and explosions.
Attention should be paid to the primary risk contributors and the practicality and cost of
preventing, controlling or mitigating tern.
4
Define the design and operational regime - codes, standards and safety
management systems
This is the definition of which codes and standards will be used to design the structure, plant
and equipment These include the primary prevention measures which ensure the technical
integrity of the plant The appointment of the designer and operator/owner management
systems including structure and responsibilities should also be defined.
5
Confirm all fire and explosion hazards
are identified
Optimise the design to improve the
inherent safety
This is the start of the formal assessment of the fire and explosion hazardous events. It may
use the output from the conceptual selection studies as a start point. For a new design, the
identification of possible hazardous events should be used to review the layout and process
design so as to eliminate or reduce all hazards to meet the high level performance standards,
concentrating particularly on those hazards which make the predominant contribution to the
overall risks. On an existing installation, it may be possible to identity ways of reducing the
risks through changes in operational practices.
6
Identify the causes of
hazardous events
Verify that the design codes are suitable for the
hazardous events and select specific prevention
methods
The assessment requires that initiating events are identified. This allows the causes to be
identified and a check of the design codes and standards and SMS and operating parameters
to ensure that they are suitable to address the causes and adequate to deal with their severity.
Where they are found to have shortfalls, the codes and standards may be changed or
enhanced. Procedural systems or operating parameters may be changed and, if necessary,
new specific prevention measures may be added. This may lead to a further review of
previous lifecycle steps, follow feedback loop to Step 4 as shown in Figure 2.4.
7
Determine fire and
explosion loadings
Select / optimise control systems to limit the escalation
of hazardous events
The characterisation of the hazardous events identifies the size, intensity and duration of
representative hazardous events and the contribution of control measures. This enables the
most severe events to be identified and their control measures to be enhanced or augmented
to reduce their severity. At this point those events to be used as the basis of design for
mitigation systems are chosen.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 78 of 493
8
Identify vulnerable plant, equipment, personnel
and routes to escalation
Select mitigation systems
The plant and equipment which could fail when exposed to fire and explosion in the
characterised events should be identified. An assessment of the likelihood and consequence
of these failures determines the need for protection and, in the case of existing installations, its
provision and adequacy.
9
Define the role and functionality, reliability, availability and survivability parameters
for engineered systems
This applies to hardware (engineered) systems and is the definition of the overall purpose of
the systems and the essential parameters to be met by the system so that it fulfils its role. The
reliability and availability may need some iteration with the escalation and risk assessment in
Step 11. For existing installations this may be a formalisation of the original design standards
and objectives.
10 Define the role, manning and competence requirements for procedural systems
This defines the role and the essential parameters required to be met by procedural systems.
It requires confirmation that the manning and competence levels are or will be available to the
extent necessary.
11
Develop fire and explosion
escalation analysis and risk
assessment
Verify that all hazardous events are
addressed, systems are suitable and the
high level performance is achieved
This is the overall review of the fire and explosion risks and their acceptability. It formalises the
escalation analysis which will have been developing as part of the assessment process. On
new designs it is carried out prior to proceeding to detail design to ensure that the proposed
systems are suitable for the hazardous event and will be sufficient to reduce, as far as is
reasonably practicable, the risks from each hazardous event. On existing installations it is the
determination of the adequacy and contribution of the safety systems provided. The
cumulative risks from all major accident hazardous events should be within the high level
performance standard and ALARP. This information is essential to determining if remedial
measures or improvements are needed to the existing or proposed system provision. These
results may lead to a review of other lifecycle steps - follow feedback look to Steps 4, 7 or 9 as
applicable, as shown in Figure 2.4.
12 Design hardware to meet the requirements
The design contractor and suppliers should co-operate in designing the systems and
components to meet the functional parameters and the availability and reliability requirements
and ensure that any interactions and also limitations are addressed.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 79 of 493
13 Plan future verification
The verification process provides assurance that the design was appropriate and has been
properly executed and identifies the schemes by which systems can be fully inspected and
tested at appropriate intervals during their life. There is no point in specifying a performance
standard which cannot be verified.
14 Develop procedural safety systems
This includes the provision of specific procedures to complement the generic procedures and
practices associated with the SMS. On an existing installation, the existence and quality of
these procedures should be assessed.
15 Provide/identify procedures and schedules for operation, maintenance and testing
This is to ensure that the systems can be properly operated and maintained and that they
achieve the functional parameters. On an existing installation, it is necessary to ensure that
these facilities are in place. The tasks may include:
provision of access;
provision of specialist test and maintenance equipment;
preparation of effective operation, maintenance and test procedures;
setting of maintenance and test frequencies;
identification of training and competence requirements.
16
Verify that systems are effective and reliable during commissioning and throughout
the installation life
This is function testing which should be carried out prior to installation (at suppliers works),
during commissioning, prior to-start-up, and at predetermined intervals during the system life.
The function testing during commissioning will normally cover the full range of expected
operational demands, to provide a base line for trouble shooting throughout the remainder of
the lifecycle.
17
Ensure personnel are trained and competent to implement, operate, maintain and
test systems
This applies both to personnel training and competence for procedural systems and for the
operation, maintenance and testing of engineered systems. It may be necessary to prepare
training courses and schedules and to have sufficient personnel trained prior to start-up. This
applies not only to regular installation personnel but also to individuals who may visit the
installation to operate, maintain or test the plant. On an existing installation it may be
appropriate to review the training and competence of existing personnel.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 80 of 493
18 Operate and maintain systems to achieve continued effectiveness
This requires the continued maintenance and operation of the plant so that the engineered and
procedural systems continue to meet their original intent as developed during the design and
initial assessment process.
19 Identify and assess any change, modification or deterioration
During the life of the installation, changes may be considered or arise naturally through, for
example changes in the produced fluids from the reservoir. Alternatively a safety system may
deteriorate so that it is unlikely to continue to achieve its intended functional performance,
reliability and availability. All changes should be assessed to determine the effects on the high
level performance standards and, where necessary, improvements should be considered to
the systems provision.
20 Revise the assessment and system provision
This is the update of the assessment required by a relevant significant change identified in
Step 19. It may also lead to a review of the other lifecycle steps affected by the change
including the hardware, procedures and documentation and to a revision of the Safety Case.
Follow feedback loop to Steps 4, 7 or 9 as applicable, as shown in Figure 2.4.
21
Update assessment and safety system provision to address decommissioning
hazards
The design process should have considered likely decommissioning hazards and identified the
relevant procedures or systems. These should be formally reviewed prior to decommissioning
of either part or all the plant to ensure that all hazards are identified and adequately
addressed. Where the existing systems or procedures are deficient, these should be
addressed by following the relevant steps in the lifecycle.
22 Decommission the plant using effective safety systems
The safe decommissioning of the plant and eventual abandonment of the installation may be
dependent on special hardware or particular procedures. These should be in place and
sufficient competent persons should be available to operate and implement them.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 81 of 493
3 Assessment of and protection from fires and explosions
3.1 Introduction
The assessment of fire and explosion hazardous events is the process whereby these events
are identified, probabilities and consequences are determined and a judgement is made on the
adequacy of the risk reduction measures. It is an iterative process which, if the arrangements
to manage the hazardous events are judged to be inadequate, involves modifying them and
revising the assessment. It provides critical information which should be the basis for effective
FEHM.
The assessment process should be used as a design and operational tool to understand the
hazards and hazardous events and to identify when prevention, control and mitigation
measures can be applied to reduce the risks. The flowchart Figure 2.4 showed where and
when the assessment should provide information into the lifecycle and management process.
The timing and detail of the assessment will depend on the stage in the lifecycle, the level of
information available at that time, and the frequency and severity of the hazardous events.
Those events which result in the major risks to life will deserve the greatest attention,
particularly in terms of analysing initiating frequency and consequence.
3.1.1 Constraints on hazard identification
The identification of fire and explosion hazardous events is the start point for the rest of the
assessment and of the whole hazard management process. It should use a structured,
systematic and auditable approach which addresses both process and non-process fires and
explosions and cover all parts of the installation including pipelines, risers and wells. The
method employed should be a structured process, which involves a suitable combination of
operations personnel, design engineers and safety specialists.
The hazard identification process should address all foreseeable fires and explosions and, in
particular, those involving releases of hydrocarbons. This process should be fully documented
including all of the foreseeable causes of initial release as these should be addressed when
identifying the need for specific prevention measures.
To structure the process, the installation may be divided into discrete areas in which hazards
are identified by considering the process or utilities systems, plant, fixtures, combustible
inventory, etc. within each. Potential external initiators of fires and explosions such as a
helicopter crash are also important and should be considered. The information required to
carry out the initial hazard identification may include the following (as available):
Operating and maintenance philosophy;
Plot plans and plant layouts;
Piping and Instrumentation Diagrams (P&IDs);
Process Flow Diagrams (PFDs);
Equipment lists;
Process data sheets.
Other information such as incident statistics or records may also be useful.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 82 of 493
The materials considered during the fire and explosion hazardous event identification
phase are likely to include:
Process oil/gas/condensate;
Process additives (e.g. methanol and tri-ethylene glycol);
Fuels (diesel, aviation fuel, etc.) and lubricants;
Bottled gas (e.g. propane, acetylene);
Industrial explosives and detonators;
Combustible material (e.g. wood, furnishings, paper, plastics);
Laboratory and process chemicals.
In identifying hazards the parameters which define the type of hazardous event should be
identified and documented. These may include:
System pressure;
Isolated and non-isolated inventory;
Temperature;
Density;
Composition of material;
Likely release points and their size;
Flash point;
Ignition sources;
Combustible load;
Oxidising agents.
The fire or explosion events identified will vary depending on the hazardous material involved
and the conditions relevant to the particular system or inventory being considered. Typical
events are:
Pool fire (combustion of a flammable liquid pool);
Jet fire (combustion of high pressure gas or liquid);
Spray fire (combustion of a pressurised liquid release);
Blowout (wellhead spray or jet fire);
o Flash fire (combustion of a flammable gas where the flame propagates at a
speed insufficient to result in damaging overpressures);
o Explosion (combustion of flammable gas/vapour in which confinement and/or
flame velocities are sufficient to result in damaging overpressure);
o BLEVE (rapid ignited release of flammable pressurised contents of a heated
vessel resulting in blast overpressure, missile fragments and fireball);
Cellulosic fire (fire involving material, such as wood, paper, etc.);
Electrical equipment fire.
Users of this guidance should decide what information is relevant to their particular needs.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 83 of 493
3.1.2 Selection of the representative design accident events
One of the most important decisions taken in the hazard management process is the selection
of hazardous events from which the concept of an upper bound, or envelope, of conditions on
which the design of control and mitigating systems are based. The analysis of these events
will give the loading parameters for fires and for explosions as listed in Sections 5 and 6.
Alternatively the design could be based on standard criteria with the loads from the actual
design events being checked at a later stage and compared to the design load. The
characteristics of these loadings need to be defined in sufficient detail so that protection
systems can be designed to match them.
With a new design, the escalation analysis is also important in the selection of the design
accident events, together with the perception of the extent and severity of the escalation. As
the analysis proceeds, a picture of the range of initiating scenarios and escalating events
throughout the platform will emerge. From this overview, it should be possible to select the
design events based on the practicality of preventing larger initial events and stopping the
escalation of smaller events to those of an extreme magnitude. In particular, a designer would
need to consider the following when identifying a design event:
the scale of the incident relative to the installation size;
the options for reducing the frequency of an incident so that the resulting risk is ALARP;
the practicality of controlling and mitigating the event.
3.1.3 Consideration of escalation
In addition to the effects of an initial fire or explosion it is important that a structured approach
is taken to determine whether and how an event can escalate to endanger personnel. It is also
the means to identify all the subsequent failures which would have to occur before personnel
are put at risk.
The primary objectives of the escalation analysis are to:
identify mechanisms whereby an initial event may escalate to impinge on key systems
or facilities, e.g. the TR and/or evacuation and escape facilities;
identify where control or mitigating measures could be used to prevent, delay or reduce
escalation or protect life;
identify the combination of measures needed to deal with each major hazardous event
and to provide an input to the development of associated performance standards;
evaluate the effects on the installation safety systems at each stage of escalation and
how this may affect subsequent escalation;
evaluate the probability and hence the frequency of each escalation path which affects
the key facilities or systems such as the TR and Escape, Evacuation and Rescue
(EER) facilities and the time duration from the initial event.
This may be carried out as an event tree analysis. This can show the sequence of failures
which need to occur to result in a particular level of consequence and give designers and
Operator/Owner the opportunity to add, to or enhance the safety systems to break the
sequence of events.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 84 of 493
Experience has shown that often only a relatively small number of escalating scenarios
contribute significantly to the major accident risk on an installation. Therefore the escalation
analysis is an important aspect of hazard assessment and risk management. It is important
that the location, frequency, timing and duration of different scenarios previously established
are fully considered so that mechanisms and routes by which a fire or explosion could escalate
to cause critical failure can be identified.
This involves identifying those critical components or systems which, if they fail, have
significant consequences regarding:
threat to life;
environmental damage;
loss of assets (plant/production).
Input data from the previous steps of the assessment include:
the location and description of the initial event especially its size, severity, duration and
frequency;
the means by which the initial event may escalate and, at each escalation stage, the
corresponding probability and time to escalation;
the effects of the events on the installation including the safety systems at each stage
of escalation and how this affects subsequent event progression;
the contribution of safety systems to reducing the consequences and the probability of
their successful operation;
the effects on the key facilities or systems such as the TR and EER facilities in terms of
impairment, time to impairment and impairment frequency;
the fatality levels associated with each scenario.
In assessing the contribution of safety systems, the characteristics of each stage of the event
should be considered if it is possible that systems may fail to operate successfully or could be
damaged. Such systems may include:
emergency shutdown;
blowdown;
active/passive fire protection;
detection systems;
communications (internal and external);
essential control and instrumentation;
essential power supplies;
drainage;
overpressure protection;
active/passive explosion protection.
It may also be necessary to consider the actions and decisions of key personnel, in particular
the OIM, in responding to an escalating situation. The decision to move personnel to different
parts of the installation, to abandon the installation, to fight the fire, etc. and the time at which
these decisions are made can have major implications.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 85 of 493
The need to take particular decisions should be reflected in the preparation of the Emergency
Response Plan and in the provision of communication and evacuation systems.
The ability to take decisions may be affected by smoke, heat and the scale of the incident.
This should be taken into account, particularly if the TR and control centre are affected.
Likelihood is a more appropriate term in this context where a qualitative assessment is being
performed, the terms probability and frequency imply that numerical values are available.
Therefore, successful installation screening is achieved by early consideration of the
vulnerability of the installation and the likelihood of an explosion event.
3.2 Fires on offshore installations
3.2.1 Fire types and scenarios
In order to successfully implement the appropriate protective mechanisms for fire hazards, it is
essential (and obvious) to understand what element or area is being protected and what event
the designer is protecting against. Therefore, the protective measures can only ever be
effective when an assessment is carried out of the potential fire hazards. This step is required
by the fire and explosion risk analyses (FERA).
3.2.2 Release events
To establish which fire scenarios should be considered as part of a QRA of an installation, it is
first necessary to consider the range of incidents that may lead to an uncontrolled release of
flammable material which, if ignited, would give rise to a fire. In this context, relevant questions
concerning potential release scenarios are:
WHY did the release occur?
WHAT is released?
WHERE did it occur?
The answers to these questions combine to determine the type of fire that may result, the
likely size of the fire and its potential impact on people and the installation. Considering each
in turn:
WHY: The answer to this question will establish the size of the leak and influence the
likelihood of ignition. For example, has the leak occurred due to a leaking flange joint or as a
result of a preceding explosion event? A range of sizes should be considered from small leaks
at flanges and fittings up to major failures of vessels and risers which result in very high
release rates. The leak rate may also change with time and may have a limited duration.
Failure frequencies for different sizes of event should be taken into account; generally small
leaks will be the most common. Release failures should be based on platform specific
information where possible, and Duty Holders are encouraged to collect, analyse and use
failure rate data based on their own maintenance systems and practices.
The reason why a failure is being considered may also influence the likelihood of ignition, for
example, if a vessel failure is being considered as a result of a preceding explosion or fire
attack then ignition is almost certain, whereas a small leak of high pressure gas generated as
a result of a leaking flange may not interact with a potential ignition source. Ignition
probabilities also depend on fuel type, for example, a spillage of diesel onto a cold surface is
not readily ignited.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 86 of 493
WHAT: The nature of substance being released will also influence the type of fire that results.
A non-volatile liquid spillage may result in a pool fire whereas a high pressure gas release may
produce a jet fire. Apart from process fluids, other flammable substances are likely to be
stored and used on an installation for use in service roles. Potential fluids to be considered
are:
Natural Gas dry or containing condensate and/or water;
Condensate unstable or stabilized;
Live crude possible including a significant amount of water;
Transport fuels - Aviation fuel, Diesel;
Process fluids Methanol, Ethylene Glycol;
Lubricants and hydraulic fluids.
In addition, some of the gas and oil streams may include hydrogen sulphide, which may
require special consideration because of its potential to produce toxic products or be toxic if
unignited.
WHERE: Where the leak occurs will also influence the type of fire that results. In particular, is
the fire likely to be in an open or confined area and what is the potential for the fire to impact
onto pipework or vessels that may also contain flammable material, or indeed other critical
targets (e.g. other safety critical elements, control systems etc.)? The latter question is
important with regard to the potential for incident escalation. Some fires may occur at a
location away from the source of the leak, for example, liquid spills which may spread to other
areas or even spill onto the sea. The location of the fire will also influence its likely
consequences; hence fire scenarios at a range of key locations should be addressed in the
QRA. In particular, fires close to where people work which could affect escape routes, Safety
Critical Equipment, the Temporary Refuge or key structural components.
Having selected and defined a release event giving rise to a fire, this fire and its effects may
well change and develop with time depending on the prevailing circumstances. The following
factors may affect fire behaviour and/or the consequences:
ESD: Assuming the ESD operates the volume of the isolatable volumes will affect the
duration of the larger leak scenarios and result in a transient fire size, reducing with
time.
Blow-down: Similar to ESD operation, this could result in a transient release rate.
Additionally, blow-down may reduce the consequences of the fire scenario by
depressurising a vessel or pipework onto which a fire is impacting, thereby preventing
escalation.
Confinement: Fires in confined areas with limited ventilation may change over time, for
example, become progressively more severe as external flaming occurs, when the fire
moves through the ventilation openings.
PFP: The use of passive fire protection may not affect the nature of the fire but will
affect the response of objects subjected to fire attack and delay or prevent incident
escalation.
Deluge: Depending on the fire type, active water deluge systems (area and dedicated)
may affect both the nature of fire and the thermal loading to engulfed objects and in
most cases will be beneficial to escaping personnel.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 87 of 493
3.2.3 Ignition
The likelihood of ignition is clearly an important factor to consider for any QRA and will also be
dependent on the answers to the WHY, WHAT, WHERE questions above. Some fuels are
more easily ignited than others and the manner of spillage may affect its flammability (for
example oil spills onto the sea are often not readily ignitable and additionally are likely to be
distant from common ignition sources on an offshore installation.
Ignition sources such as electrical fault, electrical arcs (for example across switch contacts),
sparks, high temperature surfaces, flames and electrostatic discharge should be considered
and the proximity of such sources will vary at different locations on an installation (see
Section 3.2.6.8 for a discussion of ignition sources)
3.2.4 Fire scenarios
Given that ignition has occurred, the answers to the WHY, WHAT, WHERE questions above
also determine the nature of the initial fire and how the fire may subsequently develop. Typical
answers to these questions include:
WHY WHAT WHERE
1. Leaking flange,
small fitting or
valve
High pressure gas
In open module in
open area or
congested region
2. Pipework failure
from impact or
corrosion or
preceding event
Pressurised volatile
liquid
In confined area
3. Equipment failure Pressurised gas/liquid
mixture
Spillage onto sea
4. Vessel rupture or
collapse following
explosion,
structural collapse
or fire event
Non pressurised,
non volatile liquid
From subsea source

By considering combinations of these answers the fire type can be determined. Three
examples are as follows:
WHY WHAT WHERE FIRE TYPE
1 Leaking flange joint
High pressure
natural gas
In an open sided
module
Jet fire with potential
impact onto
pipework and
vessels
2
Fire attack on
pressurised vessel
leading to failure
Gas and volatile
liquids
On the installation BLEVE - fireball
3
Storage vessel
failure
Non-volatile liquid
On the installation
but liquid spills onto
sea
Potential pool fire on
the sea

FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 88 of 493
Considering a range of generic cases, such as those above, the following six fire types are
proposed:
Gas Jet Fire originating from a pressurised gas release on the installation.
Two-Phase Jet Fire originating from a pressurised release of a flashing liquid or a
gas/liquid mixture on the installation.
Pool Fire on the Installation originating from a liquid spillage. May be static or running
depending on the drainage paths or bunding around the source.
Pool Fires on the Sea originating from a spillage on the installation falling onto the
sea, or failure of a sub-sea liquid pipeline.
Gas Fires on the Sea originating from failure of a sub-sea gas pipeline.
BLEVE originating as a result of catastrophic failure of a pressurised vessel containing
a volatile liquid.
It should be noted that the behaviour of these fires may change with time as noted in
Section 3.2.1, for example, due to the effect of ESD, confinement or deluge. The nature of
these fires and their behaviour when interacting with confinement and/or deluge is considered
in further detail in Section 5.2.
The fire and smoke loadings, issues concerning heat transfer and other details of the fire types
are discussed in Sections 5.3, 5.4and 5.5.
3.2.5 Transition between fire scenarios
As discussed above, some fire scenarios may change with time, for example, a fire occurring
in a confined space may lead to increasing fire severity with time and the movement of the
flame through the vent may produce external flaming. Similarly, some fire scenarios may lead
to incident escalation and result in a different fire event occurring as a direct consequence, for
example, a jet fire impacting onto a pressurised vessel may lead to vessel failure and a
BLEVE fireball event. A liquid spillage may start as a pool fire on the installation but drainage
of the spill may ultimately lead to a pool fire on the sea. Therefore, it is important that a QRA
considers the potential sequence of fire events and that a fully representative set of events is
analysed. The QRA should be supported by a thorough HAZID with input from people with
experience of the existing or similar plant or processes.
3.2.6 Fire prevention methods
3.2.6.1 General
The principals of Fire Hazard Management promote a four-part strategy for dealing with the
fire hazard, when that hazard cannot be eliminated by inherent safety approaches (see
Section 2.7). In order of priority, the remaining steps of the strategy seek to:
1. Prevent or minimise fires at source
2. Detect fires early
3. Control fires
4. Mitigate against effect of fires
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 89 of 493
Sections 3.2.6 to 3.2.8 give an outline of the methods available in each of these four
categories. In reality almost every offshore installation employs a mixture of all four methods.
Good design seeks out the best mix of prevention, detection, control and mitigation
methodologies for the specific fire scenarios associated with an installation.
There are opportunities throughout the design of any installation to minimise the fire hazard
using the four strategies above. Every engineering discipline involved in the design process
should be aware of the interaction between their specific discipline input and the fire hazard
management for the installation. It is the responsibility of the safety engineer in conjunction
with the project manager to engage all the engineers in discussion of fire hazards from an
early stage so that no cost-effective opportunities for improvement are missed.
This section outlines the options available for preventing or minimising the fire event at source.
Sections 3.2.7 and 3.2.8 cover the various options for detection, control and mitigation of fire
events once they have already occurred.
3.2.6.2 Methods of fire prevention or minimisation at source
Given that the principal role of oil and gas installations is to produce large quantities of
hydrocarbons, complete removal of the fuel source not an option. However there are
opportunities for the designers to minimise the potential for large releases of fuel. These are
described in the following sections.
3.2.6.3 Minimise inventories
The biggest inventories are in the reservoir, the pipelines attached to the installations and the
process vessels. Engineers need to be briefed to consider minimisation of release potential in
addition to consideration of production maximisation and cost. They should aim to:
Minimise inventories between the wellhead and downhole valves;
Provide suitably located topsides and subsea isolation valves on all import and export
pipelines. Any non-provision of subsea isolation must be thoroughly justified.
Justifications must consider all lifecycle phases (especially for NUIs);
Size pipelines, vessels and other process equipment to minimise inventory loss in a
leak situation as well as meet process requirements;
Provide adequate automatic isolation throughout the process system, backed up where
necessary with accessible manual isolation valves;
Minimise on-platform storage wherever feasible.
3.2.6.4 Optimise layout
Good layout is essential to the overall safety of the installation. Where separation of people
from hazardous areas is not possible, provide protection by segregation behind firewalls and
attention to escape/egress routes. Key points are:
Keep living quarters and evacuation facilities away from the process;
Provide diverse egress routes from modules and access platforms/decks back to the
TR or provide a suitable protected muster point (PMP);
Provide grated deck in process areas to reduce pool fire risks;
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 90 of 493
Wherever possible hydrocarbon containing vessels should be bunded and connected to
hazardous drains or vents or flare systems designed to remove flammable liquids from
the vessel;
Ensure that the hazardous drain arrangements are capable of handling releases from the
single largest vessel or source based on the range of reasonably foreseeable events;
Locate risers as far as possible from the TR & evacuation point;
Locate risers and riser valves where other fires or fire escalation cannot affect them;
Review the locations and orientations of flanged joints to minimise the location of targets
(SCEs or other flammable inventories) within the range of small and escalating jet fires;
Small platforms such as Southern North Sea gas platforms cannot provide separation by
distance therefore immediate safe egress/escape provision plus sheltered evacuation
points are crucial for safety of personnel.
3.2.6.5 Minimise the potential for loss of containment events
Minimise the number of potential leak points in the design, particularly flanges and
instrumentation connections. However enough valves need to be left to provide for safe
isolation for intrusive maintenance. Use of newer design of equipment such as high
integrity flanges, valves with integral block and bleed and inherently safer wellheads
should be considered.
Design for future sand erosion and corrosion by providing for ease of detection,
monitoring and replacement.
Where facilities and access for routine test and maintenance are not provided on the
understanding that such work will only be done during shutdowns, this should be
highlighted on drawings and in manuals.
Where emergency manual isolation is provided, make sure it is documented in
emergency response plans, unambiguously labelled in the field and accessible in the
relevant fire scenarios.
3.2.6.6 Providing an inert or non-flammable environment
Determine the degree of containment to confirm whether an inert atmosphere is
achievable in the specific application, for example:
o Completely contained within a pressurised vessel;
o Completely contained but within an open vented atmospheric vessel/tank.
Determine the required supply of inerting medium, e.g. the degree of inflow and outflow
required for all operating conditions, for example offloading requirements or inerting an
area with opening/closing doors (such as filling a Temporary Refuge with lower oxygen
content media, see next bullet point).
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 91 of 493
Review the non-flammable media available for application, considering the use of the
areas and volumetric flow rate requirements, the media may include:
o Nitrogen;
o Over-rich (i.e. above Upper Flammable Limit) fuel gas;
o Cleaned combustion gas;
o Low oxygen content media (such as Inergen, a proprietary product with
insufficient oxygen to support combustion but adequate oxygen content to
maintain life);
o Carbon dioxide.
Consider the preferred delivery option, whether the media can be generated on the
installation (e.g. Nitrogen Generator) or whether it is desirable to be brought on board.
Review the media for their own hazardous effects in the context of the potential
applications. Avoid all but the lower oxygen content media in areas where personnel
without breathing apparatus may be, ensuring that the lower oxygen content media are
suitable for occupied areas. Identify any time limits on occupancy or minimum health
and fitness criteria with the media supplier.
Confirm that the layout does not contribute to or exacerbate migration of the media to
sensitive areas, for example carbon dioxide being heavier than air will flow down hill,
therefore, recessed areas for valve or equipment access could capture the CO
2
,
especially where personnel could access as part of recovery work after the emergency
.

3.2.6.7 Minimise the time to ESD and blowdown
ESD should be designed to occur immediately on detection of a release event. ESD
should move the plant to a safer state. Designers need to check whether the ESDV
locations minimise ignited release consequences rather than just reducing leak size.
Rapid blowdown or draining of topsides process inventories in order to prevent
escalation of a fire situation should be provided unless there are specific good reasons
for not doing so (e.g. very small topsides process).
The code-based design approach of providing blowdown to 7 barg or half design
pressure in 15 minutes should no longer be automatically assumed adequate.
Blowdown should be designed in the light of the specific escalation times for each fire
scenario and generally be as fast as feasible once activated, (see Sections 7.7.4 and
7.7.5 for more details on blowdown systems).
Where only a manual blowdown capability has been used the designer and Duty
Holder must justify the choice of system with respect to the identified major accident
hazards, the design and operating philosophy must be clearly recorded for the
intended user and all operational and maintenance details must be documented or
referred to in the emergency response instructions for the installation.
Blowdown must be to a safe location with respect to personnel, bearing in mind the
likelihood of spurious blowdown events as well as real emergency events, and
designed such that the heat radiation for maximum foreseeable flaring (or ignited
venting) rate does not pose a hazard to escape and evacuation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 92 of 493
3.2.6.8 Minimise ignition sources
All electrical equipment in hazardous areas shall be certified. This is to cater for
fugitive leaks in accordance with hazardous area design codes.
The dispersion distances for such leaks, from which the hazardous zones are
calculated, do not cater for major accident releases.
A gas cloud from a medium or large leak can, and will, drift outside hazardous area
limits. Therefore caution must be exercised in locating unclassified equipment such as
generator sets, temporary pump skids, heating equipment etc in safe open locations
around the installation.
The ignition-prevention philosophy for the platform should explain how the ignition risk
is minimised.
Plant should be suitably earthed and all operators trained in awareness of offshore
static spark risks (a recurring cause of fires).
Equipment which provides an ignition source and is unacceptably close to release
sources should either be located inside an enclosure with ventilation ducts that close
off automatically on detection of gas, or be provided with some alternative form of
protection.
Certified electro-mechanical equipment (e.g. diesel generators) requires careful
maintenance in order to retain its certification and is a significant operating expense.
3.2.7 Gas and fire detection and control methods
3.2.7.1 Detection of loss of containment events
Early detection of loss of containment events is crucial. Detection should always trigger
limitation of the leak by rapid automatic isolation it should simultaneously alert personnel to the
danger. Since it is difficult to automatically detect liquid oil leaks (although oil mist detectors
can detect higher pressure liquid leaks), historically reliance has been placed on detection of
the associated gas.
Most installations have hundreds of sensitive detectors in place. In order to prevent spurious
shutdowns and un-necessary platform alerts, most installations have a two-tier alert system.
Typically, under this system, a single low-gas-level alarm alerts staff in the control room to a
potential problem, which is immediately investigated but no shutdown or general alarm is
initiated. One single low level gas detection is more likely to be a false alarm than a real gas
release. If a second alarm in the same area then occurs or if a high-gas-level alarm goes off,
then this is indicative of a real release rather than a false alarm. The fire and gas system
voting interprets 2 or more low-level or 1 or more high-level alarms as confirmed gas
releases. This automatically initiates platform alarms and shutdowns.
Confirmed gas detection should always initiate immediate, appropriate executive action in the
form of shutdowns and, where applicable, blowdown. Most platforms have between 2 and 5
levels of shutdown, depending on the extent of the detected release. A system which requires
operations personnel to walk into a gas-release scenario in order to investigate before
initiating shut down of the process system is potentially dangerous and no longer acceptable.
Personnel should never be asked to enter a gas-cloud for the purposes of investigation or
manual action they may be rendered unconscious by the un-ignited gas or be engulfed in
flame if the cloud suddenly ignites. Where one person is missing, more people are exposed
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 93 of 493
through search and rescues attempts and the evacuation process becomes delayed. The
detection system should instead be designed to give remote indication of the development
and/or migration of the release thus allowing personnel to stay well away from danger. Once
the fire and gas panel shows the situation is sufficiently under control then cautious, upwind
approach from a position of safety can be attempted.
There are many different types of gas detector available. All have their strengths and
weaknesses which are explored in the table below. All installations, modern and old, use a
combination of different methods in order to cover the range of duties necessary.
The approach to the detection of flammable gas has moved away from trying to detect all
leaks and now concentrates mostly on the following three distinct criteria:-
1. The detection of gas clouds of a specific size and LEL (i.e. 5 metres, 50% LEL
cloud)
2. The detection of gas leaks also of a specific size (i.e. 0.1kg s
-1
to 2.5 kg s
-1
)
3. The detection of gas at the HVAC intakes to areas containing potential sources of
ignition (TR, turbine enclosures, etc.)
The basis for the specific cloud size and gas leak size are established by specialist
analysis/modelling of the areas. The systems are generally not concerned with the detection of
fugitive gas leaks, except in some special cases.
Performance Standards are used to set the initial design conditions to be met by the various
detectors (see Section 2.3).
Table 3.1 - Summary of methods of gas detection
Method of gas
detection
Strengths Weaknesses
Single point Pellistors
These detect the presence
of gas when it reaches a
detector head. They are
good at detecting
accumulations of gas.
Well-understood item. Good
designs should allow gas
clouds to be tracked, as they
drift through areas of plant,
from the safety of the control
room.
Susceptible to poisoning of the catalyst by
oil-spray and contact with other chemicals.
Always check proposed site and
contamination issues with manufacturer.
They generally require a high level of
maintenance due to drift, and recalibration
due to poisoning, as these detectors do not
automatically provide indication of a faulty
pellistor.
Very large numbers are required to
adequately cover a typical fire zone.
Not preferred on new or upgraded
installations.
Have historically been used for
detection of gas in air supply
ducts to enclosed areas
containing unclassified
electrical equipment or other
potential sources of ignition
but not recommended now IR,
beam detectors available.
Location in an air intake duct is an arduous
duty for this type of detector Executive
action occurs on 2oo3 voting. Access for
frequent maintenance and testing is
essential. I/R point detector with duct probe
or I/R open path detector are now available,
and better, for this service.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 94 of 493
Method of gas
detection
Strengths Weaknesses
Not very effective for small leaks in open
areas. In this situation use in conjunction
with acoustic detectors.
Susceptible to drifting if not regularly
checked and maintained, leading to
unnecessary shut-downs.
Unless the gas comes into direct contact
with the detector head it will not operate so
numerous detectors, suitably located are
required. Vapours heavier than air require
detector location at floor level. For natural
gas releases, detectors need a high level
location.
Must be calibrated and located
appropriately for the vapours they are
designed to detect. Calibration settings for
LNG (methane), LPG (propane),
condensate and hydrogen are all different.
Heavier or lighter than air gases require
increased numbers of detectors and
present difficulties positioning to avoid
damage at low level and maintenance
access at high level.
Note: On older installations where there is heavy reliance on pellistor type detectors, consideration should
be given to setting the devices to give initial (low level) alarm at a levels just above the anticipated drift
range of the device and high level alarm slightly above that. Operators have found that alarm at 10 to 20%
LEL and executive action at 25 to 40% is feasible for a well maintained system. This gives an added
margin of safety while avoiding nuisance alarms. Different set points will be necessary for different
applications. The suitability of the set point each application should be documented, and not automatically
assumed to be 20 % LEL for low level and 60 % for high level alarm.
IR point detectors Very good at detecting
flammable gases at potentially
known locations. Very little
maintenance or calibration
required during the life of the
detector (in excess of 5 years).
These detectors are least
sensitive to methane, so when
calibrated for methane will also
detect other gases i.e.
propane, butane etc more
readily. This type of detector is
good for confined areas, ducts
etc (with a duct probe unit).
Not good as the prime detector type for
open process areas as large numbers of
detectors would be required.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 95 of 493
Method of gas
detection
Strengths Weaknesses
IR Beam (open path)
detectors.
These detect the presence
of a cloud of hydrocarbon
gas between a detector
head and its reflector
Very good at detecting gas
clouds in open process areas,
effectively taking the place of
numerous point detectors.
Very little maintenance
necessary, but this can be
achieved by one man with an
interrogator tool. Not
susceptible to poisoning.
Detectors can be sited at the
boundaries of modules of fire
zones to provide economic
coverage of large areas,
providing good information on
gas migration.
Care should be taken when
subsequent work is being
carried out on the installation,
when there might be the
potential for blocking beams
by scaffolding, sheeting for
weather protection or painting.
Some early versions could be activated by
adverse weather, especially rain and fog
and vibration
Leak detectors (acoustic)
These detect the noise
made by any significant
leakage from a high
pressure gas (whether
flammable, toxic or inert)
system.
Will detect any significant leak
in vicinity without contact with
gas therefore large numbers of
detectors not necessary.
Usually only two or three
detectors are required in a
typical process area.
Area mapping of background noise is
necessary to enable the correct alarm
setting to be established. These detectors
need to be located with easy access for
routine testing.
These detectors will detect a high pressure
leak of any gas, whether hydrocarbon, air,
N
2
, CO
2
etc. Hence caution is necessary
when arranging the shutdown logic and
when placing the detectors, with respect to
any regular discharges of air (such as near
air compressors). Discussions with
equipment vendors should be initiated to
understand the frequency range over which
the detectors will work.
Note: There has been
reluctance by the industry
to embrace acoustic
detection. It is still regarded
with suspicion as new
technology despite nearly
ten years of successful use
in the Southern North Sea.
Concerns about spurious
activations by background
noise can be averted by
designing in recognition of
other noise signature in vicinity
and possible use of pre-set
time delays before alarm
initiation. Initial calibration of
detectors in their designated
location is essential.

Manual Personnel should always be
vigilant and report small leaks
for Investigation, repair and
monitoring. Most small leaks
are still detected manually
especially on open design
platforms

FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 96 of 493
Method of gas
detection
Strengths Weaknesses
CCTV (see under CCTV in
Table 3.2)
Cheaper and readily fitted
especially on large
installations or on extensive
process areas. Allows operator
judgement on how to deal with
the situation.
Visibility of large gas releases depends on
numerous process, release and
atmospheric variables. Small gas releases
would not generally be picked up.

3.2.7.2 Additional notes on detector types
Infrared detectors
An infrared gas detector consists of an infrared source and an infrared detector. When
flammable gas passes between the source and detector, the gas absorbs infrared radiation
and lower radiation intensity is registered at the detector. Specific gases are detected by
measuring the amount of absorbed infrared radiation at specific wavelengths; the difference is
related to the concentration of gas present.
Infrared detectors will not poison and can operate in inert atmospheres. They can be used in
confined spaces where oxygen depletion might have otherwise limited the effectiveness of a
pellistor detector. Infrared detectors are fail-safe, a detector that is obscured or has failed
registers zero infrared radiation and the alarm signal is activated. IR detectors are available in
either a fixed-point format, in which the gas diffuses into the detector or in an open-path format
where the source and detector are separated (thus a line of sight detector).
Pellistor detectors
A pellistor detector consists of a matched pair of elements, one of which is an active catalytic
detector and the other an inactive compensating element. Flammable gas contacting the
catalytic surface of the detecting element is oxidised causing a rise in temperature of the
active element, this rising temperature increases the resistance of the active element. There is
no such change in the compensating element and the output signal of the detector is based on
the imbalance between the two resistances.
Pellistor sensors can give accurate readings under adverse environmental conditions as
changes in ambient temperature, humidity or pressure will impact both elements. Pellistors
can be poisoned or inhibited by silicones, sulphides, chlorine, lead and halogenated
hydrocarbons. The detectors require regular cleaning and calibration, (with an impact on
maintenance costs). Pellistor sensors also require the presence of oxygen in order to operate.
Detection of fire events
Early detection of fire is crucial. The earlier a fire can be detected the earlier personnel can be
warned and steps taken, both automatic and manual for containment and control. There are
many types of fire detection device available on the market. No one device covers every fire
situation. The uses, locations, strengths and weaknesses of the most common types are
outlined below
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 97 of 493
Table 3.2 -Summary of methods of fire detection
Methods of Fire
Detection
Strengths Weaknesses
Smoke Detection:
Ionisation Smoke
detectors detect the
visible and invisible
products of
combustion as they
come into contact
with the detector.
Widespread use in enclosed areas
such as accommodation ceiling voids,
electrical equipment and control rooms.
The detectors can be wired in series
with up to 20 detectors on one loop.
These detectors have a high resistance
to contamination and corrosion. They
are available in a wide range of
versions to suit different needs.
Not effective in open modules, as the
smoke is usually dispersed before
reaching detector.
Not advised for use in areas where
some smoke is expected in normal
operation e.g. above cookers.
Care is needed with disposal since
they contain a minute radioactive
source
Optical Smoke
detectors detect only
visible smoke and
rely on the light
scatter principle
Widespread use in enclosed areas
such as accommodation modules. The
detectors can be wired in series with up
to 20 detectors on one loop. These
detectors have a high resistance to
contamination and corrosion and are
available in a wide range of versions to
suit different needs.
Not advised for use in areas where
some smoke is expected in normal
operation e.g. above cookers.
VESDA (Very Early
Smoke Detection
Alarm) or HSSD
(High Sensitivity
Smoke Detection)

These pull air
samples from areas
susceptible to
electrical fires to a
small analyser and
check for smoke or
pre-combustion
vapours.
Alert personnel to the incipient
development of a fire situation e.g.
behind instrument panels, especially in
unmanned control rooms or in cable
routes. These detectors are particularly
suitable in areas with high air flow
ventilation.
The very early warning allows
personnel to enter the room to
investigate and/or isolate power
supplies without undue exposure to
risk.
These are being widely used to
replace Halon systems removed from
control rooms, MCC or switch-rooms.
They can be alarm only, or wired to
the F&G control panel for executive
actions and/or shutdowns. These
systems are relatively high unit cost
and there are additional maintenance
requirements for checking and
keeping air-sampling tubes clear.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 98 of 493
Methods of Fire
Detection
Strengths Weaknesses
Flame Detection
IR flame detection Widely used and well understood. Used
to detect the infra-red wavelengths of
hydrocarbon flames. Typically 4 to 16
detectors would be needed to cover a
module depending on module
congestion and dimension.
Detect yellow flames, but weak on
bluer flames (e.g. methanol fires).
Vision of units can be obscured by
smoke or equipment (especially
forgotten temporary items). Often
used in combination with UV
detectors where several types of fire
can occur in one module. Generally
specialist mapping techniques are
used to optimise detection and
ensure adequate coverage is
achieved. To avoid spurious alarms
higher numbers of detectors are
required to provide voted logic.
Spurious alarms may occur from
other, non-fire IR sources, so not
suitable in areas where black body
radiation occurs.
UV flame detection Widely used and well understood. Used
to detect the Ultra-violet wavelength of
a flame spectrum. Typically installed
under turbine/compressor hoods.
Detect the bluer flame types. As for
the infra red detectors, solid objects
or smoke will obscure the cone of
vision, reducing the effectiveness of
the detector. The lens of each
detection unit needs regular checking
for dirt build-up which prevents
effective operations of the device.
Video flame detector
(makes use of
specialist flame
imaging technology)
Very good at detecting flaming fires.
Sophisticated versions can be set up to
mask out known flame sources e.g.
platform flare. These can provide
conventional alarm signals plus a video
image if required. Possibly the way
forward for Green field projects.
Unit cost may be high but fewer units
required to cover a typical process
area.
Fusible bulbs These bulbs break at a pre-defined
temperature and raise an alarm/ESD.
They also usually either release water
directly or release air to activate deluge
systems. This system does not rely on
electrical power for satisfactory
operation and deluge release.
A these devices require a heating
effect that causes failure, dependent
upon their relative location with
respect to the fire, they may take
significant time to detect a fire (for
example compared with optical
(IR/UV) detectors). By the time the
bulbs operate, significant damage
may have been done.
The bulbs may also subject to
physical damage and corrosion
which could lead to false alarms. An
extensive pipe network is required
(linking the bulbs to the detection
system) to provide coverage of full
module.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 99 of 493
Methods of Fire
Detection
Strengths Weaknesses
Fusible links These melt at pre-defined temperatures
to raise an alarm/ESD by breaking a
circuit. Some directly initiate release of
hydraulic fluids to close safety valves
on wells or risers.
As above for fusible bulbs.
Fusible plugs These melt in fire situations to send an
alarm signal and release hydraulic
fluids thus closing well and riser safety
valves.
As above for fusible bulbs.
Rate of heat rise Detects rapid temperature change.
Useful in areas with temperature
fluctuations. Highly reliable as a single
detector, confirmed fire signal.

Rate of heat rise
- Rate Compensated
Detects temperature change. Highly
reliable as a single detector, confirmed
fire signal
Not as fast reacting as the rate-of-
rise detectors.
Fixed Detects a pre-set high temperature.
Based on thermocouple design. Highly
reliable as a single detector, confirmed
fire signal.

Gaining in popularity and reducing in
price with time.
Systems with good coverage can be
expensive to install and maintain.
Particularly good for checking alarms in
remote areas such as column bases on
semi-subs.

Conventional CCTV
used to supplement
traditional fire and
gas detection devices
Allows escape routes from TR to
evacuation points to be checked and
state of fire development in process
areas without exposing emergency
response personnel to danger.


The reliability of the fire and gas detection system needs to be designed in at the outset of
design and then maintained at a high level of reliability and availability throughout the
platforms operational phase. Best practice for new designs relies on good levels of
redundancy in the electronic system architecture (usually dual or triple redundancy) and will
include the following characteristics:
Electrical fault monitoring to detect any electrical discontinuity faults which have occurred
in the system. Fault alarms should not be cleared until the fault is investigated and
removed;
Significant redundancy in field devices;
Fire and explosion survivability for detectors and cabling;
Uninterruptible power supply.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 100 of 493
The required target reliability of the Fire and Gas detection system must be specified by the
Project team to the manufacturer at the outset of the system design (if not already specified in
the invitations to tender). It will be difficult (and extremely expensive) for anyone but the
manufacturer to produce the reliability figures once the system is already built.
As part of the current application of IEC 61508 [3.1] or IEC 61511 [3.2] (the latter being the
requirements and assessments of safety instrumented systems in the process industries
sector), the reliability and failure modes of instrumented safety systems must be considered
along with hazard probabilities and demand rates. Guidance on assessment techniques and
avoidance of failure modes can be found in this document.
3.2.7.3 Control methods
Fires that have not been prevented should be detected and then controlled to reduce the size,
duration, and escalation potential of the fire. The following control methods are commonly in
use offshore. All platforms are different, but many of these control methods will be relevant to
most installations. Note that extinguishants and manual firefighting are considered below as
control methods. Deluge systems and passive fire protection methods are classed as
mitigation methods because they generally protect against the impact of an existing fire rather
than working to control the fire itself. The mitigation methods are addressed in Section 3.2.8.
Some typical fire related operational and design considerations are provided for each control
method in Table 3.3 below.
Table 3.3 - Summary of methods of controlling fire
Control
method
Control mechanism Fire related design considerations
Process
Emergency Shut
Down Valves
(ESDVs)
Automatic - Reduces
inventory available to leak or
fire by isolating process into
separate, smaller, segments.
Ease of testing and maintenance. Regular test of
process ESDVs often neglected.
Specify and justify test interval and acceptable
leak rate as part of design. Record in performance
standard documentation
In fire situations several ESDVs plus adjacent
pipework may be engulfed at one time, releasing
several inventories to prolong fire.
ESDVs are frequently used at module boundaries
to prevent inventories from one module feeding a
fire in another, these divisions then match the
designated fire areas and their associated
firewater coverage. Where no such boundary
isolations are in place, it becomes possible for
hydrocarbon which is stored in one module to be
released into another module and fuel escalation
of further fires..
Riser ESDVs
(Topsides and
subsea)
Automatic - Isolates platform
from pipeline inventories at
the topsides.
Note that riser ESDVs are a
requirement in the UK
Continental Shelf under the
Pipeline Safety Regulations.
Topsides valves to fail close
Locate away from process fire areas wherever
possible.
Protect valve and exposed riser sections against
foreseeable fire scenarios
Always consider benefits of subsea pipeline
isolation, even a simple NRV may provide
significant risk reduction. Justify and record basis
of decision.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 101 of 493
Control
method
Control mechanism Fire related design considerations
Sub-sea Isolation
Valves (SSIVs)
Automatic - Isolates platform
from pipeline inventories at a
defined distance.
Topsides valves to fail close
Locate away from supply vessel routes, incoming
jack-ups and other potential sources of dropped
objects or dragging anchors. Locate the valve
such that uncontrolled events just the far side of
the SSIV will not pose a radiation problem for the
installation, distances are often of the order of
about 250-350m.
Well head and
downhole
isolation valves
Automatic - Isolates platform
from reservoir inventories
Surface and downhole valves to fail close on
confirmed fire or gas release event.
General Platform
Alarm (GPA)
Automatic - Removes people
to place of relative safety
Any prolonged fire necessitates evacuation as a
precaution
OIM and deputies must understand escalation
mechanisms and timeframes for all emergency
scenarios in order to be able to make competent
decisions.
Blowdown and
blowdown valves
(BDVs)
Automatic or manual -
Removes gases to flare or
cold vent
See also Section 7.7 for a
general review of Process
Responses
See also Sections 5.5.1.9 to
5.5.1.12 and 7.7.2 to 7.7.5 for
details on how the approach
described in ISO 23251:2006
[3.3] impacts blow down rates
and subsequent
consequences.
BDVs to be fail-open, unless this endangers
helicopter operations and pre-warning not
feasible.
Automatic facility recommended. Any manual
arrangements need clear and detailed instructions
for operation to offshore staff.
Appropriate blowdown time to be developed from
escalation scenarios
Process drain
facility
Automatic or Manual -
Removes main liquid
inventories from vicinity of fire
to a safer location (e.g. cellar
deck surge tanks)
Usually manual facility
Consider vulnerability of dump line route
Consider time required for draining
Manual fire
fighting
Manual fire intervention with
hydrants, fire hoses, foam
monitors, extinguishers etc
Appropriate for very small fires - Immediate
intervention on discovery of small fire can prevent
fire taking hold. All personnel trained for small fire
intervention.
Fire fighting, equipment cooling and helideck fire
control only possible where trained fire teams
available. Effectiveness depends on
understanding of installation-specific fire and
escalation scenarios and plus realistic offshore
exercises.
Note that even with training, fire fighting teams
that remain to fight a fire will be at greater risk.
Comparative risk issues must be understood and
precise criteria defined to limit fire fighting teams
exposure.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 102 of 493
Control
method
Control mechanism Fire related design considerations
Remote manual
fire fighting
Initiation of fixed or oscillating
fire monitors, with or without
foam.
Often used on helideck or open upper or weather
decks. May be affected by strong winds.
Inerting agents Prevents fire from
starting/taking holds by
rendering the atmosphere
inert Inergen

, CO
2
etc.
Useful in enclosed, remote spaces difficult to
access in fire situations (e.g. pump rooms in semi
sub or ship hulls)
Static discharge may ignite atmosphere, causing
explosion check potential with vendor.
Inerted atmosphere may not be breathable so
warnings and pre-discharge alarms required.
Extinguishants Stops fire burning by
preventing oxygen reaching
fuel, removing heat, or
otherwise interfering with
combustion process water-
mists, foams, some types of
deluge etc
Useful in enclosed spaces such as machinery
enclosures
Deluge and fuel/water wash-off needs weight-
control consideration, particularly on floating
installation.
Foam application Reduces evaporation of
vapours.
Creates film/foam to prevent
oxygen reaching liquid fuel
thus reducing, or
extinguishing pool fire.
Suitable for contained liquid fires. Less effective
on running pool fires, not effective on jet fires
Dirivent systems Disperses very small leaks to
prevent flammable cloud
build-up.
Only effective for fugitive (very tiny) leak scenarios
System shuts down on in major release scenarios
as may spread leak and mix release to flammable
concentrations.
Other HVAC
systems
Provides air exchange within
an enclosed area to prevent
or slow flammable cloud build-
up.
System needs special attention to be able to
provide adequate air flow rates and be safe, i.e. to
not introduce any ignition sources and also not
move the fuel/air mixture to other areas hitherto
safe within the context of the originating accident.
Bunds Control spread of liquid
releases
While bunds can contain a liquid release/fire, they
can also concentrate a fire around the equipment
in the bund and should be used in conjunction with
foam. Design must ensure deluge does not cause
bund overflow by being sized for maximum
foreseeable liquid volume release.
Drains Remove liquid and deluge
releases to drain system.
Small releases are usually within drain system
capacity. The drain capacity needs to be capable
of removing maximum foreseeable liquid volume
release although the effects of burning liquids in
the drain system must be checked.
Sea-fire possibilities and consequences need
checking
In emergency scenarios environmental issues
become secondary to preservation of life.

FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 103 of 493
3.2.8 Methods for mitigating the effects of fires
3.2.8.1 Firewalls
Dedicated firewalls are often used to physically separate fire areas. The basis of the
separation and the specification of the firewall are dependent upon both the fire types and
severities identified in the fire hazard area and the vulnerabilities of the equipment, systems
or personnel in the area being protected.
There are several grades of pre-defined firewalls and a fire risk analysis will generally choose
an acceptable defined standard rather than develop a bespoke standard (unlike designing a
blast wall for explosion hazards). Some of the general terms for firewall specifications are
described below. Firewalls continued performance is highly dependent upon the preceding
and succeeding events, not least how their integrity is maintained following an explosion
event. These and other interaction issues with explosion hazard management are discussed in
more detail in the section on Interactions between fire and explosion hazard management.
3.2.8.2 Class A-0 division
A division formed by a bulkhead or deck that is constructed of steel or an equivalent material
and suitably stiffened. It should prevent the passage of smoke and flame after 60 minutes of
exposure to a standard fire test.
3.2.8.3 Class A-60 division
A division similarly constructed as A-0 and is additionally insulated with non-combustible
materials so that, if either side is exposed to a standard fire test, after 60 minutes the average
temperature on the unexposed face will not increase by more than 139 C above the initial
temperature and also that the temperature at any point on the unexposed face, including any
joint, will not increase by more than 180 C above the initial temperature.
3.2.8.4 Class B-15 division
A division formed by a bulkhead, ceiling or lining that is constructed and erected entirely from
non-combustible materials and prevents the passage of flame after exposure to a standard fire
test for 30 minutes. It is insulated so that if either face is exposed to the first 30 minute period
of a standard fire test, the average temperature on the unexposed face will not increase at any
time during the first 15 minutes (of that test) by more than 139 C above that initial
temperature. The temperature at any point on the unexposed face, including any joint, will not
increase by more than 225 C above the initial temperature after exposure for 15 minutes.
3.2.8.5 Class H-120 division
A division similarly constructed as A-0 and is additionally constructed to prevent the passage
of smoke and flame after exposure to a hydrocarbon fire test for 120 minutes. It is insulated
with non-combustible material so that, if either face is exposed to a hydrocarbon fire test, after
120 minutes the average temperature on the unexposed face will not increase by more than
139 C above the initial temperature and also that the temperature at any point on the
unexposed face, including any joint, will not increase by more than 180 C above the initial
temperature.
3.2.8.6 The standard fire test
The "standard fire test" is a test conducted in accordance with Regulation 3.2 of Chapter II-2 of
International Maritime Organization International Conference on Safety of Life at Sea [3.4].
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 104 of 493
3.2.8.7 The hydrocarbon fire test
The "hydrocarbon fire test" is a test in which a specimen division which resembles as closely
as possible the intended construction and includes (where appropriate) at least one joint and
has an exposed surface of not less than 4.65 m
2
and a height or length not less than 2.44 m,
and is exposed in a test furnace to temperatures corresponding approximately to a time-
temperature relationship defined by a smooth curve drawn through the exposed test
temperatures (indicated below), measured above the initial furnace temperature.
Temperature
point
Time interval
(N minutes
after start of test)
Exposed test
temperature
(increases in
Celsius)
1 3 880
2 5 945
3 10 1032
4 15 1071
5 30 1098
6 60 1100
7 120 1100
3.2.8.8 Penetrations and closures in firewalls
Where a firewall of any class is pierced for the passage of electric cables, pipes, trunks or
structural elements or for other purposes, the penetration must be arranged so that fire
resistance standard of the division is not impaired. Similarly, any openings such as doors or
other access hatches must match the integrity of the division when closed and in the case of
doors be self-closing.
3.2.8.9 Passive fire protection methods
Passive methods are preferred where specific protection of critical process or structural items
is needed in order to prevent escalation. Widespread application to process and structural
items is not generally feasible due to weight, inspection and maintenance/replacement issues.
Modern design philosophy is to identify specific areas or items of concern (usually structure or
piping which on failure would escalate the initial event) and target these items for PFP
application. PFP is preferred over deluge in such situations since it is immediately available
and has no moving parts to fail and prevent operation.
If properly applied/installed it is highly reliable in service. However it has also been the cause
of problems in the past so current best practice concerning the design and application of such
systems, is discussed below.
Passive fire protection (PFP) comes in many forms, but the object is always to provide some
sort of heat insulating barrier between the fire and the item to be protected. PFP can be
designed for use on vessels, pipework, structural members, boundary walls or individual items
of safety critical equipment. The objective is to prevent the protected item heating up and
either losing strength, losing function, distorting or producing noxious fumes.
Previously the design emphasis was on application of codes and rules. For example,
accommodation block were given A60 walls regardless of the fire risk to the accommodation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 105 of 493
Now, best design is to design all PFP systems to be appropriate to the specific fire scenario for
which the PFP is required. PFP can be effective in protecting against high pressure jet fires
whereas deluge is not
The system is usually designed by the PFP suppliers engineers to the scenario-based
specification of the relevant discipline engineer (process, structural, mechanical or instrument
as appropriate for the item being protected) and the safety engineer.
For any of the systems outlined below it is up to the designer to demonstrate initial suitability of
the PFP system to the IVB and HSE, and the duty holder to maintain the protection throughout
the lifecycle. For some of the common systems initial suitability is easy to demonstrate since
the manufacturer will have a standard fire test certificate (such as A60, B15, or H120) for the
proposed system. However for some of the newer products, or existing products in severe or
novel applications such classification is not easy to obtain and the demonstration of suitability
will have to be via specially devised fire tests or research. Some considerations around
standard fire tests are discussed in Sections 7.2.1 and 7.3.2 of this Guidance.
The following types of PFP are in current use and their uses and drawbacks are discussed in
the paragraphs below and further in Section 4.4.2.
3.2.8.10 Cementitious or vermiculite type
These are heavy mineral-based based coatings which can be applied to walls, structure or
pipework in a wide variety of ways from spraying or trowelling to bolting-on of pre-formed
sections. They have been used extensively offshore since the 1970s. There are many different
types available. The thickness of the coating principally determines the time it takes to transfer
the heat through the coating and the mechanical strength of the compound or sometimes an
extra outer shell, determines whether the coating will withstand the physical impact of the fire,
for example erosion from jet fire impingement or pressure waves from explosions.
Since the properties of cementitious or vermiculite coatings are well researched and many
applications have been extensively tested, classification of the protection is relatively easy to
obtain. Some systems have been tested and found capable of withstanding the impact of high
pressure jet fires.
In the 1980s and early 1990s the biggest problem with use of these coatings was that the
offshore installation process was carried out poorly. Many poorly applied coatings fell off after
a few years. Deluge water found its way beneath coatings and the fixing pins or protected
items (particularly where they were warm) corroded rapidly. Some coatings just disintegrated
with time. Products have improved significantly since the early 1990s and recent experience
has demonstrated that provided these systems are installed in full compliance with the
manufacturers instructions, there are few problems. However it is difficult to exercise control
over application in the offshore environment, especially in exposed areas and below main
deck levels. Therefore, wherever possible for new designs, coatings should be installed
onshore under controlled conditions before float out.
Removable PFP, in the form of enclosures or blanket wraps can be removed to allow
corrosion checks and inspection/maintenance of protected equipment. However, removable
systems are not practical in many places, being generally heavy, costly and requiring space.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 106 of 493
3.2.8.11 Intumescent coatings:
Intumescent paints and coatings work by expanding to many times their original thickness on
exposure to high heat or flame to produce a fire resisting, thermally insulating coating or char.
Like the mineral-based coatings discussed above they are available in a variety of forms to
suit a wide variety of applications from protection of deck undersides to sealing of piping or
cable transits.
The possibility of corrosion under PFP coatings is a major concern for designers. For new
builds it is possible to plan for future inspection through the coating, out as explained below.
Retrofitted systems remain problematic. Although intumescent coatings can now be applied in
fairly thin layers, use in underdeck or other exposed areas and particularly in the splash zone
usually requires a thin neoprene layer under the coating and another on top to prevent
external corrosion and protect the coating. Any such thick or composite coating makes
subsequent NDT inspection results extremely difficult to interpret. It would be possible to plan
for such NDT inspection if the designer specified at the outset that sample pieces of steel were
taken and kept, coated and uncoated, for calibration purposes. This would allow results to be
interpreted with more confidence. For retrofitted systems, without these calibration aids,
effective NDT through PFP coating systems is not practically achievable at present. Research
continues but no viable methods exist at present.
Wet-applied intumescent coatings often shrink slightly as they dry out, and they usually give
off toxic gases when they intumesce. The effects on adherence to substrate plus the migration
of toxic gases to affect personnel need taking into account during design.
As for the cementitious PFP, proper preparation of surfaces to be coated with intumescent
PFP is essential for long-term performance. Intumescent systems can be specified to provide
fire protection for anything from minutes to hour, and many systems have been through fully
documented testing. Both cementitious and intumescent coating systems are continually
changing and developing so details are best obtained directly from the manufacturer.
Further discussion of common types of PFP application, such as PFP in firewalls, enclosures,
flexible wrap systems etc is provided in Section 10.3.2.2 on passive fire protection systems.
3.2.8.12 Weathered and cracked PFP
Since much of the PFP in existence on offshore installations at the current time is suffering
from ageing, 2 separate projects have been initiated. HSE and HSL are continuing a
programme started by Shell which will report on the effects of 10 years of weathering (and
ageing) on the fire resistance of PFP. A joint industry research project is underway by MMI to
determine which types of damage to PFP are most critical and what are the most effective
repair methods. At the time of issue of this Guidance, both projects were still set to publish.
In addition, ageing, weathering or other damage to PFP can cause a loss of water-tightness
and thus lead to water penetration and potential corrosion. This in turn creates difficulties for
the maintenance teams to inspect and monitor potential corrosion points under PFP.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 107 of 493
3.2.9 Active fire protection methods
3.2.9.1 Mitigation by deluge water application
Deluge works mitigates the effects of fires principally by providing cooling both to the fire and
to equipment exposed to radiant heat from the fire. In addition it can wash away liquid fuel fires
to drain systems or overboard. Protection of all the equipment in a module by application of
PFP is rarely practical, so the alternative is to deluge a whole module or section of structure
with large quantities of water.
The water acts to:
Cool the general area by evaporation of the smaller water droplets (see also various sub-
sections within Section 5.2 where the effects of deluge on different fire types are
described);
Provide a running film of water onto equipment in the area in order to cool it;
Provide a screen of water droplets as a barrier to radiant heat, thus reducing the heat
load on structures and equipment;
Provide a screen of water droplets as a barrier to radiant heat exposure of people;
Retard the movement of the flame front through a module and consequently reduce
explosion overpressures to some degree.
For general area cooling the key factors are application rate and water droplet size. If the
water droplets are too small, they evaporate rapidly in a severe fire or can be blown away if
the area is exposed. If the droplets are too large there is less evaporation from fewer droplets
and the cooling is inefficient for the amount of water used. The droplets however are less
affected by wind, will reach the floor, cool and wash liquid spills away and can provide a
running film of water over equipment to keep it cool. Larger droplets however require bigger
pumps, more power, and more AFFF so the cost of the system has to be balanced against its
effectiveness. The deluge rate depends on both the fire scenario and the escalation potential,
but the general rules are:
General deluge only protects equipment exposed to flame or/and radiant heat from pool
fires or radiant heat from jet fires providing there is a sufficient deluge rate to provide a
film of running water over the equipment. Where a jet-flame actually engulfs equipment,
however, much of the film is likely to be displaced by the jet flame and the cooling effect
lost. Directed water deluge using high velocity nozzles may be used as trials have
indicated an increased effectiveness against jet fires; Section 5.2.2.2 discuss deluge
protection options in the context of jet fires.
Areas shielded from deluge but exposed to the fire will receive some limited protection
from the heat attenuation of the deluge droplets falling between the location of the fire
and the location of the equipment. Objects subject to thermal radiation from fires (but not
direct fire impact) receive benefit from attenuation of the water sprays active between the
location of the fire and the object.
Suppression of combustion and cooling of the high heat layer in the roof of a burning
module (where the module is partially enclosed) is known to be achievable by spraying of
very fine droplets at roof beam height. At the present time there is no method for
calculating the protection provided by this mechanism,
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 108 of 493
The deluge rate and droplet size must be suitable for the cooling mechanism appropriate
to the type of fire. Where there are several different scenarios, the deluge rate for the
worst-case scenario, should be used as this should cover all lesser cases. Therefore in
the case of enclosed modules with potential for serious, pressurised oil, gas or
condensate fires deluge rates of 20 to 24 l min
-1
m
-2
would be needed, with rapid
activation and water coverage especially at roof-level where the high heat will
concentrate, However, deluge of high pressure gas jet fires within enclosed spaces will
very likely result in extinction of the fire and could lead to an explosion hazard.
3.2.9.2 Vessel deluge
Further details on appropriate flow rates and other design issue for deluge systems are
provided in Section 10.3.2.4.
3.2.9.3 Mitigation by sprinkler systems
These are usually potable water filled systems and provided in areas where the fire-risk is non-
process related and therefore less severe, for example inside accommodation modules. They
are activated by frangible bulbs, which release water directly from the sprinkler piping as soon
as the bulb is broken by the heat of the fire in the area. Design is straightforward by
comparison with deluge systems and is usually in accordance with the applicable NFPA
standards.
3.2.9.4 Watermist systems
Water-mist systems are now commonly being used in turbine, generator or pump enclosures
to replace Halon protection systems which are no longer permitted for use. The fine mist is
injected intermittently from pressurised water reservoirs/ cylinders, in roughly 15 second
bursts. The mist provides cooling and suppresses the combustion, which will be also be
controlled by lack of air into the enclosure (provided there is no explosion on ignition). In
enclosed spaces, protection systems need to take account of manning regimes and hence
should include warning systems to evacuate personnel as the mist systems are being armed.
Enclosure type fires tend to be non installation-threatening (but always need due consideration
within the fire and explosion review process for the installation) The protection is usually
automatic and provides immediate control, however there are a limited number of mist-
injection cycles available from the water reservoir and instruction/training for follow-up action
by the platform personnel e.g. fire team action and/or evacuation needs to be covered in
platform emergency response plans.
3.2.9.5 Gaseous systems
Gaseous systems have been a common replacement to Halon systems, but it should be noted
that Halon systems actually disrupted the combustion process; not all replacement media have
the same effect.
Replacement gaseous systems are:
Carbon Dioxide (CO
2
);
Replacement low oxygen alternatives (e.g. Inergen

);
Replacement Halon alternatives;
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 109 of 493
These alternatives function primarily by displacing the oxygen from the fire, although in
addition, the CO
2

option generates a low temperature upon release which has a cooling effect
on the fire.
The fire extinguishing media can themselves present hazards, most notably CO
2

which is a
powerful asphyxiant which causes hyper-ventilation exacerbating the hazard.
Inergen

has specifically been design to provide a safer fire-fighting medium within which
personnel can survive, providing only just oxygen to sustain breathing (with some difficulty) but
not enough to sustain a fire.
3.3 Appropriate performance standards
3.3.1 Application of performance standards
The fire and gas detection and protection systems on an installation are generally categorised
as safety critical systems, or safety critical elements (SCEs) for the installation. In order to
pass on the understanding of the design and operation of each system to those who operate
and maintain the installation, the key features of the systems are recorded for all to see and
understand in the form of Performance Standards.
The Performance standards for SCEs should contain precise information relating to the
functionality, availability, reliability and survivability of the system in question
It is rare for platforms to have only one type of device within such systems. The Fire and Gas
Detection or the Active Fire Protection SCEs for example will have many different aspects,
parts or subsystems. While the goal of the overall system will be the same, the Performance
Standards for each part of the SCE will probably be different and needs to be specified
separately within the documentation.
3.3.2 Functionality issues
As can be seen from Section 3.2.7, there are many different types of equipment available for
the purposes of detecting fires and gas releases, and for protecting against fire. The principals
of operation of the various sub-systems vary widely, as do the availability and reliability
requirements of the equipment involved. It is important that the Performance Standard
captures all the key information, not just part of it. In addition it should provide cross
references to the various codes, standards, analyses and guidance documents which have a
bearing on the performance.
Some examples of different functionalities within the same SCE Performance Standard are
shown in Table 3.4 below:
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 110 of 493
Table 3.4 - Typical safety critical element functionality descriptions
SCE Sub-item Functionality
Typical
derivation/
supporting
documents
1. Gas detection at
inlets to enclosed areas
containing non-certified
electrical equipment
Detect low-level gas at 10 % (alarm)
and high-level at 25 % (ESD 1, close
dampers, S/D fan). 3 IR Point detectors
in each duct on 2oo3 voting
Fire and Gas
Detection
Philosophy
Fire and Gas
Cause and Effect
Drawings
2. Gas detection in
open hazardous areas
Detect 50 % LEL gas cloud of radius
5m or more using paired IR beam
detection in process modules.
Confirmed beam-pair detection initiates
ESD 2.
Installation Safety
Case
Gas detection
system
Goal:
Detect loss of
containment
events.
3. Acoustic leak
detection
Detect gas leaks of 0.1 kg s
-1
and
above in process modules. Executive
action only on coincident gas detection
(by beam detectors) in same area.
In-house Vendor
Design Code for
Acoustic
Detection
1.Water deluge with
AFFF in Process
Modules including
communicating
mezzanine and deck
levels
12 l min
-1
m
-2
general area coverage in
LP separator and oil metering modules
with at least 3 % AFFF to cool
equipment in vicinity of oil pool fires and
prevent consequent leakage from other
inventories. Activated on confirmed
Flame detection (2ooN) voting.
Active Fire
Protection
2. Water mist
application in
Generator Rooms A
and B
Water mist injection to generator rooms
to provide suppression and cooling.
Activated on confirmed smoke or heat
detection in generator room.
Firewater design
philosophy
Installation Fire
and Explosion
Analysis and
Assessment
In-house vendor
design code for
Water Mist
Systems
1.H120 firewalls Firewall at gridline 2, process area
boundary, providing protection to TR
and TEMPSC embarkation areas
Passive Fire
Protection
2. J15 passive fire
protection on First
Stage Separator
Fire protection of gas space of First
Stage Separator to protect against jet
fire impingement from gas export
system and potential BLEVE.

Note that a jet fire rating has been
proposed in the latest draft version of
the ISO (22899-1) on the jet fire test.
This is specified as:
Type of application / Critical
temperature rise ( C) / Type of fire /
Period of resistance (minutes).
Safety Case
Passive Fire
Protection
strategy
Document.
Installation Fire
and Explosion
Analysis and
Assessment
Vendor design
Code for PFP
suitable for Jet
Fire impingement

3.3.3 Availability issues
These are often given limited consideration in Performance Standards. It is important to
understand the availability issues for any Performance Standard. A significant factor in
generating a systems availability is obtaining an estimate of the level of unrevealed failure
modes to which the system may be subject.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 111 of 493
Just as there are different functionalities there are differing availabilities associated with
different methods or types of protection equipment. Availability is not the same as reliability.
The availability is the fraction of time the equipment is available to perform its intended
function. A passive coating for example is available 100 % of the time (assuming it has not
been damaged or degraded in service). A passive fire protection enclosure or removable
cladding on a vessel however may be removed for several weeks in the year to allow
inspection of a valve or NDT of a significant part of a vessel. Similarly, automatic Fire and Gas
detection systems might be keyed out, making them only partially available during
maintenance or project related activities.
It is important that the person responsible for devising the Performance Standard also
documents the assumptions made regarding availability, so that the design intent is correctly
understood and upheld throughout the life cycle of the installation by the operations and
maintenance personnel.
Some example maintenance arrangements for safety critical equipment are given below.
F&G detection system During period of unavailability of fire and gas detection in an
area due to essential maintenance, local manual surveillance for fire/gas events would
be provided at all times.
Evacuation Systems on NUIs During unavailability (e.g. testing) of escape and
evacuation equipment, a standby vessel would be on close stand-by to assist rapid
evacuation. Manning for the purposes of testing should only be allowed within
documented weather operating limits of the available (remaining) evacuation systems.
3.3.4 Reliability issues
Reliability and availability are two technical terms that are often confused. Availability has been
explained above. Reliability is the probability that the system or item of equipment will perform
its intended function when required to do so. The reliability details for each system or
subsystem listed within a performance standard should be clearly stared, with reference back
to the reliability studies carried out during the design of the equipment. Changing the
frequency of inspection and maintenance will have a direct bearing on its stated reliability. For
this reason the maintenance or the inspection period used as key input to the frequency figure
quoted must also be quoted in order for the reliability figure to be meaningful. As noted above
for availability, it is important to obtain an estimate of the level of un-revealed failure modes the
system may be subject to, preferably from gathered own experience.
It is also important to understand that reliability figures theoretically derived from calculations
involving manufacturers data on mean time to failure may be over optimistic. It is strongly
advised that platform specific information is used in evaluating equipment and plant reliability.
The manufacturers data may have been gained under laboratory conditions and produces
times-to-failure information that may not be reproducible in the real offshore environment or
otherwise represents an amalgam of accumulated data from a range of applications and
maintenance regimes. For example, theoretical calculations for a pellistor gas detection head,
using the manufacturers data may imply that an adequate reliability is achieved by a 6
monthly test and inspection frequency. In reality, if the detector is then placed in an air inlet
duct, exposed to salt, spray, temperature and pressure cycling and vibration, the time to failure
in actual service may be significantly shorter. Where un-revealed faults in safety equipment
could occur, test/ maintenance history must be monitored. If every time the gas detector is
tested it fails to operate there must be immediate feedback to the responsible engineer, that
the high reliability indicated in the Performance Standard is not being achieved. The test
frequency should then be adjusted (for example to a 3 monthly interval) until it can be
demonstrated that an appropriate level of reliability is restored.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 112 of 493
Voting arrangements for heat, smoke, flame or gas detectors also have a direct bearing on the
proposed frequency of maintenance interventions. For example, a detection voting system that
requires 1 detection element to be activated out of a total 2 (known as 1 out of 2 and indicated
as 1oo2), has only one other item by way of redundancy plus a spurious indication from either
item will cause unit or platform shutdown. It should be remembered that reliability
requirements encompass unnecessary activation as well as failure to activate. The built-in
redundancy is unavailable during maintenance of any one item. Industry good practice has
converged on 2 out of 3 voting systems (2oo3) which offer a good compromise of high
reliability of having 3 items available and still leaving a working arrangement in the event of a
single item failure plus the demand rate for spurious indications is lower as a confirmed signal
is always required. During maintenance this arrangement becomes a 2oo2 system. The voting
arrangements should always be stated in the Performance Standards. Where reliance is
placed on just one or two detectors to take executive action a review of the failure modes and
the consequences of failure should always be undertaken and the consequences of
maintenance changes need to be evaluated to ensure there are no knock-on effects to the
platforms overall risk profile.
3.3.5 Survivability
The Performance Standard must state the survivability requirements for each SCE and each
of its component parts where there are different requirements to those for the overall system.
This makes it clear to all concerned exactly how long the item will need to continue to function
in a major emergency in order to fulfil its safety role. For example one or more of the
communications systems and the place of temporary refuge (TR) will be required to function
as long as there are any personnel left on the installation. This may be anything from 10
minutes on a small NUI to 2 hours on a large installation. Individual fire or gas detectors
however may only need to survive for long enough to detect the release or fire and initiate the
necessary alarms, shut-downs and blowdowns. This may be only a few seconds. Valve
actuation systems may need around a minute. Whatever the specified survivability, the
information provided in the Performance Standard must be clear and unambiguous to the
reader. Experience from major disasters both on and offshore indicates that failure to examine,
understand and then communicate the survivability requirements of the provided safety
systems to the right personnel has been a major contributor to the disaster.
3.3.6 Written schemes of examination (WSEs) or verification
Detailed schemes of examination or verification are required under the PFEER and DCR
regulations to provide an independent check that:
the initial design of the safety critical system/element is appropriate for the hazard;
the SCEs procured; installed and commissioned still achieve their required function;
the maintenance being carried out is compatible with the reliability and availability
specified in the Performance Standard;
the maintenance considers the likely failure modes (especially un-revealed failures) of the
components.
The written schemes must be thorough; any essential information omitted from these
documents is in danger of being left out of either the maintenance scheme or the written
schemes of the independent Competent Person, leading to gaps in the platform safety
management system. Such gaps may only come to light in the aftermath of a major incident.
The written scheme is required to be live through the platforms lifetime and may be re-
affirmed at any time.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 113 of 493
3.4 Methods and approaches to structural analysis
3.4.1 General
The risk level for the installation as defined by the risk matrix given in Section 2.8.2 determines
the level of sophistication required for the fire assessment.
If the conservatism of simplified methods of analysis can be guaranteed, then these could be
used at an early project phase or as a first step in a sequence of analyses of increasing
sophistication.
For High or Medium risk installations, a Structural Assessment should be performed for a
representative range of fire scenarios. The process and Safety disciplines will generally define
these Scenarios.
A Structural Assessment may be performed at three levels of increasing complexity starting
with a Screening Analysis. Should a structure fail the Screening analysis then a Strength
level analysis will be required. If it fails the Strength level analysis then Ductility level analyses
must be performed. If the Ductility level analysis indicates failure then mitigation measures are
required. These could involve measures for elimination or reduction of the frequency of
exceedance of the initiating event, reduction of the severity of the consequences of the event
or structural modification.
Failure in the context of fires means failure to satisfy the performance standards for the
installation. High-level performance standards for the installation and safety critical
components are defined in terms of allowable peak temperature, strain or time to collapse
depending on the method of analysis used.
Screening Analysis, Strength level or Ductility level performance characteristics from an
assessment of one installation may be used to infer the fitness for purpose of other similar
installations, provided the framing, foundation support, service history, structural condition,
blast and fire barriers and payload levels are not significantly different. In cases where one
platforms detailed performance characteristics are used to infer those of another similar
platform, documentation should be developed to substantiate the use of such generic data.
The required initial level of analysis depends on the Risk level assigned to the installation or
the risk level associated with a representative set of fire scenarios.
The risk category of the installation does not preclude the use of more sophisticated methods
of assessment which may result in reductions in conservatism and hence cost, if they are
considered more appropriate.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 114 of 493
Table 3.5 - Appropriate method of analysis fires
Risk level
Analysis
method
Load calculation bases
Response
calculation
Low Screening
analysis
Allowable temperature (yield strength
reduction to 60 %
Past experience.
Design basis checks.

Past experience for
demonstrably similar
platforms.
Strength level
analysis
Calculate peak temperature member by
member, from nominal fire loads and fire
extent.
Strength level analysis,
Redundancy analysis
Medium or
High
Ductility level
analysis
Calculate temperature - time history of
primary members from fire loads time
history and flame extent.
Redundancy analysis,
Ductility level analysis

A structural Redundancy Analysis of a topside structure will indicate which members can be
removed without collapse of the structure. In addition those members not supporting the TR,
muster areas, escape routes or safety critical equipment must survive during and after the fire
event for sufficient time to allow personnel on board to escape, allowing for the possible need
to assist injured colleagues. The results of a fire response analysis will then indicate which
structural members and SCEs must be protected to achieve the fire performance standards for
the installation.
Simple fire response analyses are usually performed based on the following
assumptions [3.5].
Unprotected structural members and panels have no variation of temperature through
thickness or along their length. In practice the critical sections of the member are
considered from the point of view of resistance.
Fire protected structural members and panels have a constant steel temperature, the
thermal insulation has a linear variation of temperature through thickness.
Each member may be considered to have reached a steady-state variations of
temperature are due entirely to changes in boundary conditions and incident heat
fluxes.
Conduction between members need not be considered (except when considering coat-
back requirements).
Thermal stresses due to restraint may generally be neglected as supports also soften
during fire loading.
The methods of analysis identified above are discussed in the following sections.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 115 of 493
3.4.2 Screening analysis
A screening analysis for an existing installation consists of a condition assessment which may
involve a survey followed by design basis checks.
Design basis checks consist of checking the basis of the existing design for the installation and
determining if the methods used for the design are currently acceptable in the context of fire
events.
For a Screening Analysis, the Zone method may be used. The Zone method assigns a
maximum allowable temperature that a steel member can sustain. This method does not take
into account the stresses present in the member before the fire. The maximum allowable
temperature may be read from Table 3.6.
These temperature values correspond to a yield strength reduction to 0.6 of the ambient
temperature values. The fact that a fire is an accidental load will mean that the allowable
stress is the full yield stress value as opposed to about 60 % of the yield stress allowed for in
the conventional design load cases. The yield stress corresponding to 0.6 of the ambient yield
stress will then give an allowable stress the same as that for the structure before the fire.
Higher strain levels than 0.2 % may give a proportionately higher decrease in Youngs
Modulus giving an unmatched reduction in yield strength with the reduction in Youngs
modulus exceeding the reduction in yield strength. The Zone method may then not be
applicable [3.6].
Fire barriers must perform according to their required rating.
A blanket critical temperature for all members may be postulated as in the Zone method. This
critical temperature is chosen typically to be 400 C as this requires no modification to the
normal code checks if strains are limited to 0.2 % in an elastic Design Level analysis. This
approach may result in unnecessary protection and may be unconservative locally to areas of
high strain.
It will not usually be necessary to protect every vulnerable member unless the scenario
performance standards demand that the installation is required to re-start after a few days.
The above method will indicate the protection of non-essential members from the point of view
survival of the installation.
The temperature calculation for each member is performed and measures are taken to restrict
the temperatures to values below the critical temperature usually by the application of PFP
(Passive Fire Protection).
It will also be necessary to check that radiation levels on escape ways remain at acceptable
levels (i.e. below 2.5 Kw m
-2
), to allow for personnel on board to escape.
3.4.3 Strength level analysis
Strength level analyses are conventional linear elastic analyses as used in design against
environmental, operating and gravity loads. The loads used in such an analysis should be in a
form which could be interpreted as a load case as used in the design process.
In investigating the effect of a fire the live loads such as contained liquids and storage may be
taken as 75 % of their maximum values as is the case for the consideration of Earthquakes.
Alternatively, live loads may be taken as the values used in the fatigue analysis performed for
the installation if these have been properly derived.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 116 of 493
The transfer of conclusions and load characteristics from the analysis of a geometrically
similar platform with similar structural and process characteristics is acceptable for strength
level analyses.
In a strength level analysis a maximum allowable temperature in a steel member is assigned
based on the stress level of the member prior to the fire such that the utilization ratio remains
less that the corresponding value given in Table 3.6 below.
The maximum allowable temperature in a steel member as a function of utilization ratio is
given in Table 3.6 below.
Table 3.6 - Maximum allowable steel temperature as a function of Utilisation Ratio [3.5]
Maximum member temperature Yield strength reduction factor
Member UR at 20 C
to give UR = 1
at max. temperature
C F
400 752 0.60 1.00
450 842 0.53 0.88
500 932 0.47 0.78
550 1022 0.37 0.62
600 1112 0.27 0.45

If the primary structure on the installation have been designed for all credible fire scenarios to
then the primary structure will be acceptable from a fire resistance point of view.
Higher strain levels than 0.2% may give a proportionately higher decrease in Youngs Modulus
giving an unmatched reduction in yield strength and Youngs modulus. Strength level checks
may then give utilization ratios above unity. A Ductility level or elastic-plastic method of
analysis may be required.
Table 3.7 gives the maximum allowable steel temperature as a function of strain. The peak
temperature of each member needs to be determined for the fire event to check if the
structural response remains elastic.
Table 3.7 -Maximum allowable temperature of steel
Maximum Allowable Temperature of Steel
Strain %
Celsius Fahrenheit
0.2 400 752
0.5 508 946
1.5 554 1029
2.0 559 1038

Fire barriers must perform according to their required rating.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 117 of 493
3.4.4 Scenario or performance based strength level analysis
In a performance or scenario based approach, the first task involves the definition of credible
fire scenarios from the failure probabilities of vessels and piping, the inventory pressures local
to the release point, the material released, the emergency shut down systems available and
the ventilation conditions. This information will normally be supplied by the Safety and Process
disciplines.
A scenario based Strength level analysis is performed in the following general stages:
1. Definition of a fire scenario. (See Section 3.2.1.
2. The time history of the rate of release is calculated.
3. If required, the probability of occurrence of the release can be estimated from published
failure statistics and the numbers of past failures which are available for most types of
vessels, flanges and process equipment generally [3.7, 3.8, 3.9, 3.10, 3.11 and 3.12].
4. Calculation of the burning rate for the fire geometry enables the extent and duration of
the fire to be determined.
5. The heat output from the fire in terms of radiation and the convection of hot air and
gases may then be determined (see also Sections 5.3, 5.4 and 5.5).
6. The heat incident on structural members and panels may then be used to calculate the
temperature/time history of the member.
7. For load bearing members, the temperature determines the appropriate values for the
yield stress and Youngs modulus of the material of the member to be used in the
structural analysis performed.
8. For panels and firewalls, which are usually non load bearing, the important parameters
are the temperature of the cold face and the time to reach certain limiting temperatures
which determine the walls rating.
9. It will also be necessary to check that radiation levels on escape ways remain at
acceptable levels where immediate injury will not caused (i.e. below 2.5 kW m
-2
).
10. A utilization ratio of up to 1.7 will be acceptable for members loaded in bending if a
small amount of plastic deformation is acceptable. A different utilization ratio will be
appropriate for detection of buckling. Shear stresses should be kept within the yield
stress for the material at that temperature. Alternatively the yield stress may be
enhanced by a factor of 1.5 to take account of the fact that fire is an accidental load.
11. Modified code checks may be made on the structural members and if load re-
distribution is neglected then the material effects and isolated plasticity may also be
taken into account in the analysis.
12. The occurrence of plastic hinging may be taken into account by factoring the
acceptable utilization ratio by the ratio of the plastic Zx to elastic section modulus Sx.
This factor is generally greater than 1.12 and will be in the range 1.1 to 1.5. The
member must be able to sustain the formation of a plastic hinge before buckling, i.e. be
in tension or be a plastic section.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 118 of 493
13. Use of the critical temperature approach may give an efficient scheme for the
application of PFP in combination with a full non-linear elastic-plastic (progressive
collapse) structural analysis. This type of analysis is referred to as a ductility level
analysis for fire or explosion response calculations.
3.4.5 Redundancy analysis
An elastic linear analysis is performed to determine the minimal structure which will fulfil the
requirement that escape ways will remain available for sufficient time to allow escape and that
the TR integrity is maintained during and after a fire event.
A structural redundancy analysis will determine which members are essential for the above.
Protection of these members with PFP will complete the assessment on the basis of a
redundancy analysis.
The determination of the critical structural members may be performed using an elastic
structural frame model as follows:
1. Eliminate all non-critical structural elements by inspection, with due regard to
escalation potential;
2. Remove all members identified in step 1;
3. Modify the static loading to represent the probable load at the time of the fire 75% of
the loads associated with process contents and storage may be used as suggested for
Earthquake analysis [3.6];
4. Remove safety factors in the code check, enhance the yield stress by a 1.5 factor, or
allow a correspondingly higher utilization;
5. Identify those members with the highest utilization ratios - particularly relating to
stability using the frame model;
6. Remove these members from the geometry;
7. Repeat step 6 and assess the remaining structure at each stage.
3.4.6 Ductility level analysis
A ductility level analysis may be required for Medium or High Risk installations. This method of
analysis can take into account the load re-distribution which takes place when structural
components fail and the time to failure of the structure considered.
A number of options for the linearization of stress/strain relationships at elevated temperatures
exist. If the software used for the ductility level analysis allows temperature dependent
stress/strain curves to be input then the linearization will not be necessary.
1. The levels of heat radiation and convection from the selected fire scenarios are calculated.
2. The time history of the increase of temperature of the structural components is derived.
3. Conduction of heat from neighbouring structural components will also occur but may
generally be ignored in the primary framing analysis.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 119 of 493
4. Once the steel temperature at a given time is known, the reductions in yield stress and
Youngs modulus may be calculated.
5. Failure of a structural member is defined as collapse (where increasing displacement
results in no net increase of capacity) under the imposed static gravity and operating loads.
6. In investigating the effect of a fire the live loads such as contained liquids and storage
may be taken as 75 % of their maximum values as is the case for the consideration of
Earthquakes. Alternatively, live loads may be taken as the values used in the fatigue
analysis performed for the installation if these have been properly derived.
7. Optimization of PFP (passive fire protection) thickness is rarely worthwhile as application
of PFP to a given thickness is not sufficiently controllable. The thickness of PFP is
controllable at best to within about 3 mm.
8. The scenario based strength level analysis method will not detect failures at intermediate
or later times caused by thermal restraint from cold members. This is, in any case, an
unlikely event in the context of offshore topside structures. Imperfections or deflections for
example due to a previous explosion will not be taken into account. It will be necessary to
use a ductility level analysis to take these effects into account.
9. In view of the fact that a single scenario is only one among many, the spatial variation of
thermal loading is not generally meaningful. It is unlikely that this level of analysis will be
necessary unless a single extreme event such as a riser failure or blow-out which puts the
whole installation at risk is being considered.
10. It will also be necessary to check that radiation levels on escape ways remain at
acceptable levels (i.e. below 2.5 kW m
-2
).
3.4.7 Assessment of fire barriers
Fire barriers are given a rating derived from the SOLAS (Safety of Life at Sea) [3.4]
classification system for use on ships. Originally they were developed for cellulosic fires as
opposed to hydrocarbon fires, which are more severe. The type of fire is represented in a
furnace test where the firewall is in contact with a furnace with a well-defined temperature/time
relationship. The hydrocarbon fire curve has a higher rate of temperature rise and attains a
higher peak temperature.
The three main ratings used offshore are:
B Maintains stability and integrity for 30 minutes when exposed to a cellulosic fire. The
temperature rise of the cold face is limited to 140 C for the period in minutes specified
in the rating. i.e. A30 has a 30 minute time period during which temperature rise is
below 140 C.
A Maintains stability and integrity for a period of 60 minutes when exposed to a cellulosic
fire. The temperature rise of the cold face is limited to 140 C for the period specified in
the rating.
H Maintains stability and integrity for a period of 120 minutes when exposed to a
hydrocarbon fire. The temperature rise of the cold face is limited to 140 C for the
period specified in the rating.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 120 of 493
J Currently proposed one in latest draft version of the ISO (22899-1) [3.13]; identifies
Type of application / Critical temperature rise (C) / Type of fire / Period of resistance
(minutes)
Here retaining stability and integrity means that the passage of smoke and flame is
prevented and that the load bearing components of the barrier do not reach a
temperature in excess of 400 C.
Insulation failure is also deemed to occur when the average temperature rise on the
unexposed face of a separating element exceeds 140 C or the maximum temperature
rise exceeds 180 C, whichever occurs first. These limits are to prevent combustion of
any material which may be close to the unexposed face. Their origins are unknown
and, in many cases, the limits may be excessively conservative.
3.5 Explosion hazard management
3.5.1 Common issues with fire hazard management
The major measures discussed for inherent safety and prevention of fire will apply equally to
explosions. This section will address those measures which are additionally effective for
explosion hazards, which tend to be those measures that act as detection, control and
mitigation measures.
3.5.2 Detection, control and mitigation
Aspects of inherent safety have been discussed in Section 2.7. The employment of inherently
safe features is an important part of any new design or assessment of existing installations,
however there will usually be residual hazards and some risk that needs to be managed.
Using the safety management hierarchy these residual risks should be approached firstly by
controlling the risk and then by mitigation.
Control implies the detection of the initiating events and actions initiated after the detection to
reduce the hazard or exposure to it. For the explosion hazard, systems will have a role in:
detection and initiation of control measures
avoidance of the explosion event
reduction of people on board (POB) exposure
reduction of the severity of the explosion hazard
minimization of the escalation potential
protection of the SCEs
Where choices exist, preference should be given to passive rather than active systems of
control and mitigation.
Measures that can be used to fulfil the control and mitigation roles are given in Table 3.8
below.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 121 of 493
Table 3.8 - Summary of control and mitigation options
Role Control/Mitigation measure
Detection and initiation of control
measures
Gas detection
Acoustic leak detection
Operator/Manual alarm callpoint/Phone
Emergency Shutdown (ESD)
Avoidance of the explosion event Isolation of electrical equipment
Increase ventilation start stand-by fans (in explosion
zone)
Shutdown ventilation intakes (on detection in adjacent
areas)
Reduction of POB exposure General alarm
Blast walls, TR, means of escape and evacuation
Reduction of the severity of the
explosion hazard
Initiation of area deluge upon gas detection
Increase ventilation start stand-by fans
Minimization of the escalation potential Isolation of hazardous inventories
Blowdown/depressurisation
Blast walls
Protection of SCEs Blast walls/enclosures
Resilient mountings
Inherent robustness

3.5.3 Control systems and safety critical equipment
3.5.3.1 Safety integrity levels
Instrumented control systems rely the following generic loop to effect the control mechanism;
a means of detecting an upset condition, e.g. a gas accumulation
an electronic data processing system to process outputs from the detection system
output signals to activate the controlling mechanisms.
For any control system there will be a potential for failure to operate on demand due to the
inherent unreliability of the elements involved. It is essential however that control systems
have a reliability that gives sufficient confidence that they will be effective. The level of
reliability to function on demand should be commensurate with the level of risk being averted.
This can be assured by determining the loops Safety Integrity Level and designing the
elements of the loop to meet this level of reliability [3.1, 3.2]. The procedure should be applied
to each instrumented control loop used in the management of explosion hazards.
3.5.3.2 Safety critical elements
Safety Critical Elements (SCEs) are those items or systems that prevent or reduce the impact
of major accident events. They are identified as part of the detailed design of an installation as
required by the Safety Case Regulations [3.14].
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 122 of 493
In order to demonstrate that these systems remain functional and fulfill their duties, element
specific performance standards defining how the SCEs will operate under normal and extreme
conditions. SCEs that mitigate the effects of a major accident will have to remain functional
after initiation of design accidental events, e.g. explosions. A design accidental event is one for
which SCEs on the installation should perform their function as designed. Extreme events
against which design is not reasonably practicable may result in loss of these systems.
A typical listing of SCEs would include the items given in Table 3.9:
Table 3.9 - Typical Safety Critical Elements
Ref. no. Safety Critical Element
SCE 001
Hydrocarbon Containment -Pipelines, Risers, Vent lines,
firewater pipework
SCE 002 Hydrocarbon Containment -Topsides Process Facilities
SCE 003 Hydrocarbon Containment -Wells
SCE 004 Fire & Gas Detection System
SCE 005a Riser Shutdown System
SCE 005b Topsides Shutdown System
SCE 005c Wellhead Shutdown System
SCE 006 Ignition Prevention
SCE 007 Platform Sub-Structure
SCE 008 Topsides Structure
SCE 009 Uninterrupted Power Supply
SCE 010 Emergency Lighting
SCE 011 Evacuation & Escape Systems
SCE 012 Rescue & Recovery
SCE 013 Telecommunications
SCE 014 Navigational Aids
SCE 015 Personal Protective Equipment
SCE 016 Helideck
SCE 017 Escape Routes
SCE 018 Temporary Refuge

The above SCEs should remain functional during and after a fire or explosion event, and other
items should not fail so as to create a hazard, e.g. catastrophically collapse. The performance
of each SCE is defined in element specific performance standards against which its
performance is assessed. The element specific performance standard defines the items
Functionality, Reliability or Availability, Survivability and some measure of interaction with
other safety systems.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 123 of 493
Survivability includes its endurance under explosion loads. The design of the system must
therefore match its stated survivability so that its functionality is maintained in an explosion
event. The specific explosion effects which it may need to withstand are:
overpressure;
dynamic pressure;
displacement effects;
strong vibration;
exposure to missiles.
3.5.4 Equipment specific performance standards
The term Performance Standard has become interpreted as having a very specific meaning
when related to the DCR which amends the SCR. One of the aspects of DCR is the
identification of Safety-Critical Elements and the preparation of a Written Scheme of
Verification for assurance of continued integrity. A Performance Standard can be described as
a series of statements which can be expressed in qualitative or quantitative terms the
performance required of an SCE can be compliant with DCR.
The equipment specific performance standards or low level performance standards define the
requirements in terms of functionality, availability and survivability.
The Performance Standard is a means of condensing the Design Specification and Operating
Procedures into a requirement related to a particular system in a particular mode of operation
in the face of an identified hazard. The justification for the requirement and the degree to
which it is achieved is contained within the Written Scheme of Verification or Examination.
3.5.5 Levels of criticality of equipment items
The DCR states: Any structure, plant, equipment, system (including computer software) or
component part whose failure could cause or contribute substantially to a major accident is
safety-critical, as is any which is intended to prevent or limit the effect of a major accident. So
for our purposes, the following equipment and systems at least need to be addressed when
considering the response to explosions:
Those necessary for the safe shut down of the installation.
Those necessary for personnel protection and escape.
Those necessary for fire detection, suppression and control.
Those necessary for communications.
Those necessary for hydrocarbon processing, transport and storage.
Safety-Critical Equipment may require a blast protection structure to enable satisfactory
operation within the full range of design explosion events. Protection against fire is a further
consideration, both before and after the effects of an explosion.
A practicable limiting explosion needs to be identified in the specification of these equipment
specific performance standards, such that the risks to personnel, the environment and the
commercial viability of the asset are as low as reasonably practicable (ALARP). This Ductility
Level Blast (DLB) is an achievable design event with a realistic frequency of occurrence.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 124 of 493
It will be paramount in this Guidance Document to achieve consistent terminology to identify
those events with:
The maximum credible peak overpressure, but very low frequency of occurrence;
The practicable limiting overpressure for design purposes, giving ALARP risk levels;
Overpressures giving elastic response levels in components, for early design and
robustness checks.
With systems such as gas detection, the ability to withstand a major explosion may not be
warranted, so long as the presence of the gas build up is identified. The element specific
performance standards thus need to be realistic and fit-for-purpose, taken on a element by
element basis. The performance standards need to take into account initial design and
manufacturing cost, practicability of construction, maintenance, accessibility for inspection,
reliability, robustness and redundancy.
To this end OTO 1999 046 and 1999 047 [3.15, 3.16], detailed the use of a criticality rating
system similar to the one given below:
Criticality 1 Equipment and pipes designed to withstand the same explosion severity as the
main structure.
Criticality 2 Equipment and pipes designed for a less severe but non-the-less substantial
explosion event.
Criticality 3 Equipment not designed or assessed for explosion.
The difference between Criticality 1 and 2 items would be associated with the consequence of
fire escalation and escape from the facility. It was recognised in the paper that the assessment
of Criticality 1 items would be very much constrained by project schedules and costs under
current design project philosophies. The key question though must be whether current design
practice delivers equipment and their supports which, if designed primarily for in-service
loading, provide safe and fit-for-purpose details when subjected to extreme explosion events.
Based on the limited amount of strengthening or modification to existing equipment required
for operators to delivery satisfactory Safety Cases upon their most recent submission, it must
be presumed that past designs are reasonably robust and a significant increase in design
effort would not therefore be warranted or necessary.
Criticality 1 Items whose failure would lead direct impairment of the TR or emergency
escape and rescue (EER) systems including the associated supporting
structure.
Performance Standard These items must not fail during the DLB or SLB,
ductile response of the support structure is allowed during the DLB.
Criticality 2 Items whose failure could lead to major hydrocarbon release and escalation
affecting more than one module or compartment.
Performance Standard These items must have no functional significance in an
explosion event and these items and their supports must respond elastically
under the strength level blast (SLB)
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 125 of 493
Criticality 3 Items whose failure in an explosion may result in module wide escalation, with
potential for inventories outside the module contributing to a fire due to
blowdown and or pipework damage.
Performance Standard These items have no functional significance in an
explosion event and must not become or generate projectiles.
The Strength Level Blast (SLB) and the Ductility Level Blast (DLB) are defined in the Glossary,
Annex B and Sections 8.6.3 and 8.6.4.
3.5.6 Mitigation and consequence minimization
The severity of explosion consequences may be mitigated by the introduction of:-
Lower inventory pressures
More ventilation
Judicious ignition source location
Smaller potential explosion zones
Optimised layout resulting in less congestion and less confinement
The use of blast relief panels
Robust design of SCEs and minimisation of escalation potential
Segregation of explosion release sources from congestion and major escalation targets
Early use of deluge.
3.5.6.1 Inventory pressure
Flammable cloud size is determined by the leak dimension and the pressure of the inventory.
The mass rate at which gas is released from a hole is directly proportional to pressure.
Reduced inventory pressure will reduce explosive cloud dimensions and the severity of the
explosion event.
A reduction in pressure will also result in a lower inventory mass within the system which will
give the potential for more rapid blowdown and reduced escalation consequence
3.5.6.2 Ventilation
Artificial ventilation is defined as that ventilation which is not supplied from the action of the
environmental wind alone. Artificial ventilation may be either induced or forced. Induced
ventilation means that the air is drawn into the space by fans located on the extract side of
the room, the room is then under negative pressure compared with areas around it. Forced
ventilation means that air is forced into the room by fans in the intake ducting resulting in the
ventilated space being at positive pressure relative to adjacent areas.
Assuming that some loss of inventory from a hazardous process will occur at some time,
ventilation is critical in ensuring that a significant flammable gas cloud does not form or that
the cloud is reduced in size, particularly for small leaks which are the most frequent.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 126 of 493
Rooms containing hazardous gas inventories are generally operated at negative pressure
compared with adjacent non-hazardous areas to prevent leakage of potentially explosive gas
clouds to those adjacent areas. Upon detection of flammable gas, the standby fan(s) should
be started to give maximum possible ventilation in order to aid dilution of the leak to prevent or
limit the generation of an explosive cloud.
Non-hazardous rooms adjacent or close to hazardous areas are normally operated at a
positive pressure to prevent ingress of explosive gas clouds. Upon gas detection, which would
normally occur at the fresh air intake, all fans should be stopped and the intake and discharge
isolated by (nominally) gas tight dampers.
Industry guidance [3.17] defines adequate ventilation as ventilation achieving at least 12 air
changes per hour for at least 95 % of the time, with no dead spots. The term adequate
ventilation is not meant to imply an optimum level of leak dilution; it should be regarded as
minimum target. Increased ventilation rates will ensure dilution of larger hazardous leaks and
reduce the potential for explosions to occur or reduce its severity.
In the case of natural ventilation adequate ventilation needs to be confirmed. For small
wellhead platforms and NUIs this can generally be demonstrated qualitatively since
confinement is low. For more complex installations the only way of demonstrating adequate
ventilation will be either by CFD modelling of the ventilation regime, or wind tunnel testing.
Where there is inadequate ventilation the options are to re-orientate the installation to make
more use of prevailing winds, to remove confinement, to relocate equipment to provide a freer
air flow through the module and to add some fan assistance at dead spots.
A special case which typifies the various considerations that arise in the ventilation of a
hazardous area, is that of turbine enclosure ventilation. The means of managing this risk is
detailed in the HSE guidance [3.18]. This relies on fast dilution of the leak at source to prevent
significant flammable clouds forming.
3.5.6.3 Installation orientation
If a module is open on all four sides, orientation of the installation is relatively unimportant. If,
as is often the case, one side forms a solid partition then orientation will affect the ventilation
air change rate within the module. The installation is often aligned such that the TR is directly
upwind of the process areas. This minimises potential for smoke logging or toxic gas ingress
into the TR.
Apart from smoke logging and natural ventilation, operational factors also enter into the
orientation assessment as supply vessels and helicopter approaches tend to be towards the
flow of current or wind respectively.
The preliminary QRA is likely to give an indication as to the relative risks of fire, toxic gas or
explosion. It is probable that explosion risk (including escalation from an explosion event) will
be well below that from process fires and that operational constraints of supply vessels, at
least on the larger installations, will tend to set the orientation, with natural ventilation being a
secondary consideration.
FPSOs are unique in that they orientate themselves according to the relative forces of the
current, wave and wind, called weather-vaning. Frequently the vessel will be positioned with
the wind blowing lengthways from bow to stern. This is not the preferred arrangement from an
explosion point of view as a gas cloud will extend along the deck within congested areas
rather than being blow out to the sides.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 127 of 493
With fan assisted ventilation, for instance in a closed module, it is relatively easy to show that
adequate ventilation has been provided. The provision of 12 air changes per hour as an
absolute minimum [3.17] with a qualitative demonstration that there are no dead spots by the
suitable location of supply grilles should suffice.
3.5.6.4 Ignition source location
Highest overpressures in congested modules tend to arise when the ignition point is at the
furthest point from a main vent. There is potential for ignition to occur at practically any point
within the module (e.g. from hot work activities), however removing other ignition sources
away from such extremities will, to some extent, lower the potential for high explosion
overpressures to occur.
3.5.6.5 Layout optimisation
The layout of a module should be optimised in order to;
Minimise confinement
Minimise congestion
Minimise flame front path length
Reduce potential gas cloud size
Reduce unfavourable ignition source locations
Generally, layouts that result in maximum potential for venting and minimise the potential for
turbulent flow generation, particularly in the early stages of flame travel, will reduce the final
overpressure.
3.5.6.6 Reduction in explosion zone size
For a congestion dominated explosion event the strength of explosion is dependent on the
flame path length from a main vent or from a target. For this explosion type, the largest
overpressures for a given configuration tend to arise when the ignition point is furthest from a
main vent. Keeping the dimensions of an explosion zone small will limit the potential for
overpressure generation. This also means that for a given deck area the minimum potential
overpressure occurs for a square plan area, as opposed to a long narrow plan. To achieve this
for a large complex process suggests that there will need to be a number of partitions to limit
the size of each zone. This will however tend to increase confinement and reduce the effect of
natural ventilation. A balance needs to be sought in reaching an optimum solution.
3.5.6.7 Congestion minimisation and layout
Congestion is not necessarily related to blockage ratio, more the type of blockage. The volume
blockage ratio is defined as the ratio of the volume occupied by the obstacles to the total
volume.
A large, correctly aligned, vessel may have little effect on overpressure but a number of small
bore pipes of similar volume will have a significant effect since the turbulence generated will
be greater. Since smaller items tend to give rise to the greater level of turbulence critical for
overpressure generation a suitable measure of overpressure generation potential may be the
mean diameter of equipment. This does not however take into account the amount of
equipment present. The Volume blockage ratio is a suitable measure of this. To judge the
degree of congestion in a given arrangement the volume blockage divided by mean diameter
may give a measure of congestion. These measures currently require further investigation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 128 of 493
The effect on overpressure of the above recommendations can be variable and in some cases
conflicting. It is necessary to optimise the overpressure management techniques by reference
to a calculation model to confirm the downward trend. Phenomenological models may suffice
for this purpose. The intention is to identify trends in overpressure, not absolute values, it is
not then the accuracy of the model in predicting overpressure values that is required, rather its
ability to identify trends; its speed and ease of use.
The area around vents should be kept as clear as possible. Any blockage of these will result,
not only in increase in overpressure, but also in the velocity of the gases being vented.
Installations tend to have escape routes around the periphery of modules so that minimisation
of explosion consequences at vents will have less impact on escaping personnel and prevent
damage that may affect escape routes. Additionally, pipework located near vent areas will be
subjected to drag forces proportional to the square of the exit velocity. It is therefore preferable
to locate pipework away from vent areas so that they do not block the vent path but also
because the forces exerted on them may be difficult to accommodate.
Careful layout at an early stage in a design project by orientating major vessels parallel to the
expected gas flow during an explosion and avoiding the blockage of vents can reduce the
peak overpressures by a considerable amount.
Figure 3.1 shows comparisons of good and bad layout options from the point of view of
explosion overpressure.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 129 of 493


Figure 3.1 - Relative merits of layouts
The following observations may also be noted for the mitigation of the effects of explosions.
Effective venting reduces the magnitude of the peak overpressure
When gas is allowed to expand freely the resulting overpressure is much lower than
when the gas is confined
For the same blockage ratio several small obstacles create a higher overpressure than a
smaller number of big obstacles.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 130 of 493
Blow-out panels take a finite time to move out of the way of the expanding gas and may
not prevent further overpressure increases.
Normal louvres create sufficient obstruction to cause increased overpressures.
Sharp cornered objects generate higher peak pressures than rounded obstacles.
3.5.6.8 Blast relief panels
Blast relief panels, which open quickly during an explosion in order to reduce peak
overpressures, must be carefully designed. It is unlikely that loosening of cladding panels will
have the desired effect.
A typical blast relief panel will have the following properties:
It will be light probably of aluminium construction
It will start to open at about 50 millibar or 0.05 bar differential pressure (wind
loads are usually a factor of ten lower)
It must open quickly (within about 50 milliseconds) and stay open
It must be located to open a clear vent path to prevent further flame
acceleration occurring due to venting through a congested area.
These requirements will probably result in panels of a mass per unit area of less than
0.5 kgm
-2
depending on the method of attachment.
These issues are discussed further [3.19, 3.20 and 3.21].
Panels may be retained (e.g. hinged) if there is significant risk posed by them becoming
missiles, otherwise they can be free of restraint.
3.5.6.9 Damage to safety critical elements and escalation potential
Overview
Most SCEs should be designed to operate after the explosion event (e.g. escape routes, the
TR and evacuation systems). The intention should be that these items survive an explosion
event and maintain their functionality to prevent escalation. The specific explosion effects
which an item may need to withstand are;
static overpressure
dynamic overpressure
displacement effects
strong shock (strong vibration) effects
Heat effects tend to be transitory and the thermal inertia of most items should ensure that
thermal effects of the explosion event are negligible.
Equipment on anti-vibration mounts may be displaced if the mount topples. If this is
considered possible restrained mountings should be specified or sea fixings retained during
operation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 131 of 493
The smaller safety critical elements can either have enhanced support to withstand blast wind
effects or be located near a bulkhead or structure where the wind effect will be low. This may
be appropriate for fire and gas detection devices.
Flare/vent and firewater piping can be especially susceptible to blast forces since they are
generally of low pressure design and therefore light-weight. Damage to flare/vent lines can
result in large quantities of gas entering the module, especially as the installation will probably
be being blown down at the time. This would lead to jet fires and possibly secondary
explosions. Damage to firewater lines would result in the loss of fire control measures within
the explosion zone. Means of protecting these lines will include and or all of the following:
not running these lines near vent areas where blast wind forces will be high
increasing the schedule of the lines to increase inherent robustness
increasing pipework supports
running these lines in the shelter of structural elements
Strong shock response
In an explosion event the forces acting on the structure will result in movement of decks and
members. This displacement absorbs energy plastic by deformation and if it did not occur the
structure could not survive [3.22, 3.23]. The result of this displacement is that initially;
roofs/ceilings will move upwards
decks will move downwards
walls will move outwards
Subsequent to this will be the rebound effects as the structure then oscillates. These
phenomena may occur in a wave as the overpressure moves through the module in a
congestion dominated explosion. These displacements will have significant impacts on any
items fixed to structural elements that are moving differentially to each other, for example,
pipes that run from floor to ceiling, or run from a floor mounted vessel to the ceiling. Relative
displacements can be considerable, 10s of centimetres, so that forces potentially acting upon
items spanning structural elements can be large.
As with all potential hazards the aim should be to avoid the situation occurring, that is, by
avoiding arrangements where items are attached to floor and ceiling. This may not however be
reasonably practicable. If this is so, sufficient resilience should be included in the design to
accommodate the differential movement. This may be achieved using resilient mounts or by
the building in of flexibility to the piping runs.
Good design practice however should be employed to mitigate the consequences of this
severe vibration, this involves;
the location of vibration sensitive safety critical elements distant from potential
explosion zones, especially not attaching them to common boundaries;
the use of shock or resilient mountings to absorb vibration effects;
additional restraints to items that may topple and cause damage or lose function, e.g.
cabinets, bookcases;
slack in cables where displacement of control or electrical equipment is possible.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 132 of 493
Specialist products, shock mounts, are available from companies marketing anti-vibration
equipment. Their advice should be sought before any mountings are fitted since, if the wrong
product is installed, enhancement of the vibration effect can occur. The natural frequency of
the mount must not coincide (within a factor of 2) with the natural oscillation frequency of the
loaded floor. The structural design group should be able to estimate the approximate natural
frequency of the structure at the mounting point so that the correct mount can be specified.
Missile prevention
Secondary missiles are those picked up by the blast wind produced during an explosion. The
blast winds can reach sonic speeds, therefore there is potential to move objects of a significant
size. Maximum blast wind speeds are found around the edges of the module where explosion
gases are venting. In most modules this is where escape routes are located so these are the
areas where personnel are in most danger from impact from missiles, and being knocked over.
The philosophy for minimising the potential for missile generation is to ensure general tidiness,
especially in the hydrocarbon processing areas and areas adjacent to the TR. Small items
such as fire extinguishers and items of safety equipment should be kept in cabinets firmly fixed
to the structure preferably against a partition or structural member where blast wind will have
little effect. There should be no loose items in the module, i.e. items that are not fixed to the
structure or substantial equipment items. Maintenance equipment such as scaffold poles and
tools should not be stored in process areas and should be removed when no longer required.
3.5.6.10 Deluge
The Phase 3a Advantica tests at Spadeadam [3.24] confirmed that deluge can significantly
reduce high explosion overpressures. The benefits of deluge have now been incorporated into
the major CFD and some phenomenological simulation software. Fears that the deluge would
provide an ignition source through electrostatic effects have proved unfounded [3.25] although
there is a residual doubt about the ignition potential due to charge accumulation on isolated
conductors e.g. scaffolding. The initiation of deluge and water curtains on a quiescent gas
cloud may induce turbulence in the cloud, limit ventilation and mix an inhomogeneous cloud.
These effects could give rise to higher overpressures.
The mechanism by which this mitigation occurs is by inhibition of the combustion process and
by cooling of the products of combustion as the deluge water is converted to vapour.
Deluge from standard medium velocity (MV) or high velocity (HV) nozzles has been found to
be suitable for reducing overpressure in congestion generated explosions. Congestion
generated explosions are characterised by a fast moving flame front. This acts on the droplet
to break it up and give a greater overall surface area so that it more efficiently achieves the
quenching effect on the combustion mechanism. The usual general area coverage rate of
10 l min
-1
m
-2
[3.26], even with 15 % added for hydraulic imbalance, falls outside the rate
investigated in the JIP tests [3.24]. If explosion mitigation is considered critical a deluge
flowrate of at least 13-15 l min
-1
m
-2
is recommended for general area coverage. This will have
a significant effect on lowering peak overpressures. Greater flows up to about 20 l min
-1
m
-2

will have a marginally increased benefit.
Where the overpressure is generated by confinement, for example in completely enclosed
modules, there is insufficient kinetic energy in the flame to break up the deluge droplets in
order for them to be effective. In enclosed modules deluge will be ineffective in lowering
explosion overpressures and may even result in an increase due to turbulence caused by the
water spray.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 133 of 493
It is important that the deluge is employed as area coverage rather than equipment specific
protection. Equipment specific protection only applies deluge to small discrete areas and this
is not sufficient to give any meaningful control of overpressure.
For large open deck areas, such as F(P)SOs, the process area is generally divided into fire
zones in order to limit the size of the firewater pumps. On large open decks firewalls are not
generally practicable so the deck is divided into fire zones where fire events may be expected
to be confined; these may be discrete process blocks or pre-assembled units. Firewater
pumps are sized to deluge the zone in which fire detection takes place, and immediately
adjacent zones.
Large gas clouds can, however, cover a number of such fire zones. This means that there is
insufficient water supply to cover the whole flammable cloud. For these applications and where
equipment specific deluge only is installed, water curtains may be used to arrest the flame
velocity and prevent runaway flame acceleration. A double curtain of MV nozzles supplying
water at a rate of about 15 l min
-1
m
-2
for the area covered by the curtain and spaced at 10 m
intervals should be effective in arresting runaway flame acceleration and prevent excessive
overpressures. Other devices such as fan sprays have also been tested and may give
coverage more suited for curtain use.
Deluge would then be applied to the fire zone where initial gas detection takes place with
water curtains supplied simultaneously from a separate deluge valve.
Some CFD overpressure modelling programs can accommodate the effect of water curtains
so an optimisation of frequency and coverage of curtains within the practicalities of firewater
demand can be undertaken.
A major problem in determining risk levels for an installation with explosion mitigation by
deluge is determining the level of risk reduction that can be assumed. This is due to at least
two factors;
the delay between leak initiation and deluge being applied to the module;
the reliability of the deluge system, from detector device through to deluge nozzle.
For the majority of low explosion over-pressure events there is no benefit particularly if the
coverage is incomplete
These factors can be however estimated from knowledge of the equipment and systems within
the module.
The benefits of explosion mitigation by general area may deluge may only be considered only
if a time dependent ignition probability is used and the deluge can be applied within the
reliability constraints of the system.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 134 of 493
3.5.6.11 Further explosion mitigation systems
Other mitigation systems that have been proposed include;
inert gas
barriers
soft barriers
micromist
Inert gas
Inert gas can be used to dilute the flammable mixture by flooding the volume within which the
gas has been detected, with for example CO
2
, N
2
. The explosive gas can then be taken below
its lower explosive limit. This is most appropriate for enclosed volumes where the environment
can be controlled. Care should be taken in providing such systems as they can pose a
significant asphyxiation risk to personnel and they should be discounted if the overall risk of
using them is greater than the explosion/fire risk saved. This might particularly be the case for
generally manned areas.
Inergen

(CO
2
+ N
2
+ Ar) is an alternative inerting material but it has a volume 30 times that of
Halon systems for which it is a possible replacement.
Barriers
Barriers can be used for four purposes;
1. protecting areas behind the barrier from the overpressure effects generated in the
explosion zone;
2. limiting the size of the explosion zone and thus the largest dimension over which the
flame can propagate;
3. limiting cloud spread to ignition sources;
4. limiting the number of people directly exposed.
Blast walls have long been used to protect adjacent areas from the effects of overpressure.
These walls are designed to absorb blast energy by displacement. There may be a partition
wall (e.g. B15 partition) on the non-hazardous side which will move sympathetically with the
blast wall, the air gap between the two acting as a spring. If the wall forms the boundary to a
control area housing safety critical equipment the effects of this movement needs to be taken
into account. That is, shock sensitive equipment should not be located along this wall unless it
can be demonstrated that the effects will be negligible.
By limiting the size of an explosive gas cloud the overpressure can be reduced. As long as
confinement is controlled decreasing the size of a module by inserting barriers can result in a
reduction in maximum flame path length and therefore a reduction in the overpressure
generated. It is important that these barriers maintain their integrity and do not give rise to their
own hazards by displacement and impacting on safety critical plant or by becoming missiles.
Mitigation measures aim to protect personnel or equipment from the explosion event.
Protection from the direct effects of blast can be achieved by the barrier method, that is, the
intervention of a blast wall between the explosion zone and the area to be protected.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 135 of 493
3.5.6.12 Soft barriers
Progress is being made in the manufacture of the Micro-mist device [3.27] which has been
tested as part of a recent joint industry project and consists of a cylinder of superheated water
which is released quickly as a fine mist in response to pressure, flame sensors during an
explosion. This device suppresses the explosion and has been shown to be successful in
significantly reducing overpressures. Accidental activation of these devices is not a hazard to
people.
3.6 Particular considerations for floating structures, storage
and offloading systems
3.6.1 Introduction
Floating structures for production, storage and offtake have been used safely and reliably
throughout the oil industry for many years. Early installations were primarily floating storage
and offtake vessels, FSO, but today the modern floating production, storage and offtake
vessel, FPSO, includes processing equipment and a higher level of sophistication.
Consequently, the FPSO becomes an offshore producing installation, storage facility, and
loading terminal all rolled into one unit.
The early ship-shaped vessels, developed in the 1980s, took advantage of a severe
downturn in the tanker market and were converted from relatively new tankers. More recently,
the tendency has been to use new, purpose-built, ship-shaped hulls, particularly for FPSOs
associated with long lived projects. Conversions of tankers, both old and new, continue to take
place. There are many different types of design, weather-vaning with internal or external
turrets or spread moored that maintain a fixed orientation.
The FPSO and the FSO present many of the same hazards to personnel and the environment,
although the added complexity of production facilities on the FPSO increases associated risk.
The guidance in this section relies heavily on the published guidance of UKOOA, [3.28] and
the draft guidance being prepared by OGP [3.29]. This Guidance will adopt the OGP
nomenclature and when considering an issue applicable to both types of floating installation
will use the term F(P)SO.
A number of features impact fire related hazards on floating installations; for example, the
geometry of the layout, compartmentalisation, operations, fire scenarios, response
characteristics of marine construction to fires and the vulnerability of marine systems
associated with the motion, station keeping and stability. The effects of fire on these features
are discussed further in the following sections.
3.6.2 Marine life cycle considerations
F(P)SOs usually consist of a marine structure supporting process and utilities decks of a
conventional offshore construction. These differing methods of construction are governed by
differing regulatory regimes. For the UKCS, the application of SOLAS and MODU codes
without demonstration of validation by the additional risk assessments normally required by
PFEER will be insufficient for the treatment of fire events.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 136 of 493
Some specific attributes to be considered on F(P)SOs are;
Fire-fighting in the enclosed compartments containing marine systems (e.g. engine
rooms, DP control rooms, generators); fire fighting techniques will include inerting, with
the ramifications this entails for personnel access and the requisite alarms
As the process and utilities modules are normally located above the vessels deck (and
the cargo storage), the process and utilities deck areas will be large, usually of one or two
levels. Segregation to avoid escalation of a fire can be achieved by separation of
modules occasionally further separated by fire barriers, (this may or may not help
explosion overpressures but will impair the dispersion of released hydrocarbons).
The fire risk analysis undertaken on F(P)SOs will consider the nature of the hydrocarbon
fuel source as well. Due to the nature of the storage on F(P)SOs, the fields they are
generally use for tend to be crude that can be stabilised fairly readily. F(P)SOs may be
required to hold stored product in their cargo tanks for typically 3 to 7 days dependent
upon their geographic location. The F(P)SO solution is therefore less favoured for more
volatile reservoirs.
The (potentially) long process and utilities decks and their orientation with respect to wind
conditions will be affected by the weather-vaning of the F(P)SO. The top decks should be
designed to follow a hazard gradient from the most hazardous area with respect to fires
(and explosions) to the least hazardous. This will generally be from the turret outwards.
Due to the weather-vaning effects (either due to wind or current and their effects on the
superstructure height and hull draft) the fires can escalate downwind and at the very
least, toxic products of combustion will be distributed downwind. The layout should
consider these additional hazards and the design should accommodate them to maintain
levels of safety. (Some designs have used DP to adjust the F(P)SO orientation in the
event of a release or a fire hazard although the DP then becomes a Safety Critical
Element and subject to the development of Performance Standards and integrity
assessments required in the UKCS.)
On an F(P)SO, escape routes and piping runs may be very long and tortuous and
personnel may need to pass the origin of the incident to reach the Temporary Refuge.
Consideration in the design of escape over long distances during incidents and incident
escalation should be a key issue.
Fire water mains will also be extensive and distant from the fire pumps in the process
area. Correct fire-pump sizing and firewater-main hydraulic analyses will be required to
ensure adequate pressure at deluge points, hoses and monitors.
Buoyancy, stability and station-keeping must be maintained at all times, and the systems
associated with these duties must be protected from fire hazards.
F(P)SOs also require specific consideration of major fire hazard and release scenarios unique
to their design and operation.
Oil storage tanks May present hazards in the form of either large scale storage of
stabilised crude or with empty storage tanks containing potentially explosive mixtures.
Non-process hydrocarbon inventories The F(P)SO is a power-hungry installation and
requires substantial stores of diesel to maintain station, process and utilities power
demands plus other life-support systems. The vessels are often located in difficult or
remote places and will generally be designed to be self-sufficient for extended periods
in the event that supply vessels cannot reach them.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 137 of 493
Jet fires on main deck The process decks on F(P)SOs are often lifted clear of the cargo
storage tank roof for several reasons, (see bullet points below) a 5 m gap is not
uncommon. The space provided also allows jet fires from the underside of the process to
reach other process or utility modules without any impingement to reduce the effect of the
flame. The gaps provide other risk reducing and operational benefits but steps can be
taken to reduce the likelihood of jet fires by careful layout and orientation of the higher
pressure equipment.
A gap will allow green water to flow over the main deck without placing an excessive
load on the process modules supports by creating restrictions and eddy current effects.
A gap allows a clear and uninterrupted space for long piping runs (both process piping
and storage tank vent and balancing lines)
A gap allows personnel access across the vessel, both for normal operational and
maintenance access as well as facilitating emergency response.
Swivel connections, a source of releases The turret contains a large number of swivel
joints in order to function, these are often at the highest process pressure and pass the
reservoir fluids prior to any cleaning or conditioning and are therefore subject to the
F(P)SOs most onerous process duty.
Offloading and pool fires on the sea Offloading to shuttle tankers is a regular event and
poses a significant risk both on the F(P)SO and the shuttle tanker. The risks comprise the
breakage or leakage of the transfer hoses and the potentially flammable mixing of
hydrocarbon and air in the storage holds of F(P)SO and shuttle tanker. During the
offloading operation, the shuttle tanker and F(P)SO are in relative proximity and the risks
on either vessel are compounded by increased potential for escalation to another vessel.
3.6.3 Application of fire and explosion hazard management to floating
structures
3.6.3.1 Topsides considerations
The storage and transfer of hydrocarbons on F(P)SOs present particular hazards to personnel
and the environment and some of these have been listed above. This sections describes
further measures that can be applied to the management of fire hazards in the F(P)SO
topsides.
There is a need to continuously vent hydrocarbon vapours during loading, it is important that
the venting system be designed to accommodate the maximum volume of volatile organic
compounds (VOCs) vented from storage. Allowance must be made the higher temperatures
the vents will experience when venting during maximum production rates and as well as
providing design allowances for possible process upsets. In some areas, local regulations or
guidelines limit the amount of VOCs that may be released to the atmosphere. It is always good
practice to adopt loading procedures that will minimise VOC emissions.
The atmosphere in the F(P)SO tanks is to be maintained in a non explosive condition. The
normal method is to supply low oxygen content combustion products to the tanks from boiler
uptakes or from an independent oil or dual fuel generator.
Cargo tank purging must be carried out before introducing air to the tank to ensure that the
atmosphere will at no time enter the flammability region. The guidelines given in Chapter 10.0
of ISGOTT [3.30] should be strictly adhered to during this operation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 138 of 493
F(P)SOs need special consideration due to the potential venting of hydrocarbons either near
the process plant or near the flare stack. Calculations will have to be made at the design stage
to ensure that carry over of hydrocarbons from the inert gas stack will not interfere with day to
day operations.
It is recommended that the inert gas system comply in all respects with the requirements of
SOLAS and the relevant IMO guidance notes. Prudent operators may also consider
maintaining 100 % redundancy for this critical component.
After purging, the tank must be gas freed in order to remove the residual inert gas from the
tank and replace it with a normal atmosphere containing 21 % Oxygen.
The issue of VOC return lines and their use during offloading represents a key safety issue.
The operation of VOC reclamation represents a highly hazardous situation where flammable
mixtures of hydrocarbons are returned to the F(P)SO. An added complication is that the
offloading and reclamation systems may often be combined as a dual hose system and for
F(P)SOs with stern accommodation, the offloading and reclamation point may be located close
to the accommodation and TEMPSC.
Due to the longer term storage (compared with most other offshore installations), water and
other contaminants in the crude can accelerate corrosion of the F(P)SO storage structure and
systems resulting in premature failure and, potentially, escape of hydrocarbons. Design
allowances should not be based on ideal crude conditions but should consider a realistic
appreciation of operational practices.
3.6.3.2 Vessel and marine considerations
The layout of surface and sub-sea facilities must be carefully considered early in the design to
account for the following shipping related hazards (that may give rise to loss of integrity and
fire):
Passing ships and local community activities, such as fishing;
Supply and maintenance vessels in relation to anchoring or dropped objects;
Anchor mooring patterns of drilling rigs during locating and moving;
Safe access by offtake tankers, avoiding interference with other moorings, flowlines
and risers as well as other field operations.
The field layout must also consider the need for offtake tankers to approach the F(P)SO, moor,
load their cargo, unmoor and proceed to open waters, always in safety. The parameters for
achieving this, which will include manoeuvring areas and weather limits on operations for the
tankers, may be derived by means of a risk assessment study as described in OCIMF
Offshore Loading Safety Guidelines: With special reference to harsh weather zones [3.31].
Additional reference material for Offshore Loading may be found in UKOOAs guidelines for
tandem off-loading from FPSOs/ FSUs to shuttle tankers [3.32].
Thrusters may also be useful in fire or platform abandonment scenarios where the vessel can
be rotated to clear fire or smoke from around production areas and living quarters and to
provide a lee side for survival craft launch. When designed for a safety function, it should be
noted that thrusters will be considered to be Safety Critical Elements.
Due to the vessels being in very close proximity, the risk of a fire or explosion on one vessel
affecting the other is greatest during offloading.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 139 of 493
It is important that the F(P)SO is equipped with emergency shutdown and release equipment
that will allow the vessels to part in the event of an emergency on one vessel.
3.7 Particular considerations for mobile offshore units
3.7.1 Introduction
Units that work in the North Sea will generally conform to three types of which two are more
common. Ship-shape units are not often used for drilling, as their motion characteristics are
often not suitable for drilling in harsh weather. A small number of construction and well
intervention vessels work in the calmer weather months.
Most MOUs in the North Sea are of two types, Semi-submersibles and Jack-ups. Semi-
submersibles have more in common with floating structures while jack-ups have more in
common with fixed structures. This specialist subset is termed Mobile Offshore Drilling Units,
or MODUs.
Though they are fundamentally different from each other, they do have one thing in common.
They are vessels subject to the Conventions and Codes of the International Maritime
Organisation, or IMO, and thus emanate from a long-standing marine tradition.
3.7.2 MODU classification
The UK Safety Case Regulations do not stipulate design safety cases for MODUs. However,
MODUs are subject to Classification Society rules for design, construction, and operation.
Generally, certificates are subject to renewal every five years with intermediate surveys of a
less intrusive nature ranging from every year to every two and one-half years. General areas
of interest with respect to fire hazards include such items as:
Structural fire protection layout plan for decks and bulkheads;
Fire extinguishing systems;
Recommended sequence of emergency shutdowns;
Hazardous areas.
The ABS published Classification Guidance contains a whole chapter on Fire Safety Features,
including:
Fire control plans;
Fire pumps;
Fire main;
Hydrants, hoses, and nozzles;
Fixed fire fighting systems;
Extinguishing systems (CO
2
, foam, water spray, portable extinguishers, etc.);
Fire detection/alarms;
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 140 of 493
Gas detection/alarms;
General alarm;
Area or specific alarms;
Firemans outfits;
Other PPE;
Helifuel;
Paint lockers.
Any reader will quickly note there is a distinctly marine feel to the rules. This is appropriate
as hydrocarbons are seldom present on MODUs as much of their time is spent in transit
between locations, thus the threat of types of fires that occur on ships is given attention. In the
main, Conventions and Codes of the IMO are meant to apply to vessels on international
voyages, not when the vessel is undertaking its industrial function. Though these rules are
prescriptive, the great number of ships in the worlds fleet lends of validity through experience.
Marine tradition refers to conventional ships on long distance voyages who must cope with
mishaps such as shipboard fires and explosions with faint prospects for immediate rescue.
This tradition has within it the experience of thousands of ships but scant experience of live
hydrocarbons. Perhaps it is best characterised as highly worthy knowledge in its own right but
not directly coincident with the newer oilfield traditions.
Obtaining and remaining in class is very important for a MODU. Otherwise, it would not be
able to obtain hull insurance. Minimising losses is important for underwriters so MODUs are
able to benefit from loss reduction strategies of the worlds fleet of ships, and the considerable
reservoir of experiences thus represented.
3.7.3 Conventions, codes and regulations
3.7.3.1 Introduction
MODUs are also subject to flag-state rules for operation under the conventions (roughly
equivalent to regulations) and codes (roughly equivalent to guidance) of the IMO. The flag-
states are responsible for enforcing the conventions and codes of the IMO through their
national legislation. The most significant IMO instruments are the international conventions for:
Safety of Life at Sea (SOLAS) [3.3];
Prevention of Pollution from Ships (MARPOL) [3.33];
Load Lines (LL) [3.34];
Standards of Training, Certification and Watch-keeping (STCW) [3.35];
Preventing Collisions at Sea (COLREG) [3.36];
Tonnage Measurement (Tonnage 69) [3.37].
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 141 of 493
For the purpose of this guidance, SOLAS is the most relevant and is discussed further in the
next section. The IMO MODU Code is also important, covering the construction and equipping
of Mobile Offshore Drilling Units [3.38], and discussed further in the section following SOLAS.
3.7.3.2 SOLAS
SOLAS Chapter II Construction Subdivision and stability, machinery, and electrical
installations
The parts of interest (within SOLAS) are:
Part D Electrical Installations: Precautions against shock, fire, and other hazards of
electrical origin
Part E Additional Requirements for periodically unattended machinery spaces: Fire
precautions, alarm system, safety system, and special requirements for machinery, boiler,
and electrical installations
SOLAS Chapter II Fire protection, fire detection, and fire extinction
The whole of Chapter II is relevant. Coverage includes:
fire pumps;
fire mains;
hydrants/hoses;
fixed gas fire-extinguishing systems;
fire-extinguishing arrangements for machinery spaces;
foam systems;
water systems;
arrangements for fuel/lubricating oil/other flammable oils;
ventilation;
fire control plans, etc.
In addition, details for passenger ships, cargo ships, and tankers are given and will be of
interest.
3.7.3.3 MODU code
There are two versions of the MODU Code. The 1989 Code [3.38] is meant to be applied to
units constructed after 1 May 1991. The 1979 version of the Code applies to earlier units. The
1989 Code addresses fire/explosion safety in the following chapters: -
Chapter 4 Machinery installations for all types of units
4.7 Arrangements for oil fuel, lubricating oil, and other flammable oils
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 142 of 493
Chapter 5 Electrical installations for all types of units
5.5 Precautions against shock, fire, and other hazards of electrical origin
Chapter 6 Machinery and electrical installations in hazardous areas for all types of units
6.1 to 6.7 Zoning of hazardous areas and the types of machinery in these areas
Chapter 8 Periodically unattended machinery spaces for all types of unit
8.3 Fire safety
Chapter 9 Fire safety
1 to 13 Structural fire protection, accommodation, means of escape, fire
pumps/mains/hydrants & hoses, systems in machinery spaces, portable extinguishers, fire
detection & alarms, gas detection & alarms, firemens outfits, helicopter facilities, storage of
gas cylinders, and miscellaneous items.
3.7.3.4 Overview of MODU operations on the UKCS
MODUs operating in the North Sea area are generally prepared to drill a range of wells of
different types in order to meet the needs of the client oil companies. Though there are fire
risks from flammable materials on MODUs, about half the risks with the greatest
consequences are presented by the hydrocarbon accumulation the MODU has been hired to
exploit. The Formal Risk Assessment required in a UK or North Sea Safety Case overlays all
the provisions from fire and explosion protection that Classification, the flag-State rules, and
MODU Code. However, there are two main differences.
1. The rules emanating from the IMO are prescriptive. The risk reduction model is the
marine industry acting on the experiences of the worlds shipping fleet.
2. The model of model of application is for ships on international voyages, not vessels
undertaking industrial processes.
3.7.3.5 MODUs and the UK Safety Case
Generally, oil companies hire MODUs to pursue drilling campaigns. The campaigns can be
short (one well of less than 30 days duration) or as long (3 years or longer on rare occasions).
In the UK, it will be necessary to for the MODU to have an accepted safety case before drilling
can begin. The main hazards a MODU faces are listed below:
Helicopter crash;
Fire;
Explosion;
Major mechanical failure;
Blowout;
Toxic release;
Dropped object;
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 143 of 493
Structural failure;
Mooring failure;
Ship collision;
Loss of stability;
Towing incident.
The most serious of these incidents requires a PFEER Assessment [3.39] in order to be sure
the personnel can escape to a place of safety. The hazard assessments generally undertaken
for MODUs start from the hazard list described in Table 3.10. It is worthwhile pointing out that
the MODU Owner will generally engage the crew in a compartment-by-compartment analysis
for fire and explosion risk. This utilises the greatest knowledge asset on the rig, namely the
crew, who are exposed to the risk. Following from this approach, the qualitative method is
preferred. The quantitative assessments (QRA) that take place are generally done to meet
statutory requirements for integrity of the Temporary Refuge. The QRA calculations are most
often carried out by consultants outside the MODU Owners organisation. The crew are
generally not in the habit of assimilating this level of detail of information.
Table 3.10 - Typical hazard list showing preliminary PFEER assessments
Item
no.
Type of event
Fire & explosion
consequences
Comments and description
1
Shallow gas
blowout, subsea
Yes MODU Owner depends on the client oil
company site selection and shallow gas
detection by seismic plus experience in the
area (if available)
2
Shallow gas
blowout in the
cellar deck
Yes Usually occurs when the riser is attached
(semi) or drilling out the first (structural) string
of pipe (jack-up). Same comments as shallow
gas blowout, subsea, above, apply.
3
Reservoir
blowout at drill
floor
Yes The client oil companys drilling programme is
required to analyse and predict reservoir
content (gas or oil), pressure, and
temperature, any other relevant
characteristics.
4
Toxic gas
release
No This scenario is meant to cover precautions
against the toxic effect of H
2
S on personnel.
MODU Owner depends on the clients drilling
programme.
5
Gas
release/ignition
in mud
processing
areas
Yes Caused by gas entrained in the drilling mud.
Consequences are more severe for oil-based
mud. MODU Owner works as directed by the
oil company and thus depends on oil
companys drilling programme and
consultation with his site personnel to predict
the likelihood of and to control this event.
6
Well test area
fire/explosion
Yes Occurs during flow testing of wells only.
7
Accommodation
fire
Yes Covered by class, flag-state rules, and MODU
Code
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 144 of 493
Item
no.
Type of event
Fire & explosion
consequences
Comments and description
8
Machinery
space
fire/explosion
Yes Covered by class, flag-state rules, and MODU
Code
9
Helicopter crash
into the sea
No Clients standby vessel covers this scenario
10
Helicopter crash
on the
installation
Yes MODU helideck requirements are the same as
for fixed producing installations, per ICAO
rules for design, augmented by such
instruments as CAP 437 [3.40] in the UK.
11
Collision No MODUs have provisions for survival in
damaged conditions. They rely on the client oil
company to provide information such as
proximity so shipping lanes and on the client-
contracted standby vessel to warn errant
vessels away.
12
Structural failure
due to extreme
weather
No Covered by Class, flag-state rules, and MODU
Code
13
Mooring failure No Covered by Class, flag-state rules, and MODU
Code
14
Loss of stability No Covered by Class, flag-state rules, and MODU
Code
15
Loss of control
in transit
No i.e. loss of towline
16 Man overboard No Clients standby vessel covers this scenario.

Half of the events in Table 3.10 above that cause serious concerns on a MODU involve fire
and explosion. This is a very significant proportion. Thus, the question occurs as to how the
fire and explosion expert(s) might apply themselves to reducing the risks faced by MODUs.
The information given below is meant to stimulate further consideration. Particular
circumstances and personnel roles will have large roles to play.
From the hazard events itemised above in Table 3.10, it can be seen that of 16 event
categories, 8 consider fire (and explosion) events. Event categories in item numbers 1, 2, 3, 5
and 6 are caused by well upsets and three of the remaining hazard categories consider non-
well events such as;
1. Accommodation fire
2. Machinery space fire/explosion
Which are covered by classification, flag-State and MODU Code, and:
3. Helicopter crash on the installation.
Which is common to all installations and is considered by the design guidance in CAP 437.
The inspection of helidecks is covered by BHAB inspection of the installation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 145 of 493
3.7.3.6 Pre-hire surveys
Many oil companies use 3
rd
party inspectors to perform pre-hire checks on the rigs they intend
to contract. The items listed below cover many equipment categories that the surveyors
generally cover which will have an impact on fire and explosion hazards.
Typical items for pre-hire surveys:
Well testing equipment;
Electrical safety;
Automatic fire detection system;
Fixed fire extinguishing systems (water & foam);
Breathing apparatus;
Electric safety;
Blow out prevention equipment (BOPs);
Well control equipment;
Fire control system;
CO
2
system for fire control;
Portable extinguishers and fire fighting equipment;
Gas detection system;
Safety.
3.7.3.7 Classification society surveys
Classification societies will carry out surveys of vessels to ensure that they continue to comply
with class requirements; these will be carried out against the rules issued by the class
societies referred to throughout this section. The survey reports generally stay on the unit and
at the field office.
3.7.3.8 The well programme
The well programme lays out the plan for drilling the well, including predictions for formations
to be encountered, along with the types of fluid in the formations (oil, water, or gas). Part of the
programme will deal with site assessment, covering the prospects for encountering shallow
gas. The programme should offer information regarding whether H
2
S is likely to be
encountered. The type mud system to be used will be detailed for each hole section. If well
testing is foreseen, the details of the flow rates likely to ensue will be given along with the
duration of the test and the sampling foreseen. Well testing is given separate treatment below.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 146 of 493
There is no equivalent of a design safety case for wells. However, the Safety Case
Regulations require operators to apply a process termed Well Examination. This regulation
requires that operators file their well programmes with the HSE a minimum of 21 days before
operations are due to begin. The details to be submitted are spelled out in some detail. If there
is no objection from the HSE, work can begin. However, if there are material changes in the
well programme, an independent, competent person known as a Well-Examiner, must agree
the change does not pose an increase in risk.
For the MODU Owner, the benefit of a statutory Well Examination is that the programme is
fixed in good time for the MODU operator to interpret the results and implement remedial
measures. The Well Examination process also ensures there is a process for ensuring
changes are subject to risk analysis.
The well programme covers 5 of the 8 contingencies involving fire and explosion.
3.7.3.9 The MODU safety case safety management system
3.7.3.10 Well testing
Though the Well Programme covers the objectives of well testing, it may not provide copious
detail on the well testing equipment. On many rigs, well testing equipment is not permanently
installed. It is brought to the rig when well testing is foreseen. On rigs where the installation is
permanent, maintenance of such equipment is not generally within the core skill and
experience of the drill crew.
Few drilling specialists have extensive experience testing wells. The Safety Case can only
generally cover the well testing equipment and cannot be very specific as there are many
different manufacturers, different layouts for this equipment, and different crews generally man
the well test equipment. Therefore the constructive overview of a fire and explosion specialist
should be included in these circumstances.
3.7.3.11 Recommended approach
The following is written from the perspective of an oil company contracting for the services of a
MODU. Generally, the oil company will likely have staff or have access to internal or 3
rd
party
specialists specialising in fire and explosion; MODU Owners generally do not. In this situation,
it seems natural for the oil company specialist to at least have an overview. It is probably sub-
optimal to ask the MODU Owner to do everything; on the other hand, it is probably sub-optimal
to make numerous in-depth enquiries of the MODU Owner when many aspects are covered by
Classification or Flag-State rules. A co-operative, balanced, and constructive overview into all
aspects of fire and explosion aspects is recommended.
Any enquires should respect the culture and strength of the MODU Owner. Chief amongst
these is that the MODU Owners greatest asset is the crew. Some of their number will have
participated in or have knowledge of the rigs treatment of fire and explosion. Rig crew use the
hands on approach. Thus, their expertise can best be assimilated by use of qualitative
information as this is the type of information with which they are most familiar.
The nature of shipping rules has been that they are the accumulation of experience, derived
from incidents, near-misses and other lessons learned. The information contained within
these prescriptive rules is therefore statistically valid and represents a distillation of experience
from the worlds shipping fleet.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 147 of 493
Given the diverse character of information for fire and explosion on MODUs, the list of key
application issues given in Table 3.11 below could function as a starting point for
assessments.
Table 3.11 - Key MODU application issues
Item Overview
MODU
Classification
Be aware of the Classification Society. Look up and become familiar with
their rules. The MODU Owner will have records of the ongoing surveys.
Flag-State Be aware of who the flag-State is. Look up and become familiar with their
rules. The MODU Owner will have records of the ongoing surveys.
MODU Code Be aware if the unit has a certificate and whether it is 1989 or 1979. Be
familiar with what it contains.
Safety Case Be aware of the analyses in the safety case for fire and explosion,
especially those with PFEER Assessments. They represent the risks with
the most severe consequences.
Pre-hire survey Have a look at the fire and explosion aspects of the pre-hire survey,
provided, of course, such a survey was performed.
Well Programme Have a look at the well programme from the point of view of the MODU
Owner. Judge whether you would be happy with the information in the
programme in terms of preventing fire and explosions? If not, it would be
a service to both oil company and MODU Owner to point out where better
information would be beneficial.
SMS Audits The MODU Owners own audits can provide information on the standard
of maintenance. It would be a good thing to be aware of the audit
findings. Further delving could be undertaken if an overview gave cause
for concern.
Verification of
Safety-critical
Elements
The same comments apply here as above for SMS audits.
Well testing Probably the area where the fire and explosion expert might make best
input. Well testing can be infrequent and thus less familiar. An overview
of the equipment, procedures, and risk analyses may well prove
beneficial in terms of risk reduction.
3.8 Particular considerations for existing installations
3.8.1 General
In the UK sector of the North Sea, it is a requirement (SCR) [3.14] that significant changes in
an installation or its operation will require the Safety Case to be resubmitted which should
address a review of hazards including a re-assessment including those due to explosion
hazards. Even if an installation has not been modified or its use has not been changed a re-
assessment may be required to take account of advances in methodology. Existing mobile
installations entering UK waters will also require assessment.
The assessment of existing structures differs from the assessment of a structure during design
in three important respects.
1. There is relatively little scope for the reduction of the frequency of a release and
scope for mitigation of the severity of an explosion may be limited.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 148 of 493
2. Intervention may give rise to an additional hazard which must be assessed.
3. Information may be available relating to expected explosion loads, structural
and equipment response from the detailed design stage of the design and
construction project.
Information should be available from the Safety Case, the original CAD and structural
computer models of the facility. The Individual Risk (IR) per annum TRIF and PLL will have
been used in the demonstration of ALARP in the existing Safety Case for the installation.
Use may be made of experience gained from the operation of the un-modified installation and
from similar installations. The computer data files and design reports should be checked to
confirm that they are a faithful representation of the present state of the facility.
Should modifications be necessary to improve the safety performance of the facility, then the
work to be undertaken should not in itself pose such hazards and risk to personnel that this
compromises the gains to be achieved by such modifications. All modification work should be
accompanied by hazard identification, assessment and other controls as determined by the
Safety Management system as well as method statements for their implementation.
All temporary structures and equipment utilised during the modification work should be
removed as soon as the work is complete.
The HSE reference [3.41] clauses 51 and 52, states It should be borne in mind that reducing
the risks from an existing plant ALARP may still result in a level of residual risk which is higher
than that which would be achieved by reducing risks to ALARP in a similar, new plant. Factors
which could lead to this difference include the practicality of retrofitting a measure on an
existing plant, the extra cost of retrofitting measures compared to designing them on the new
plant, the risks involved in installation of the retrofitted measure (which must be weighed
against the benefits it provides after installation) and the projected lifetime of the existing plant.
All this may mean, for example, that it is not reasonably practicable to apply retrospectively to
existing plant, what may be demanded by reducing risks (to) ALARP for a new plant (and what
may have become good practice for every new plant).
The overall individual risk and the TR impairment frequency (TRIF) from all hazards must still
be less than 10
-3
per year. If risks are in this intolerable region then risk reduction measures
must be implemented, irrespective of cost.
3.8.1.1 Explosion hazard review
Review of explosion risk for existing installations, poses a number of difficulties. These
problems generally relate to the difficulty in retrofitting structure and equipment in modules that
are operational and congested, with the usual constraints in working in a cramped offshore
environment. There may also be a problem accessing design data which should include
modifications that have taken place since the facility was installed. The implementation of
effective change procedures is essential in these circumstances.
Before investigating the ability of the systems on the installation to withstand the blast effects,
the facility should be reviewed with regard to the level of inherent safety that exists and what
additional control mechanisms there may be for overpressure reduction. The existing wells
may be operating at a lower reservoir pressure than originally designed for, however
subsequent tie-ins may have offset this possible benefit.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 149 of 493
For an existing installation there may be potential for:
increased venting
additional and/or improved gas detection (acoustic gas detection)
introduction of flame detection
lowering the level at which gas detection initiates executive actions
voting for executive action on a single detector
initiation of deluge on gas detection
the removal of redundant equipment
the relocation of equipment blocking vent paths
vibration reduction
enhanced robustness of small bore connections
utilisation of past operational experience
improved inspection/maintenance regimes
Some of these actions may not necessarily result in a reduction of calculated Individual Risk or
loss of life (as shown in the QRA) but this should not be a reason for failing to undertake
modifications if actual reduction in explosion risk can be foreseen.
Ideally, there should be no disproportionate contribution from any one hazard to the risk
associated with the installation. For example fire and explosion hazards should contribute to
the total risk at levels comparable with those for a similar installation. This is referred to as the
balanced risk contribution principle.
The general philosophy should be to bring all SCEs up to a similar level of integrity for all
accidental events. These systems include but may not be limited to:
the TR;
escape routes to the TR;
evacuation systems;
systems that could threaten the integrity of the above systems, e.g. ESDVs isolating
off-site inventories.
In effect the list may include all the identified safety critical elements but, with respect to the
ability to muster, assess and evacuate, some Safety Critical Elements may be in Criticality
Levels 1, 2 or 3 as described in Section 3.5.5.
3.8.1.2 Use of previous analyses
A review will need to be undertaken of the ability of safety critical systems to withstand
overpressure/drag effects. Whilst increased knowledge of the explosion phenomenon has
resulted in a general increase in the overpressure loadings that are calculated for a given
configuration, it is frequently the case that the integrity of systems is greater than originally
assumed. The experience of the JIP full scale tests [3.42, 3.43 and 3.24] tended to confirm this
in that damage incurred was significantly less than might have been expected for the high
overpressures experienced.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 150 of 493
Where it is clear from preliminary inspection that it will be impracticable to meet maximum
overpressures that may arise, there would seem to be little to be gained in determining to the
last degree of accuracy what the actual overpressure characteristics will be. Simpler
phenomenological models or comparison with similar installations would be adequate for the
purposes of quantifying the residual risk.
(Note: the requirements of the SCR [3.14] imply that some form of overpressure calculation
will be necessary in order to quantify the risks involved in mustering within the TR. The need to
determine potential for TR damage would then seem to be necessary).
The aim should be to bring the design up to the same level of integrity for all major SCEs with
the presumption that more effort should be made where the level of risk from explosions is
high. Existing installations will have QRA data from which explosion risk can be determined.
Where this is high for explosion events the premise should be that greater cost is justified in
providing mitigation and protection than where the risk posed is relatively low.
A means of determining the cut off point for additional mitigation would be to determine the
costs involved with design enhancement to achieve integrity for successively increased
overpressure values. Where a significant cliff edge occurs this may indicate that design
beyond the base of the cliff edge is not reasonably practicable and that design to this level is
ALARP.
The accepted level above which the overall risk is considered intolerable relates to an
individual risk of greater than 10
-3
per year or a TR impairment probability of greater than 10
-3

per year. The overall individual risk from all hazards must be less than this value. If risks are in
the intolerable region then risk reduction measures must be implemented, irrespective of cost.
Hence the risk from other hazards may indirectly affect the acceptability of risk from explosions
and these may need to be considered in setting the target risk levels for the explosion hazard.
Where the original design took account of explosion overpressure, but latest knowledge
indicates that this needs to be reviewed, then recalculation and re-assessment will be
appropriate. The calculation of overpressure should however be reasonably straightforward if
the original CAD model is available and has been updated to include changes made since the
design stage.
3.8.2 Early operating phase
Vigilance is required in the early stages of field life for deviations from the original process,
structural, mechanical or instrument design intent. Such changes need review for any
implications for fire hazard creation or management. Such a review needs to be scheduled
and chaired by the project safety engineer and attended by a mixture of design and operations
personnel. It should take place after a year or two of operation. Since key project design
personnel are likely to have moved to another project by that stage, an alternative would be for
operations to log all variations to original design, operating or maintenance assumptions/intent
for formal follow-up by the installation safety engineer in order that the implications for fire
hazard management can be explored and corrective action taken if found necessary.
Nowadays, plant modifications are closely scrutinised by a range of discipline engineers and
onshore support staff for any detrimental effect on safety. Accumulated minor operating and
maintenance changes (known as creeping change) however can go unremarked, unless
vigilance is maintained.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 151 of 493
Examples of the types of change that would not be obvious without a specific attempt to
capture them are:
Environmental data (sea level or weather pattern changes);
Instrumentation problems e.g., leading to changed operator response to alarms;
New fire research findings;
Change in production composition or phases, leading to changed fire scenarios or
release frequencies.
3.8.3 Midlife operating phase
Some typical considerations for fire hazard management of existing installations at the mid-life
stage are:
Creeping change in original design assumptions examples are development of sand,
vibration or corrosion problems, increasing the likelihood of releases in certain areas;
changes in process conditions resulting in change to fire consequence modelling
assumptions;
Fire-related protective equipment proves unsatisfactory in operation detection
devices give frequent alarms or are found to be failed at every inspection. Alarms that
are too frequent are eventually ignored;
PFP left off vessels or other equipment for longer and longer periods to allow access
for NDT/inspection;
Areas of the platform always keyed out of the automatic fire and gas system;
Very slow process changes which come to be regarded as normal by operations
personnel (e.g. more frequent alarms, very low or high operating temperatures etc.).
If minor deviations go unnoticed, over time it becomes custom and practice to operate outside
the original design scope, and/or without all protective measures functioning. Problems then
become apparent only during an emergency situation.
Many of these minor changes would be identified by the independent competent person during
the course of his examinations of safety critical equipment and systems, but some changes
can still be missed.
Most oil companies include operations personnel in their project teams. Often the intended
OIMs plus key offshore supervisors are part of the project team specifically to become fully
conversant with and supply operations input to the design process. Over a period of 10 years
or so however, personnel change and key information, whether held personally, in hard-copy
or in electronic format is likely to be lost if no active steps are taken to refresh the corporate
memory at regular intervals. In addition, over a prolonged period new research improves the
understanding of the fire and explosion threats and the ability of the protective measures to
counter the threat effectively. The implications of this updated knowledge must be taken into
account and where necessary procedures updated including those related to emergency
response.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 152 of 493
It is thus recommended that a formal review (taking into account new research knowledge) or
audit of the fire hazard management arrangements and records be carried out every 3 to 5
years.
3.8.4 Late operating phases
As platforms age the safety systems tend to require more repair and maintenance in order to
keep them in full working condition. The late operating phase is also a time when the platform
production tail off and there is a big drive to reduce OPEX costs. Fortunately, as platform age
and production rates drop, process pressures also drop, water cut increases and fire risks tend
to reduce.
It is possible on some installations, where parts of the process have been simplified or
decommissioned or where drilling activity is finished, to review a platforms fire hazard
management arrangements and remove fire protection equipment that is, by then, surplus to
requirement. This can reduce the maintenance burden. Any such modifications have to be
formally justified and recorded through the Operators Plant Modification Request procedures,
and documented in the Safety Case and associated PFEER/DCR documentation.
Typical Problems for the Late Operating Phase are:
Degradation of Passive Fire Protection;
Corrosion of firewater systems and leaks in air-trigger systems;
Wear and tear on firewater pumps and deluge valve sets;
Obsolescence of parts for Fire and Gas detection/protection systems;
Increased leak likelihood due to sand erosion, corrosion (especially under lagging) and
fatigue;
Tightened commercial constraints and reductions in manning.
Despite the associated cost of maintenance and inspection, the performance standards laid
down for of all the safety critical systems, subsystems and individual items must either:
Continue to be met as per the original design; or
Revised (with appropriate justification) to reflect the changing fire risk. The associated
written schemes would be updated to reflect the changed performance standard in
discussion with the appropriate Independent Competent Person(s).
3.8.5 Aging installations and life extension
3.8.5.1 Overview
Many installations in the North Sea have reached the end of their originally specified life but
their continued operation is still worthwhile. Other installations have been modified to act as
production hubs, taking product from other subsea wells or tie-ins and processing it, often with
new or partially modified topsides plant, for export to pipeline or tanker.
Asset life extension raises several issues in relation to fire hazard management, these are
discussed in the following sections.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 153 of 493
3.8.5.2 Design issues
New process plant needs to be provided with adequate fire and gas detection systems. The
existing systems may be adequate to cover the new equipment or may need extending, but
the same considerations as for a new design will still apply. The existing system may be
virtually obsolete and not feasible to extend so replacement of the whole system may be
required.
The effect of the new plant on the ESD and blowdown systems must be evaluated in the light
of the additional fire scenarios. It should not be assumed that tie-in to the existing platform
blowdown system will be adequate, even though original demands on the system may have
reduced. If the installation is old, the original blowdown system may have been under-
designed by comparison with existing best practice especially where severe fire scenarios are
involved.
All new fire scenarios must be reviewed for effect on existing deluge systems. A fire in the new
plant may set off several other systems, especially on an open installation. The project may
have to supply new fire pumps to cover the new plant as the existing pumps are unlikely to
have spare capacity. The condition of existing pumps for extended future service must be
assured.
More use of passive protection may be possible, but providing facilities/access for integrity
assurance for aging piping/structure/equipment must be considered.
Existing deluge systems are often difficult to extend. The mechanical condition of the system
needs to be assured for extended service. There may now be a new fire scenario with
implications for important parts of the structure (e.g. the TR or TEMPSC areas or their
supports) which are currently unprotected. (See Sections 3.2.8.9 and 10.3.2.2 for further
discussions on the limits to PFP application, including some issues affecting retrofitting PFP to
structures in situ). All escalation potential should be considered and the decisions relating to
selection of protection recorded.
New fire scenarios must be evaluated for impact on evacuation, escape and rescue.
New support structure provided for the new plant may be vulnerable to fire impingement from
existing fire scenarios, and may require protection.
3.8.5.3 Emergency response issues:
As platforms age, emergency equipment and facilities degrade. Although some items can be
easily replaced once they fall below an acceptable standard, other items such as sea ladders,
spider deck walkways, gratings on rarely-used escape routes to sea can fall into disrepair and
are expensive to replace. Routes to sea are important in severe fire scenarios and must be
kept up to standard as long as the fire hazard remains. Where new business is introduced
over an old installation, new escape routes, as well as refurbishment of existing routes (where
the original fire hazard still exists) may be needed.
3.8.5.4 General considerations
Fire hazards would be identified in the HAZID at FEED stage of the process modification
design, and subsequently assessed as for any new design project.
The impact of the new facilities on the existing fire and gas detection and protection systems
needs to be documented and recommendations tracked to implementation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 154 of 493
Incorporation of new safety critical items into existing Safety Case, SCE and PS related
documentation is a legal requirement.
3.8.6 Particular considerations for accommodation and other areas for
personnel
3.8.6.1 General
Much fire measurement data, definitions and internationally accepted standard tests have
been developed from building fires and the damage caused. Many of these have been
adapted for use on the appropriate sections of petrochemical plants and their shortcomings in
wider applications should be understood. The following sections deal with some standard
aspects of conventional onshore fires but practitioners should refer to standards produced for
onshore and civil use for these non-hydrocarbon areas.
Accommodation and other areas of the installation such as control rooms, some workshops
(i.e. those without specific storage requirements for hazardous materials), leisure areas and
galleys are all based on normal architectural practices. The internal materials are the same as
onshore facilities and the design practices tend also to be the same with minor variation. The
key difference with these areas is how they relate to process and other operating areas and
extreme care should be taken to make sure that even the most apparently benign systems do
not interface with a hydrocarbon system in an unforeseen manner.
Key aspects where interfaces can occur are listed below and these should be assessed when
considering the process fire hazards:
HVAC;
Drainage;
Storage areas/enclosures;
Access (both for personnel using the facilities and working there and goods coming
into or out of the area).
3.8.6.2 Compartment fires - general
In a compartment or building fire, the source of ignition will normally be at a discrete location
and the initial fire growth will be slow. The temperature in compartment will increase and a hot
layer of gas will build up below the ceiling. A point is reached when re-radiation from this gas
layer causes the unburnt furniture etc to ignite. Within a short space of time the entire contents
of the compartment will be burning in a process called flashover.
The severity and duration of a building fire depend on the amount of fuel and the ventilation
conditions. Fires may be fuel controlled or ventilation controlled, generally, ventilation
controlled fires are more severe.
The main difference between a building fire and a pool or jet fire is the nature of the fuel.
Although buildings contain hydrocarbons in the form of plastics they also generally contain a
large amount of cellulosic material in the form of paper, and wooden furniture. It is common,
although not strictly correct, to refer to building fires as cellulosic.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 155 of 493
When assessing elements of construction for buildings the standard fire resistance test fire is
normally used. For some fire engineered designs a natural fire is modelled. The simplest
natural fire model is the parametric fire although there are many, more complex, computer
models for building fires
3.8.6.3 Compartment fires parametric
A parametric fire [3.44] is an idealised form of a natural fire in a building compartment. They
provide a simple means to take into account the most important physical phenomena which
may influence the development of a fire. They take into account the fire load, the ventilation
conditions and the thermal properties of the compartment linings. The natural fire is assumed
to have a slow build-up with a pre-flashover period of ignition and smouldering, following
flashover, the heat build-up is rapid and proceeds for some period dependent on the available
fuel. There is then a post-flashover period where cooling takes place. The standard fire curve
starts from an equivalent point at flashover and begins the heating phase directly. For the
standard fire the heating rate continues (albeit at a slower rate) and does not reach a
cooling period.
The modelling of the temperature curve of the parametric fire also follows a similar logic of
heating starting directly from a notional equivalent of the flashover point, i.e. without any
preceding phase. The heating rate is then faster than for the standard fire but reaches a point
where cooling commences. The cooling rate assumed for parametric fires is linear compared
to the accelerating cooling of the natural fire.
The parametric fire was developed to model mainly cellulosic building fires. It gives reasonable
correlations against tests for modern office fires. It may often be more severe than the
Standard cellulosic fire.
3.8.6.4 ISO, cellulosic (standard fire)
Building regulations throughout the world almost invariably require elements of construction to
have fire resistance based on the standard fire [3.45]. This is an idealised fire defined by a
time-temperature relationship and is the basis for fire resistance tests.
3.8.6.5 Temperatures
The Standard cellulosic fire has, when compared with most other design fires, a low initial
rate of temperature increase. However, the temperature rises logarithmically with no limit. It
reaches 945 C in 60 minutes and 1153 C in 240 minutes. The temperature reached depends
on the conditions in the compartment and in a typical office fire, the combustion products
temperature will reach about 1300 C. The fire temperature will normally peak at about 45 to
60 minutes and decline steadily afterwards. Compartment temperatures will reduce to 200 C
after 120 minutes.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 156 of 493
4 Interactions between fire and explosion hazard
management
4.1 General
The methods and systems for the management of explosion and fire hazards will have a
degree of commonality. Some of these will be complementary, whereas others will serve a
single function only. In addition, conflicts may exist between the successful management of
explosion hazards and the successful management of fire hazards; thus, a holistic approach
must be taken in the management of both types of hazard.
Hazard management will always be a series of compromises between economics,
engineering, operability and risk reduction considerations.
Successful hazard management involves identifying the best compromise between all these
considerations, in compliance with any statutory obligations placed on the operator of the
installation.
4.2 Fire and explosion prevention methods
4.2.1 General
It has to be accepted that the complete prevention of fires and explosions can never be
attained. However, procedures and systems should be provided to reduce the frequency of
such events to as low as reasonably practicable. Such procedures and systems are detailed
below.
4.2.2 Minimisation of leakage frequency
The loss of containment of a flammable material is a necessary precursor to the occurrence of
an explosion or fire. This can be avoided, so far as is reasonably practicable by:
Fitness for purpose of all flammable material containing equipment and associated
pipework.
The maintenance of the design fitness for purpose throughout the life of the installation.
This requires that an adequate inspection and maintenance regime is in place
throughout the life of the installation. In addition, care must be taken to ensure that the
original design intent is not debased by subsequent modification or lost via poor record
keeping or industry take-overs and/or mergers.
Wherever possible, the number of potential leakage sources should be minimised.
Typical of these would be instrument tappings and pipework flange connections.
However, care must be taken in applying this philosophy as this may lead to an
increased need for hot work if modifications, replacement or repair of equipment are
required.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 157 of 493
4.2.3 Minimisation of ignition probability
Given that the leakage of flammable materials cannot be totally prevented throughout the life
of the installation, then a fire or explosion will only occur if the leak is ignited. Recently
published guidance [4.1] provides more information on ignition probability and the appropriate
modelling of these data, however, in generic terms, the probability of ignition may be
minimised by:
Adequate control of hot work on live installations by the use of air-purged habitats.
Alternatively, only carry out hot work during an installation shutdown. (Noting that hot
work should be avoided wherever possible, some installations have a no hot work
policy and insist on bolting (or other methods) and carry out hot work only during a
shutdown.)
The correct hazardous area zoning for electrical equipment and the correct selection
and maintenance of such equipment.
The early detection of any leakage together with the necessary control actions to
isolate all non-essential items of equipment which could potentially be sources of
ignition.
It should be noted that ignition probability per se, does not represent a true measure of risk.
What are most significant are the time-delay between a leak occurring and the ignition of the
leak, and also the time delay (if any) between the detection of the leak and the ignition of the
leak. These are a function of the rate of ignition rather than of the ignition probability. The
minimisation of ignition probability illustrates one of the many compromises that have to be
arrived at in the management of explosion and fire hazards, whilst accepting that ignition
probability must be minimised, in doing so it must also be recognised that the potential for a
long-delayed ignition increases. Under these conditions a severe explosion event may result.
4.3 Fire and explosion detection and control methods
4.3.1 General
The positive pressure phase of an explosion is in the order of a few hundred milliseconds.
Thus, the effects of an explosion are realised immediately. Conversely, the time for the effects
of a fire to be realised, even upon personnel, is of at least an order greater than that for
explosions. Thus the early detection of a leak is of greater significance for explosion hazards
than for fire hazards.
It follows that leak-detection and associated alarms, are the only means of providing adequate
warning to personnel. Fire-detection is of no value in this context. However, fire-detection is
still of importance when fire hazards are considered.
It may be that very rapid response fire-detection systems, such as those that utilise flame-
detection, could detect an explosion before they are damaged by the explosion blast or drag
effects. In addition, rapid response fire detection may also be of benefit with respect to the
initiation of explosion mitigation systems (such as deluge on gas detection). As stated above,
this would be of no significance when explosion hazards are considered. However, it may be
important for the management of fire-hazards to detect any fire that may follow an explosion.
This may provide an argument for the use of rapid-response fire-detection systems, where the
frequency of occurrence of explosions is deemed to be significant. It may also provide an
argument under the same circumstances for the automatic actuation of any active fire control
and mitigation systems upon the detection of a leak.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 158 of 493
4.3.1.1 Automatic release detection systems and alarms
Two generic types of release detectors are available:
Type 1) The detection of an accumulation of flammable gas from the release, or
Type 2) The direct detection of a release based on its acoustic signature.
Type 1) detectors may be point detectors e.g. pellistors, or beam detectors. In each case,
there is a requirement to assess the minimum flammable cloud size that should be detected.
There is little guidance available to assist in this. One approach may be to consider both the
thermal effects and the blast effects on a flammable cloud. The thermal effects may be
assessed by treating the combustion of the flammable cloud as a fireball. The minimum cloud
size, intended to be detected, may then be based on an acceptable probability of persons in
the area surviving these thermal and blast effects. A range of figures for the probability of
survival of detection systems following an initial blast load would be between 0.5 and 0.9. The
lower end of the range has been used often in QRAs submitted to the Health & Safety
Executive but a survival probability of 0.9 if other protective steps have been considered.
Type 2) detectors appear to have an advantage over type 1) detectors in as much as they
detect a leak directly. However, it is important that the sensitivity of such detectors is
adequate; the advantage of leak detection is its sensitivity; there are definite benefits to detect
leaks at as low rates as possible, this can be used to alert the operator even if a shut-down is
not initiated at this stage of the incident. In addition, there is no clear evidence as to whether or
not such acoustic detector will operate adequately when two-phase leaks occur. Thus it is
suggested that the ideal leak detection system should employ both types of detectors. The
detection of a leak should be annunciated on an installation-wide basis. All installation
personnel, including visitors, should have received clear instruction as to the correct action to
be taken on the receipt of such an alarm.
The minimum cloud size to be detected should also consider the potential escalation. This
assessment should be conservative due to the diversity of potential escalation paths and the
analysts inability to assess them all.
4.3.1.2 Automatic fire-detection systems and alarms
Only leak detection can provide adequate warning to personnel of a potential explosion
hazard. Fire detection is of very limited value in the event of an explosion already having
occurred.
Several fire detection device-types are commonly available, they include:
UV and IR flame-detectors
Rate of temperature rise detectors
Smoke detectors
CCTV with or without embedded flame imaging software
The flame-detectors will have the most rapid response of the above if they are in the vicinity of
the fire. However, very early smoke detector (VESDA) systems can respond rapidly based on
an arrangement where the detection system samples smoke at very low concentrations, this
has often been used in sensitive enclosed areas, computer systems have a long history of
being protected by VESDA systems.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 159 of 493
It is advisable that total reliance is not placed on flame-detectors alone. Conditions arise where
fires are obscured by smoke and indeed, smoke generation is the major hazard to personnel.
IR detectors may also be obscured by water, for example, triggering deluge on gas detection
may impair subsequent fire detection, or the IR detectors may fail to register fire escalation to
adjoining process systems.
The fire-detection system should include a mix of each type of detectors and be appropriate to
the mix of release/fire/explosion hazards considered in the escalation path.
The comments concerning alarms made for leak detection are equally pertinent for fire
detection.
4.3.1.3 Reducing the available inventory of fuel
This is of equal importance to the management for both fire and explosion hazards. Obviously,
where explosion hazards are concerned, any beneficial effects will arise if the fuel inventory is
partially or completely depleted before an ignition takes place. This contrasts with the situation
where fire hazards are concerned, where the beneficial effects will continue to operate after an
ignition takes place. However, these beneficial effects on the fire-hazard will only ensue if the
automatic isolation and blow-down and flare systems are not damaged by any prior explosion,
to such an extent as to prevent their correct operation. Isolation and blow-down valves should,
wherever possible, fail to a safe condition; generally, this means that isolation valves fail
closed and blowdown valves fail open although there can be extenuating circumstances for
this rule.
Especially for large high pressure valves, the actuators can be significantly large pieces of
equipment, and their destruction in an accident can compromise the fail safe mode; such
valve actuators should be protected against blast and drag-effect damage as much as
reasonably practicable, but it must be accepted that there will be practical limitations on the
extent to which this can be achieved.
This emphasises the importance of early detection of leaks and the automatic initiation of the
ESD and blow-down systems upon the detection of a leak.
Whereas, ESD and blow-down systems do provide benefit in the management of fire and
explosion hazards, it is important to realise that these systems alone cannot be relied upon to
prevent subsequent failures of equipment or structural elements due to the effects of a fire.
Blow-down systems are almost universally designed to API RP520 [4.2]. This requires that the
internal pressure be reduced by 50 % or to 100 psig (22 barg); whichever is the lower; within
fifteen minutes. However, even if this is achieved, a significant fire could still be ongoing which
could cause failures, especially in congested areas.
4.3.2 Significance of area ventilation
4.3.2.1 On explosions
The equilibrium size of a flammable cloud, produced by the accumulation of flammable gas
from a leak will be inter-alia, a function of the area-ventilation rate. The severity of an
explosion following the ignition of such a flammable cloud, will be, inter-alia, a function of the
mass of flammable gas in the cloud. Thus it follows that an increased rate of area ventilation
will have a beneficial effect upon the explosion hazard. The possible disbenefit of this is that it
could make early detection of a leak more difficult to achieve. Nevertheless, in most cases the
balance of risk will come down in favour of maximising the rate of area ventilation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 160 of 493
4.3.2.2 On fires
The influence of area ventilation rate on fires is less apparent than its influence on explosions.
The reported research [4.3] indicates that the suppression of pool fires by water/foam deluge
systems is aided by increased wind-speed i.e. an increased ventilation rate. However, the
possible distortion of the water spray pattern by the wind could mitigate this.
Where mechanically ventilated, enclosed areas are concerned; the internal wind-speeds are
unlikely to be sufficient to distort water-spray patterns. Note that for enclosed areas, the rate of
mechanical ventilation will usually be of the order of 12 air changes per hour. Research [4.4]
has indicated that for naturally ventilated areas ventilation rates in the order of a few hundred
air changes per hour are achievable.
It is possible to shut down ventilation systems to provide ventilation control of a fire, but it
should be noted that in order to prevent smoke and combustion products migrating along
ducts if the HVAC is not shutdown and isolated, (which could lead to fire or fire effects
spreading to other areas) that common practice is to shut down and isolate HVAC systems in
all but the most critical areas (such Temporary Refuges) on confirmed detection of fire.
4.3.2.3 Maximisation of ventilation rates
For existing installations, there are constraints to the options for increasing the existing
ventilation rates. For mechanically ventilated areas, major refits are required for fans and
ducting sizes, for naturally ventilated areas, the ventilation rate may be increased by the
removal of any louvered wind walls.
For new builds the influence of the rate of ventilation on both fire and explosion hazards
should be addressed in the design. For naturally ventilated areas a conflict may arise between
protecting the temporary refuge against smoke ingress and the maximisation of area
ventilation. It is conventional wisdom that wherever possible, the temporary refuge should be
up-wind of the prevailing wind direction. There will normally be bulkheads between the
temporary refuge and drilling and process areas. This means that the open sides of these
areas will be at a right angle to the prevailing wind direction limiting natural ventilation.
4.3.2.4 Other factors influencing ventilation rate
Equipment layout
The equipment layout within an area will have an influence on the area ventilation rate. The
most efficient layout to maximise the ventilation rate will be the same as that to minimise the
explosion hazard. Layout guidance can be found in Section 3.2.6.4 of this guidance.
For existing installations, it must be accepted that little can be done to change the existing
layout of equipment. For new builds cognisance should be taken of the recommendations
given in the FLACS explosion handbook.
Influence of release rate
The release rate of gas can itself have a significant influence on the rate of natural ventilation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 161 of 493
Published research [4.3] provides some, albeit limited, data on this effect. Analysis of these
data indicates that:
If the leak is counter-flowing to the ventilation flow direction, the ventilation rate will be
reduced.
If the leak is co-flowing with the ventilation flow direction, the ventilation rate will be
increased.
If the leak is crosswind to the ventilation flow direction, the ventilation rate is effectively
unchanged.
The following correlations are suggested as representing a conservative estimate of these
effects.
For leak direction counter to ventilation flow direction;
( )
= 1 22.4 V V x ......................................................................Equation 4-1
Where,
V is the reduced ventilation rate (m
3
s
-1
)
V' is the original ventilation rate (m
3
s
-1
)
x is the gas release rate (m
3
s
-1
)
For leak direction co-flowing with the ventilation flow direction;
( )
= + 1 12.45 V V x .................................................................... Equation 4-2
Where,
V is the increased ventilation rate (m
3
s
-1
)
V' is the original ventilation rate (m
3
s
-1
)
x is the gas release rate (m
3
s
-1
)
Influence of water deluge
Research [4.3] has indicated that the presence of water deluge reduces the ventilation rate in
naturally ventilated areas. The data on this are very limited and applies only to deluge rates in
the order of 24 l min
-1
m
-2
.
It is suggested that a conservative estimate of this effect would be to reduce the area
ventilation rate by 30 % when the area deluge system is operating.
4.4 Fire and explosion mitigation methods
4.4.1 Active fire-fighting systems
The first and most obvious, consideration of the interaction with the explosion events is
whether or not the fixed fire-fighting systems would still be functional after an explosion. Water
deluge systems should be provided with as much protection against the explosion effects as is
practicable. For existing installations, it must be accepted that little can be done in this regard.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 162 of 493
For new builds, this may be achieved by the judicious location of water deluge pipe-work.
However, because of its very nature, such a system will be distributed throughout the whole of
the area; it is likely that only a limited degree of protection could be provided.
It is now well established that in well-vented areas, the presence of an area water deluge can
reduce the severity of explosions. This would appear to be an argument for the initiation of
water deluge, before the ignition of a flammable atmosphere takes place. The could have the
benefits of reducing the explosion severity to an extent that the water deluge system in
operation to control or mitigate the effects of any subsequent fire, and also prevent damage to
automatic isolation and blow-down systems. Reported research on the effects of water sprays
[4.5] has provided correlations to estimate the reduction in explosion severity by area deluge.
The correlations also demonstrate the variation in explosion severity with the gas
concentration in the flammable atmosphere. The correlations are:
In the absence of water-spray,
( ) ( )
( ) ( )

=
2 2
2 1
17.693 1.0563 1.0563
2 1
E E
E E
P P e ......................................... Equation 4-3
In the presence of water-spray,
( ) ( )
( ) ( )

=
2 2
2 1
18.215 1.007 1.007
2 1
E E
E E
P P e ............................................ Equation 4-4
where
P
E1
is the overpressure at equivalence ratio E1
P
E2
is the overpressure at equivalence ratio E2
=
1
1
S
C
E
C

=
2
2
S
C
E
C

and
C
1
is gas concentration 1
C
2
is gas concentration 2
C
S
is the gas stoichiometric concentration
It is not possible to provide a generic correlation for the absolute reduction in explosion
severity, as the domains in which the explosion takes place will vary from one another.
However, it can be stated that the ratio of the unmitigated explosion severity to the mitigated
explosion severity increases as the unmitigated explosion severity increases. Thus area
deluge mitigation of explosions is most effective where very severe explosions can occur. This
means that such a system will be most effective in large, congested well-vented areas.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 163 of 493
The mitigation of explosions by area water deluge will only occur when the explosion is
accompanied by significant flame acceleration. In practice, this means large, well-vented
domains. Where this does not occur, such as in enclosed domains area water deluge will not
provide any benefit, and in some cases, could increase the explosion severity.
As has been stated above, the presence of water-deluge will result in the reduction of the
natural ventilation rate. This will have the effect of increasing the equilibrium, size of the
flammable cloud and also increasing the time required to disperse this flammable cloud. In
ageing platforms, there has been a concern that the presence of water-deluge may increase
the probability of ignition due to water ingress into electrical equipment.
Thus, in any particular situation, the decision as to whether or not the activation of an area
water-deluge is appropriate can only be informed by an assessment of all the above factors.
Water-deluge systems, with or without foam, can be effective in suppressing and extinguishing
pool fires. The following correlations for the time to extinguish pool fires have been developed
from a research programme of fire trials [4.6]. These trials used diesel as the fuel but the
correlations would give a reasonable approximation for the time to extinguish stabilised crude
oil fires.
= +
50
29
494 376 T Y
Y
............................................................. Equation 4-5
= +
E
80
859 448 T Y
Y
............................................................... Equation 4-6
where
T
50
is the time to reduce the fire size by 50 % (s)
T
E
is the time to extinguish the fire(s)
= Y C U
and
C is the water spray area cover rate (l min
-1
m
-2
)
U is the internal wind speed (m s
-1
)
These correlations are specific to water sprays with droplets having Sauter mean diameters of
400 to 500 microns. The research report [4.3] indicates that the water droplet diameter can
have a significant effect upon the time to extinguish a pool fire. In summary, large droplets are
more effective than small droplets, inasmuch as they are less easily displaced by ventilation
crosswinds and can penetrate the fire plume more effectively.
The addition of a foaming agent to the water spray system can reduce significantly the time
extinguish a pool fire compared to those predicted from Equation 4-5 and Equation 4-6.
One additional factor in foam compound selection is the viscosity of the finished foam. For two
dimensional pool fires a low viscosity of the finished foam is appropriate. However, for three-
dimensional running fires, such as may be encountered on a helideck, a high viscosity (or
sticky) finished foam is appropriate.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 164 of 493
Where water miscible fuels may be encountered, then alcohol resistant foam is necessary.
In locations where the ambient temperature can be below 0 C for a significant time the foam
compound should be freeze-protected.
A number of characteristics affect the effectiveness of water spray systems (designed for
example to NFPA15 [4.6]) against either pool or jet fires. The effects of water systems with
respect to different fire types are discussed in more detail in various sub-sections in
Section 5.2.
However, area water deluge can provide significant protection against incident thermal
radiation from both jet and pool fires.
The research report [4.3] suggested the following correlation for the reduction in incident
thermal radiation.
( ) = 100 tanh 1.55 R x ................................................................ Equation 4-7
where
R is the percentage reduction in incident thermal radiation
= x f L
and
f is the water volume fraction in the atmosphere
L is the distance through the water spray or curtain (m)
This indicates that the presence of area deluge could provide significant protection for
personnel escaping from the location of a fire. The same applies to the use of water curtains if
these are of adequate thickness.
Area deluge systems or water curtains cannot be relied upon to protect personnel from the
thermal effects of an explosion. These thermal effects are of too short a duration to prevent
any serious risk of failure of equipment or structural elements. Such risks would be associated
with the blast and drag effects of an explosion. Obviously, water spray systems can provide no
protection against such effects. Dual agent (foam and dry powder) can be effective in the
suppression and extinguishment of pool fires. Their effectiveness is probably limited to
enclosed areas due to the problem of delivering the dry powder to the base of the fire in open,
well-ventilated areas; where effective, dual agents can reduce the fire duration to less than
that where water deluge and foam are used.
Any area deluge or local cooling system should be fully operational as soon as possible after
the receipt of an initiating signal. The recommendation for the maximum value of this time
delay, given in NFPA, should be adhered to. This is because waterspray heads constructed of
brass or gunmetal will, when exposed to flame impingement, suffer major damage if water flow
has not been established. This level of damage is likely to occur within 60 seconds and
seriously degrade the effectiveness of the waterspray system. This could be avoided by the
use of waterspray heads constructed of a high melting point material, such as super-duplex
stainless steel. However this option would be accompanied by a severe cost penalty.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 165 of 493
Consideration should be made as to whether the fire hazard may extend beyond the notional
fire area, thus mitigation measures should be able to protect from fire effects from outside (via
an adjacent module for example). The application of water systems should then be appropriate
to the fire hazard identified and also to the type of protection required, e.g. does the outside
area include key escape routes form the primary affected area to the Temporary Refuge.
Where high voltage electrical equipment, or equipment susceptible to damage by exposure to
water are present then conventional water deluge or foam systems will not be appropriate fire
fighting systems. Historically, such equipment has been protected against fire by the
installation of Halon flooding systems. Since the adoption of Montreal protocol, this option is
no longer available. A number of drop-in Halon replacement systems have come on to the
market but these have not yet seen prolonged general service and thus limited data are
available on their effectiveness in real fire situations.
Water mist systems appear to be very effective against electrical fires in enclosed areas.
However, there is no general agreement as to whether or not unacceptable levels of damage
to such equipment would ensue. At the time of writing this Guidance, more evidence is
required to validate this objection to the use of water mist systems.
4.4.2 Fire-proofing systems
Two types of fireproofing materials are in general use on offshore installations. These are:
1. Inert materials;
2. Intumescent materials.
The inert materials provide excellent protection against fire exposure and a resistant to the
erosive effects of jet flame impact. They do suffer from the disadvantage of increased load on
the structure. It is for this reason that the intumescent materials are generally preferred. The
intumescent materials can also provide excellent fire protection. However, there is a concern
that the erosive effect of jet flame impact could dislodge the char formed and thus reduce the
effectiveness of the fireproofing. Where these materials are to be used, the material
manufacturer should provide jet fire test data to demonstrate that this is not a problem.
The design standard performance specifications for fireproofing materials are generally based
on diffusion flame engulfment rather than jet flame impact. Thus the need for the test data
referred to above is reinforced.
In this context it is of course necessary to know whether diffusion flames or jet flames will be
encountered. The research report [4.7] does provide some evidence on the likely rainout of
liquid from an ignited two-phase release. If the rainout is significant then a pool fire will result.
If not, then a spray fire (equivalent to a jet fire) will result. It is suggested that for ignited two-
phase releases;
If the GOR is low, then at drive pressures above 10 bar absolute a spray fire will result.
If the GOR is high, than at drive pressures above 5 bar absolute a spray fire will result.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 166 of 493
The effectiveness of both types of fireproofing materials can degrade over time. This can be
due to mechanical damage of the coating, especially the sealing topcoat. This in turn can lead
to water ingress and deterioration of the fireproofing material, together with possible
unrevealed corrosion of the substrate. This can be avoided by regular inspection of the
fireproofing coatings and repair as necessary. Ideally, the fire-proof coating of any item should
be capable of withstanding an explosion blast loading, up to the failure loading of the
equipment item or structural element concerned, without suffering any significant degradation
of the fire-proof rating. This would retain the protection provided by the fire-proofing against
any fire subsequent to the explosion. The design of fire-proofing systems is universally carried
out on the basis of the fire loading only.
4.4.3 The temporary refuge
Ideally, the temporary refuge should provide for the protection of personnel against the effects
of both fires and explosions. Whilst it is feasible that the temporary refuge could provide such
protection against the thermal and smoke effects of fires and against the thermal effects of
explosions, there will be a practical limitation on the protection that can be provided against
the blast effects of explosions. Thus the objective should be to reduce the explosion blast
effects on the temporary refuge to as low as reasonably practicable. This is probably best
achieved by maximising the separation distance between the temporary refuge the likely
locations of explosions as much as it is reasonably practicable to do.
4.5 Combined fire and explosion analysis
4.5.1 Introduction
In practice it is not realistic to consider fires and explosions in isolation; it is not only impossible
to fully isolate the two phenomena, but to do so risks missing potential high-risk events. This
applies particularly where a fire analysis ignores potential damage caused by a preceding
explosion or where an explosion occurs during a fire.
The nature of the interaction between explosion and fire will depend upon whether an
explosion precedes a fire (the usual base case) or whether it occurs during a fire. The effects
of interaction are discussed in the following sections.
For the purposes of this section, explosion shall be assumed to include the effects of
projectiles.
4.5.2 Fire response of explosion damaged structures
4.5.2.1 General
There are four categories of explosion damage to structures, three of which may affect
subsequent fire endurance.
1. A structure, which has responded to explosion while remaining in the elastic deflection
range everywhere and without connection failures. A Category 1 structure can be
considered to have been unaffected by explosion when considering its response to fire.
This is the case for structures subject to explosion within the SLB range.
2. A structure, which has responded to an explosion with plastic deformation but without
connection failures. A Category 2 structure will be unaffected in its response to fire
except in respect of:
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 167 of 493
o Possible damage to PFP (e.g. due to substrate strains), but noting that there
are extremely limited data available on PFP damage following an explosion;
o Loss of straightness of members subject to buckling loads;
o Deformation of supported equipment and pipes;
o Loss of pipe/equipment support.
3. A structure that has responded to explosion loading with or without connection failures
(local or global). Category 3 structures will be weakened and behave differently in fire
scenarios, compared to undamaged structures, with much reduced fire endurance.
4. A structure, severely damaged by explosion with loss of entire segments of the
structure.
Categories 2, 3 and 4 damage relate to structures designed to resist explosion in DLB range.
4.5.2.2 Analytical treatment of explosion damaged structure
For Category 1 damage in an explosion (SLB) it is assumed that there is no weakening of
structure with respect to fire endurance hence fire and explosion can be considered
independently by different techniques, if required.
In practice it is very difficult to perform fire response analysis of explosion-damaged structure,
where the explosion damage may have reduced the reserve structural capacity for dead loads.
The two practical difficulties are:
1. Calculating the reserve structural capacity for distorted and/or weakened structures;
2. Covering a suitable range of explosion damage scenarios.
It is therefore recommended to design the main parts of the structure to survive design events
with Category 1 (e.g. 10
4
years return period) or modest Category 2 damage. In practice this
will involve optimising the overall layout of the topsides facilities to minimise explosion
pressures.
For damage corresponding to Categories 2, 3 or 4, it would be necessary to apply a structure
model that has been fully modified to take account of the explosion damage that has occurred
prior to fire.
This is a particularly advanced type of analysis but could be practical where the non-linear
software can determine both fire and explosion response. It is probably necessary to account
both for geometry changes and the straining that has occurred in strained members and this
will affect the material model for those members. For this reason it may not be suitable to use
different software for the fire and explosion response and merely use the output geometry from
the non-linear explosion software as input to the fire-response software.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 168 of 493
4.5.3 Explosion response of structures at elevated temperatures
4.5.3.1 General
As temperature increases, the yield stress and Youngs modulus of metals decrease. This can
result in comparatively small temperature rises resulting in a considerable increase in
explosion related deflection. This applies particularly where a component is designed to resist
explosion through plastic deformation. Explosions during fire can sometimes result from
equipment or vessel BLEVEs due to heating in fire or a delayed effect of explosions in one
area on an adjacent area, already in flames. This is part of a complex domino situation where
a first area is in flames and the explosion in that first area has caused leaks in a second
(adjacent) area, and it takes some time before the leaks in the second area ignite and cause
the second explosion, causing explosion overpressures in the first area.
Unless, analyses of escalation identify clear limits to potential damage, it is recommended that
the fire hazard strategy assumes a burn down philosophy and that the fire risk analysis
should confirm that the TR is not destroyed with an unacceptable frequency, in which case, a
different solution will be required (e.g. a revised layout or separate accommodation jacket).
Other damage can occur due to projectiles caused by vessel BLEVEs and to a lesser extent
from pipe failures. Another source of damage may be equipment and structure falling from
areas above that has become weakened by fires. The higher the module stack, the more
damage a dropped could cause. Where appropriate, this aspect needs to be linked to
dropped-object hazard evaluation. On F(P)SOs and converted jack-up type substructures the
damage consequence due to impact with the deck might be large and the protection
requirements difficult to meet without heavy protection such as thick steel plates or Bi-steel.
4.5.3.2 Analytical treatment of fire-damaged structure
Rigorous numerical analysis for explosion effects on fire-damaged structure is currently not
practical in most cases, though the advanced non-linear techniques briefly alluded to in
Section 4.5.2.2 might be applicable here.
Coping with the explosion after fire scenarios is principally achieved with a suitable barrier
philosophy and distancing (sensitive equipment and structure from hazard). For vessel
BLEVEs distancing will not usually be sufficient due to long projectile trajectories. Barriers,
(which may be walls or other equipment installed between the location of the BLEVE and
vulnerable targets) can reduce projectile trajectories and will be required if projectiles form a
significant component of the continuing escalation hazards.
From the practical standpoint, where an explosion during a fire is a significant risk, the
temperature of structural steelwork may need to be kept significantly lower than for fire-only
loaded steelwork. This is to improve resistance to resist the secondary explosions. This can be
accommodated by more extensive application of PFP and this factor should be borne in mind
when contemplating reducing the extent of PFP coverage to meet only specific fire scenarios.
An additional consideration is that where there is a significant risk of an explosion during a fire
it is necessary to ensure adequate strength and bonding or fixing of passive fire protection
materials at high temperatures.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 169 of 493
4.6 Safety conflicts
4.6.1 General
The application of safety measures always requires a balance regardless of whether the
hazards are fire or explosion related. The over-riding principle concerns the risk assessment of
the identified hazards and whether the protective steps for one hazard will exacerbate the
likelihood or consequences of another. This conflict is particularly meaningful when dealing
fire and explosion hazards as they are the result of only slightly diverging escalation paths. All
protective measures should be considered in the context of the hazards identified for the
specific installation as is reiterated elsewhere in this guidance; the hazard identification
exercise for the installation should be rigorous and comprehensive.
This section will discuss specifically the potential conflicts arising from the use of the protective
measures considered for fire hazard management. The detail of each measure discussed can
be found elsewhere in this guidance.
The conflicts will be reviewed in the context of their role in the protective hierarchy and the
issues in conflict will be described.
4.6.2 Conflicts arising from inherent safety measures
The major inherent safety steps are to reduce or eliminate inventories.
Reduction or elimination of inventory is desirable for all hydrocarbon related hazards and
presents no obvious conflicts with other hazard categories.
In general, the reduction or elimination of ignition sources is again desirable for all
hydrocarbon related hazards although care should be taken that dispersion of gas or vapour to
a non-hazardous area where ignition sources have been allowed is considered in the HAZID
and that suitable other steps have been taken.
4.6.3 Conflicts arising from preventative safety measures
Additional safety measures that might be considered here are open module areas to disperse
any hydrocarbon release (in gaseous or vapour form) or providing comprehensive hazardous
drainage systems to remove liquid spills as quickly and safely as practicable. These steps
would then prevent the concentration of flammable fluids reaching or exceeding the Lower
Flammable Limit (LFL).
The reduction or elimination of ignition sources will (theoretically) prevent ignition of any
release prior to dispersion or dilution having occurred.
A conflict arises with the open module concept. The normal practice for fire protection
engineers is to consider the firewater demand of the largest area plus adjacent areas to which
the fire may spread. It can be seen that the larger area (the practical result of opening
modules) increases the firewater demand and may make the demand impractical for normal
firewater pump sizing. The open area also decreases the likelihood that the fire will ever be
ventilation controlled, thus requiring the designer to consider other steps. This open module
measure does however improve the situation for explosions.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 170 of 493
Concerning designing drainage systems to remove liquid hydrocarbon spills, these pose no
obvious safety conflicts with other hazard categories but may create an undesirable
environmental event. Although regulators often acknowledge environmental impacts in
extreme events, the design and operational constraints of this safety measure should be
considered further and the consequences of both events understood.
4.6.4 Conflicts arising from detection safety measures
Detection measures tend to be relatively passive and provide a step towards a more precise
hazard management system (focussed control, mitigation or response). There are no obvious
conflicts identified here, merely that the detection devices/systems should certainly be directed
towards specific hazard categories and if possible, specific hazards. The detection devices
should be defined by their Performance Standards to achieve a certain degree of detection in
the context of particular hazards and also with other protective measures having been
activated, for example, flame detection effectiveness after firewater systems (deluge or mist)
have been activated.
Therefore, for detection, the issue is more of omission (of particular applications) rather than
conflict and can be clarified by clear application to the defined hazards.
4.6.5 Conflicts arising from control safety measures
Safety measures that might be considered to control the event would comprise isolation valves
and blowdown systems to control the inventory available to feed the fire. Dependent upon the
way that the incident was defined, a further control system would be the firewater system,
either acting to control escalation or acting as a mitigation measure. The firewater systems will
be discussed under conflicts arising from mitigation measures.
Concerning isolation valves and blowdown systems, these will limit the released inventory for
any release event and present no conflict in the execution of that function. However, to
function well in the event of an incident, these measures may require additional ESD valves
and blowdown lines.
The designers should be aware of one area of conflict in that the actuators of large valves are
themselves quite large and that they and/or blowdown piping will constitute significant
obstructions to explosion generated flame-fronts and thus increase overpressure loads which
may in turn require blast protection as both ESD valves and blowdown lines are safety critical.
The design process moves into a vicious circle whereby the safety items can increase the
severity of the event they are controlling. These issues are not insuperable and like many
safety issues are dealt with by adopting good layout principles.
4.6.6 Conflicts arising from mitigation safety measures
The are 3 main mitigation measures for fire hazards;
1. Physical containment; to stop the fire either escalating to adjoining sensitive areas (where
personnel may be), or reaching new inventories or to otherwise limit the fire by ventilation
control.
2. Extinguishing systems; to extinguish the fire directly or to cool surrounding piping,
equipment and structures to retain strength and stop escalation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 171 of 493
3. Designing for retention of structural integrity; to provide fire resistance (via intrinsic
structural strength or passive fire proofing) in order to maintain structural integrity to
support process systems (and avoid escalation) and to support areas of greater safety for
personnel (TR and muster areas) and to support evacuation systems (TEMPSC launch
stations, helidecks).
With respect to the mitigation measures identified under item 1, these measures provide the
greatest conflicts with other hazard categories. Physical containment of areas, whilst
delineating fire areas, providing greater effectiveness for the applied fire water systems and a
degree of ventilation control (in circumstances where the area/module is well sealed) have
adverse effects on other hazards. Gas or vapour releases are also contained, they are not
dispersed beyond the area/module and the opportunity for dilution to below the Lower
Flammable Limit does not exist. Also, there remains the possibility that delayed ignition
initiates an explosion rather than a fire in which case the resultant explosion overpressure will
more than likely be higher than in an open module (though this may not always be the case
and a considered analysis should be undertaken). The avoidance of gas/vapour clouds in the
flammable or explosive region should always be the first priority.
Concerning mitigation measures identified under item 2, there is a range of demands for the
extinguishing systems dependent upon which fire type they are designed for. In addition, there
are different nozzle types and spray behaviour required for explosion suppression. The
mixture of nozzle types and their location should be considered carefully when designing the
firewater system. Dependent upon the hazards identified for an area, a decision can be taken
on the basis of the risk (considering both likelihood and consequence) of the reasonably
foreseeable events. The risk ranking of the types of events will provide an indication as to the
types and locations of firewater nozzles to be used.
There is also the effect of timing; deluge used for explosion suppression is required to be
activated early, i.e. in advance of any ignition and this has led to the practice of some
operators of initiating deluge on gas detection.
The critical consideration for the structural and safety demands required by mitigating
measures under item 3 is to maintain structural integrity. There are no obvious conflicts arising
from measures meeting these demands, the increased strength and/or added passive fire
proofing do not impact other hazard management measures. However, the addition of passive
fire proofing does increase the likelihood of accelerated corrosion due to trapped moisture
which may arise from leaking insulation or from temperature cycling generating condensation.
4.6.7 Conflicts arising from emergency response safety measures
The safety measures considered here will form escape and evacuation equipment, both
personal and for teams and will also comprise portable and hand-held fire-fighting equipment.
These are all measures required to assist personnel and there are no obvious conflicts where
their provision impairs the hazard management efforts for other hazard categories. At worst,
they may be ineffective, as indeed they will be for some fire scenarios.
4.7 Fire and explosion walls
There are two main types of fire and explosion resistant walls, proprietary corrugated walls (in
carbon or stainless steel) and bulkhead walls.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 172 of 493
Corrugated walls are the most popular, mostly because they are lighter, less expensive and
can be manufactured complete, off-site and installed after grit-blasting and painting of topsides
structure and installation of main equipment. They fit more easily into the construction
programme. PFP is generally tested using flat surfaces; the effects of a jet fire on a corrugated
wall either in terms of heat load or surface PFP are less well understood.
Another issue for manned areas can be toxicity of smoke from intumescent PFP. This type of
PFP is rarely used on corrugated walls but is common on bulkhead structures.
Corrugated walls are designed not to participate in the loads bearing capacities of the
structures they are integrated into and only have to have residual strength in fire to support
their own weight.
Bulkhead walls on the other hand do participate in the dead load carrying capacity of the
structures into which they are constructed and therefore require to be insulated to prevent
strength loss in fire. Most fire / blast walls do not otherwise require to be insulated, and
insulation of them is only normally required where they are used as boundaries to enclosed
occupied rooms.
Resistance to penetration by projectiles will be affected by temperature rise and this will
depend upon whether PFP is used or not. It also depends on whether or not the insulation is
on the fire attack side or the cold side of the wall.
In some cases relatively thin coatings of PFP have been applied to (carbon steel) corrugated
walls and this has the advantage of ensuring limited temperature rise during the important
early blow-down phase of platform equipment when BLEVE and projectile risk is highest (a
compromise solution).
Stainless steel corrugated walls have more residual strength at elevated temperatures and are
therefore more resistant to projectiles. On the other hand they tend to be thinner than
equivalent carbon steel walls and this diminishes the strength advantage in regard to projectile
penetration, but they are very ductile.
Support interface design is important as this must allow for thermal expansion of the wall in fire
and out-of-plane bending, due to preceding explosion or differential temperature through the
depth of the wall or both. The out of plane deflection due to fire is lower with corrugated walls
because the geometry of the wall profile ensures that the inner flange and outer flange are
heated equally, whereas large differential temperatures occur in bulkhead walls and stressed
skin construction (with the plate on the fire side) because the cold side flange of the stiffeners
is not heated directly: the temperature gradient is greatest with uninsulated walls.
Provided the supports are configured to deform without strength-loss, the residual strength of
the wall will not be affected by the distortion but care needs to be taken with the PFP in these
areas, particularly where such PFP is within the coat-back distance for the structure that
supports the wall. If in doubt, shaped stainless steel flashings can be used in such locations
with fibrous insulation behind.
4.8 Decks
Decks normally comprise a series of girders and a stiffened deck plate. Usually the PFP will be
applied to limit the temperature rise of main girders and those secondary beams that support
the higher categories of Safety Critical Equipment. Coat-back requirements are often relaxed
to 50 mm or so hence the overall percentage of cover to deck steel work will be relatively
small.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 173 of 493
It is not normal to coat the top surface of decks, in pool fires decks would not be expected to
be significantly heated if the fire is from above but this may not be the case with jet fire. The
top flanges of girders can be weakened in such circumstances, particularly as the insulation to
the girder below the deck plate will inhibit heat loss and allow higher top flange temperatures
to occur.
As a general rule it is preferable to specify the secondary deck beams and plating to have a
higher strength than the primary structure so that its loss in explosion and / or fire does not
lead to the primary structures being dragged down or losing their secondary stabilising support
members, for example for lateral torsion buckling. The welding of secondary steel and girder
connections needs particular attention and it is recommended to make welded connections
capable of transmitting the forces imposed during gross deformation of the secondary
members they connect without fracture (as in earthquake-resistant design).
Potential deficiencies in fire resistance of decks which support SCEs or which act as fire-
boundaries can sometimes be overcome by the addition of deck to deck hangers. Where the
critical fire is below the deck these hangers would not be weakened as they would be located
in a different fire area. This is a solution that can be applied for retrofit situations.
It should be understood that there may be a problem of running pool fires on decks due to
distortion of plates arising from the fire. All analyses are based on a circular or bunded fire and
do not take into account potential running. At the time of writing, it is understood that HSE are
planning a test programme to investigate this effect.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 174 of 493
5 Derivation of fire loadings and heat transfer
5.1 Introduction
In the following sections generic fire types are identified for the types of fire that might occur on
or near an offshore installation. The fire types are considered further in terms of their
characteristic flame and how their behaviour might be affected by confinement and/or deluge.
The parameters used to define the fire and the hazards presented by the fire in terms of
thermal and smoke loading are defined.
Based on large scale experimental work (including unpublished studies by Advantica to which
access has been granted for this guidance) and on the predictions of validated models
developed and used by Shell and Advantica, typical fire loading data are summarised for the
fire types. Typical values can be used to assess the hazard to personnel and the likely effect
on fire impacted obstacles using a simple calculation method.
Also considered are the effects of deluge on fire behaviour, the potential heat loads from fires
and the effect on the temperature rise of an engulfed object, plus the manner in which PFP
may limit the rate of temperature rise of an engulfed object and how blow-down may reduce
the heat load and hence the likelihood of failure. Using these typical fire loadings and
calculations of heat transfer to objects, the steps to prepare an initial scoping or indicative
QRA of the fire hazards are also outlined.
5.2 Fire characteristics and combustion effects
5.2.1 General
In Section 3.2.4, potential fires on offshore installations were categorised into six fire types. In
this section, each of these fire types is described in detail in terms of the likely nature of the
flame and the thermal loading it may present to the surroundings. Where appropriate, the
effect of active water deluge on the fire is discussed as is the effect of confinement.
5.2.2 Gas jet fire
5.2.2.1 Nature of the gas jet fire
An ignited pressurised release of a gaseous material (most typically natural gas) will give rise
to a jet fire. A jet fire is a turbulent diffusion flame produced by the combustion of a continuous
release of fuel. Except in the case of extreme confinement which might give rise to
extinguishment, the combustion rate will be directly related to the mass release rate of the fuel.
In the offshore context, the high pressures mean that the flow of an accidental release into the
atmosphere will be choked having a velocity on release equal to the local speed of sound in
the fluid. Following an expansion region downstream of the exit the flame itself commences in
a region of sub-sonic velocities as a blue relatively non-luminous flame. Further air
entrainment and expansion of the jet then occurs producing the main body of the jet fire as
turbulent and yellow. In the absence of impact onto an object, these fires are characteristically
long and thin and highly directional. The high velocities within the released gas mean that they
are relatively unaffected by the prevailing wind conditions except towards the tail of the fire.
The fire size is predominantly related to the mass release rate which in turn is related to the
size of the leak (hole diameter) and the pressure (which may vary with time as a result of
blowdown).
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 175 of 493
In the case of high pressure releases of natural gas, the mixing and combustion is relatively
efficient resulting in little soot (carbon) formation except for extremely large release rates.
Hence little or no smoke is produced by natural gas jet fires (typically <0.01 g m
-3
), and the
fires tend to be less luminous than jet fires involving higher hydrocarbons. CO concentrations
in the region of 5 to 7 % v/v have been measured within a jet fire itself but this is expected to
drop to less than 0.1 % v/v by the end of the flame.
A factor which is often overlooked is the noise produced by sonic gaseous releases. This is
usually high pitched and so loud that it may prevent effective radio communication between
personnel. As a result emergency actions could be hampered.
A further point to note is that some combinations of leak size and pressure will not give rise to
an inherently stable flame. For hole sizes under 30 mm diameter, there is a lower bound
pressure which high pressure releases must exceed to produce stable flames. Simplistically,
this extends approximately linearly from 2 barg at 30 mm diameter to about 75 barg at 8 mm
diameter. In practice this means that most small leaks (see Section 5.4.1) will be inherently
unstable and will not support a flame without some form of flame stabilisation, such as the
presence of another fire in the vicinity to provide a permanent pilot or stabilisation as a result
of impact onto an object such as pipework, vessels or the surrounding structure. This implies
that unstable flames may self-extinguish revert to leaks thus contributing to potentially
explosive environments. This aspect of flame behaviour should be considered in determining
major hazard scenarios and their escalation paths, however, in the highly congested
environment offshore, impact within a short distance is very likely, and small leaks will most
likely stabilise on the nearest point of impact.
Apart from providing flame stabilisation, impact onto an obstacle may also significantly modify
the shape of a jet fire. Objects which are smaller than the flame half-width at the point of
impact are unlikely to modify the shape or length of the flame significantly. However, impact
onto a large vessel may significantly shorten the jet fire, and impact onto a wall or roof could
transform the jet into a radial wall jet where the location and direction of the fire is determined
by the surface onto which it impacts.
As noted above, the combustion process within a natural gas jet fire is relatively efficient and
produces little soot (carbon). Consequently these flames are not as luminous as higher
hydrocarbon flames. Radiation emissions from natural gas flames arise mostly from water
vapour and carbon dioxide, except for very large releases where soot production starts to
enhance the process. The long thin shape may also result in a flame path which is not optically
thick. The net result is that the radiative heat transfer to the surroundings is lower than for
higher hydrocarbon flames and this is reflected in the fraction of heat radiated, F, for such fires
(see Section 5.3.1, Fire loading to the surroundings). Similarly, the radiative heat transfer to
objects engulfed by the flame is generally lower than for higher hydrocarbon flames, but the
high velocities within gas jet fires can result in high convective heat transfer to objects. Clearly
the total heat flux which is imparted to an engulfed object will vary over the surface of the
object. In addition, the relative proportions of convective and radiative heat flux will vary over
the surface, with the highest convective component likely to be experienced close to the point
of impact of a flame where the highest velocities occur, whereas the highest radiative heat
load will be experienced where the more radiative part of the flame (usually nearer the end of
the flame) is viewed by the object. As the more radiative part of the flame is closer to the tail,
this can result in the highest overall heat fluxes being experienced on the rear surface of an
engulfed object which may seem counter-intuitive. Neglecting such spatial variations, broadly
speaking, for a given location of an object within a flame (as a proportion of flame length), the
convective component is more or less constant with increasing size of release, whereas the
radiative component increases with release rate as the flame becomes optically thick and
more smoky. Hence the relative proportion of convective to radiative flux varies with fire size
(see Section 5.4.2).
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 176 of 493
5.2.2.2 Effect of deluge on gas jet fires
The activation of general area deluge can adversely affect the stability of high pressure gas jet
fires, particularly if the fire is not impacting onto an obstacle. However, in most practical cases,
this undesirable effect is very unlikely to occur due to impact onto obstacles providing
adequate flame stabilisation. Indeed, deluge has little effect on the size, shape and thermal
characteristics of a high pressure gas jet fire. Therefore, the heat loading to engulfed obstacles
is not diminished. The same is true for dedicated vessel deluge systems; the water being
unable to form a film over the vessel in the presence of the high velocity jet, and so dry
patches form where the temperature rise is undiminished by the action of deluge.
There is some evidence that the deluge increases combustion efficiency resulting in lower CO
and increased CO
2
levels within the flame.
The major benefit of area deluge with jet fires arises from the suppression of incident thermal
radiation to the surroundings, which protect adjacent plant and in particular, aid escape by
personnel. For a medium velocity type (e.g. MV57) nozzle operating at 12 l min
-1
m
-2
, incident
radiation levels can be reduced by about 20 % for a single row of nozzles, 30-40 % for 2 rows
and 40-60 % for more than 2 rows (general area deluge). Increased deluge rates can further
reduce incident radiation levels: 60-70 % at 18 l min
-1
m
-2
; 80-90 % at 24 l min
-1
m
-2
for general
area deluge. Nozzles producing smaller droplet sizes can have an enhanced mitigation effect,
but there is an increased risk that the droplets will be blown away by the wind.
5.2.2.3 Effect of confinement on gas jet fires
The behaviour of a jet fire within a confined or partially confined area will depend upon the
degree of confinement and the direction of the jet relative to the ventilation opening. If
ventilation is plentiful or the jet is directed through a vent then there may be little difference in
jet fire characteristics compared to an unconfined fire. However, if the release rate of gas is
large relative to the size of the confinement or the ventilation openings are small then the fire
may not be able to entrain enough air for complete combustion inside the compartment. This is
likely to result in increased levels of incomplete combustion products such as CO, increased
levels of smoke (soot) and increased flame temperatures, particularly in regions close to the
ceiling of a compartment where hot combustion products may be trapped and recirculate. This
leads to increased heat flux to objects and surfaces compared to an unconfined fire.
The location where combustion occurs and the hottest parts of the flame may also shift due to
the confinement. In tests involving horizontal jet fires in a compartment incorporating a single
wall vent, where the jet was directed away from the vent, increased temperatures were seen at
the interface between the smoke layer leaving the compartment and the air layer entering the
compartment, most particularly in the area furthest from the vent.
Unlike unconfined fires, the behaviour of under-ventilated confined fires changes with time as
the air initially available within the compartment is consumed, and this may lead to external
flaming after a period of time when the body of flame moves through the vent in order to find
the oxygen required for combustion. CO levels of up to 5 % v/v at the vent may occur but after
the onset of external combustion the CO levels drop to typically less than 0.5 % v/v by the end
of the flame. Soot production is related to the equivalence ratio and hence the degree of
ventilation and may range from about 0.1 g m
-3
at an equivalence ration equal to 1.3 to up to
2.5 g m
-3
at an equivalence ration equal to 2.
Certain ventilation patterns could lead to flame instability and extinguishment. The worst case
condition is likely to occur if the jet fire is slightly under-ventilated as this leads to high heat
release rates and enhanced soot production.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 177 of 493
5.2.2.4 Confinement and deluge of gas jet fires
Deluge of a confined jet fire may lead to flame extinguishment and hence a serious explosion
hazard from the continuing release. The likelihood of flame extinguishment is significantly
increased if the surroundings are already hot at the time the deluge is activated as the main
mechanism which results in extinguishment of the jet fire is inerting, that is evaporation of the
water droplets leading to a mixture of gas/air/steam within the compartment which is outside
the flammable limits. The water vapour may also contribute to flame instability by reducing the
burning velocity. However, if the deluge is activated at an early stage, prior to the compartment
walls becoming hot, then the fire may not be extinguished and some benefit in terms of
reduced flame temperatures and wall temperatures may accrue.
5.2.2.5 Two-phase jet fire
An ignited release of a pressurised liquid/gas mixture (such as live crude or gas dissolved in
a liquid) will give rise to a two-phase jet fire. The gas stream atomises the liquid into droplets
which are then evaporated by radiation from the flame. However, a pressurised release of a
liquid can also give rise to a jet fire in which two-phase behaviour is observed if the liquid is
able to vaporise quickly. This is most likely to occur when a liquid is released from containment
at a temperature above its boiling point at ambient conditions whereupon flash evaporation
occurs, (for example propane, butane).
Pressurised releases of non-volatile liquids (for example, kerosene, diesel, or stabilised crude)
are unlikely to be able to sustain a two-phase jet fire, unless permanently piloted by an
adjacent fire; even so, some liquid drop-out is likely and hence the formation of a pool. At high
pressures, a spray of liquid droplets may be formed which can drift in ambient winds and
become dispersed over a wide area.
As for the gas jet fire described above, the two-phase jet fire is a turbulent diffusion flame
produced by the continuous combustion of a fuel at a rate directly related to the mass release
rate, producing a fire which is long and thin (although generally wider than a gas only jet fire)
and highly directional. The exception is when liquid drop-out occurs, leading to a potentially
increasing accumulation of fuel as a pool. Two-phase jet fires (particularly those generated by
flashing liquid releases) are significantly less noisy than gas jet fires. As for gas jet fires,
impact onto an obstacle larger than the flame half- width at the point of impact may shorten or
modify the shape of a fire significantly.
The liquid content results in relatively higher release rates for a given aperture and pressure
compared to gaseous releases and, when the release is two-phase (such as may arise from a
relatively long pipe connected to a liquid storage vessel), estimating the release rate is difficult.
The output from Codes used to characterise 2-phase releases should be viewed with caution
as these types of mixed fluid flows are very difficult to model accurately. The generally lower
exit velocities from flashing liquid releases lead to shorter flame lift-offs and proportionately
shorter and more buoyant flames overall. These lower velocities also make the fires more wind
affected whilst the higher hydrocarbon content of these fuels increases the flame luminosity.
However, two-phase releases involving gas dissolved in, or mixed with, a liquid can result in a
jet fire which combines the worst aspects of both the gas jet fire and the flashing liquid jet fire,
that is, high velocities and high flame luminosity.
The higher hydrocarbon content also results in more soot being formed than in a natural gas
jet fire, although there is no available experimental data quantifying the difference.
Measurements in the smoke downstream of a live crude jet fire determined an optical
obscuration factor of typically 10 % over a 200 mm path length. This corresponds to a visibility
distance of about 5 m.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 178 of 493
The soot produced then contributes significantly to the radiant emissions from the flame,
resulting in a proportionately higher contribution of radiative flux to engulfed objects. However,
the generally lower velocities arising from flashing liquid releases (such as propane or butane)
results in a lower convective flux to engulfed objects. Impaction to an obstacle close to the
leak can also result in a local cold spot and hence high temperature gradients to the
surrounding hot areas, inducing thermal stress.
In the case of a pressurised gas-liquid mixture (such as live crude), the high velocities may
still occur and result in a high convective contribution, whilst the higher hydrocarbon content
maintains a high radiative contribution; making these type of jet fires a worst case in terms of
total heat flux to engulfed obstacles. Experimental work suggests that the maximum combined
fluxes occur for gas-liquid mixtures which are about 70 % by mass liquid.
A special case of interest at some installations is live crude which includes a significant
quantity of water. Experiments have shown that mixtures with a water cut (defined as mass of
water/mass of fuel x 100 %) of up to 125 % remain flammable, although not necessarily
capable of supporting a stable flame in the absence of some other supporting mechanism. The
inclusion of water also slightly increases flame length and flame buoyancy, and the amount of
smoke produced reduces significantly. For water cuts under 50 % no significant reduction in
heat fluxes to engulfed objects can be expected (<10 %). However, over 50 % the flames are
significantly less radiative, and the overall heat flux to an obstacle can be reduced by 40 % or
more.
5.2.2.6 Effect of deluge on two-phase jet fires
Compared to the situation with a gas jet fire, the use of dedicated vessel deluge to protect a
vessel against a flashing liquid two-phase jet fire (e.g. propane, butane) can be more effective.
The water interacts with the flame to some extent; reducing the flame luminosity and the
amount of smoke produced. Nevertheless, at typical application rates (10 to 15 l min
-1
m
-2
) it
cannot be relied upon to maintain a water film over the vessel and hence to prevent vessel
temperature rise in areas where dry patches form, although the rate of rise may be expected
to reduce to 20-70 % of the rate without deluge for a propane jet fire. Similar behaviour has
been noted for live crude jet fires with dedicated deluge although, in this case, no reduction in
the rate of temperature rise was observed in the area where the fire impacted the obstacle.
However, in tests with an increased water application of 30 l min
-1
m
-2
, a 2 tonne LPG tank
was effectively protected when subjected to a 2 kg s
-1
flashing propane jet fire.
For live crude jet fires, using area deluge at the standard rate of 12 l min
-1
m
-2
is unlikely to
modify the flame behaviour although there is some evidence that a higher deluge rate
(24 l min
-1
m
-2
) can result in water interaction with the flame, resulting in a shorter flame and
some reduction in heat fluxes to certain areas of an engulfed object, notably the front (where
flame impact occurs) and top areas. Since dedicated vessel deluge is more effective at
reducing the radiative heat fluxes in the region to the rear of the vessel, the combination of
area deluge and dedicated vessel deluge can be effective in reducing overall heat fluxes to a
vessel such that the temperature rise is halted or at least the rate of temperature rise is
reduced. This may prevent vessel failure, especially if combined with a blowdown strategy.
As for gas jet fires, a major benefit of area deluge of two-phase jet fires arises from the
attenuation of incident thermal radiation to the surroundings, which protect adjacent plant and
in particular can aid escape by personnel. Even dedicated vessel deluge alone can result in
some reduction (~15-20 %) in the incident thermal radiation to the surroundings as a result of
modifying the flame characteristics.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 179 of 493
Measurements in the combustion products downstream of live crude jet fires determined an
obscuration factor due to smoke of typically 10 % over a 200 mm path length without deluge
and no significant change was noted in the presence of area deluge at 12 l min
-1
m
-2
. At
24 l min
-1
m
-2
the smoke changed from black to grey due to the increased water vapour and
this had the effect of increasing the obscuration factor to about 20 %, corresponding to a
visibility distance of about 2 m.
5.2.2.7 Effect of confinement on two-phase jet fires
Confined two-phase jet fires are expected to behave in a similar manner to confined gas jet
fires (see Section 5.2.2.3).
5.2.2.8 Confinement and deluge of two-phase jet fires
The effect of area deluge on two-phase jet fires in compartments is expected to be similar to
that noted in Section 5.2.2.4 for gas jet fires. Extinguishment could give rise to a mist-air
explosion hazard and/or the formation of a liquid pool. In tests involving only partial
confinement around the upper area of a module, during which dead spaces occurred close to
ceiling, area deluge was found to be beneficial in reducing heat fluxes to the ceiling surface,
reducing the flame extent and the amount of smoke produced.
5.2.3 Pool fires on an installation
5.2.3.1 Nature of hydrocarbon pool fires
A pressurised release of a hydrocarbon liquid which is not sufficiently atomised or volatile to
vaporise and form a jet fire will form a pool. Similarly a spillage from non-pressurised liquid
storage will result in a liquid pool being formed. Ignition of the vapours evolving from the liquid
can lead to a pool fire which is a turbulent diffusion flame. For hydrocarbons such as
condensate the vapours will evolve readily from a spillage and be easily ignited. For heavier
hydrocarbons, such as diesel or crude oil, little vapour evolution occurs unless the fuel is
heated and hence initial ignition of a spillage may be dependent on the presence of other fires
in the vicinity providing sufficient energy to initiate vapour evolution. However, once ignited,
the fire itself radiates heat to the pool surface causing more fuel to evaporate. The heat
transfer from the flame to the pool controls the vapour evolution rate (and hence mass burning
rate) and within minutes the fire will reach a steady state condition of flame size and mass
burning rate. Larger fires from larger pools will tend to result in higher mass burning rates.
However, an upper limit is reached when the radiation to the pool surface is independent of
the flame thickness above it (optically thick). This occurs for fires only a few metres in diameter
for heavy hydrocarbons due to the radiative emissions from soot. The mass burning rate is
also dependent on the fuel type and for liquid hydrocarbons decreases with increasing carbon
number (typically ranging from 0.1 kg m
-2
s
-1
for light hydrocarbons to 0.05 kg m
-2
s
-1
for some
crude oils).
Combustion of these relative high hydrocarbons inevitably leads to the production of large
quantities of soot, particularly in large pool fires where the size of the pool reduces the ability
of air to mix with the fuel evolving in the centre of the pool. The soot emissions result in the
characteristic yellow flame and large quantities of smoke can be produced; to the extent that
the smoke can result in reduced thermal radiation to the surroundings by screening of the
radiant flame.
Hence, the fraction of heat radiated, F (see Section 5.3.1 for definition), tends to decrease with
increasing fire size, although the smoke hazard may increase.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 180 of 493
In measurements in the smoke downstream of 16 m
2
diesel pool fires, the obscuration factor
over a 200 mm path length, as a result of the soot, was found to be typically 30 %
corresponding to a visibility distance of about 1 to 2 m. CO levels measured at the same
location were in the range 100-200 ppm v/v. However, a worst case level at the end of the
flame of about 0.5 % v/v is recommended. Soot levels in the range 0.5 g m
-3
to 2.5 g m
-3
can
be expected.
Except in very large fires where buoyancy driven turbulence may become significant, the low
velocities within the fire result in the flame being affected by the wind and this factor
determines the trajectory of the flame. These low velocities also result in low convective heat
fluxes to objects engulfed by the fire; the predominate mode of heat transfer being radiation.
5.2.3.2 Effect of deluge with hydrocarbon pool fires
General area deluge can be very effective in controlling hydrocarbon pool fires and mitigating
their consequences. If the water is capable of reaching the liquid pool, the cooling of the fuel
reduces vapour evolution and hence reduces the size of the flame. This, in turn, leads to
reduced radiative heat transfer from the flame to the fuel surface which also contributes to
reducing the vapour evolution. Consequently, with time, the fire size is reduced and complete
extinguishment may result or, if not, sufficient control achieved that manual fire fighting could
be safely undertaken. The ability of the water to enter the pool of fuel is higher on the upwind
side of the fire where the thickness of the flame is least. Consequently, as the deluge starts to
take effect on the fire, the flame retreats from the upwind side of the spillage. In tests involving
condensate, the fire coverage of the pool was reduced by over 90 % in 10 minutes. Hence,
after 10 minutes, the flame size was commensurate with a pool of less than 10 % of the
original area. The introduction of a small percentage (1 %) aqueous film forming foam (AFFF)
into the deluge system can significantly increase the rapidity of achieving fire control and
extinguishment.
Due to the much reduced fire size when a pool fire is subject to water deluge, the amount of
smoke is also significantly reduced. Measurements of the obscuration factor over a 200 mm
path length in the combustion products from a diesel pool fire dropped from typically 20-30 %
to negligible levels when the fire was deluged and CO levels at the same location dropped
from over 100 ppm v/v to typically 10 ppm v/v. However, if the water does not directly interact
with the fire itself and only interacts with the stream of smoke evolving then there is no
evidence that the water deluge washes soot out of the smoke, nor that the toxicity (such as
CO level) is reduced. A point of note is that the cooling effect of deluge may reduce the smoke
buoyancy and possibly result in smoke being present at lower heights where it may hinder the
visibility for personnel trying to escape.
The heat loading to objects engulfed in a pool fire may also be reduced by the activation of
deluge, most particularly on the surfaces where a water film can be maintained. The
vulnerable areas will be the underside where the water cannot provide coverage and the
downwind side where the flame is likely to be thickest. Nevertheless, in these areas the rate of
temperature rise is likely to be reduced and additional benefit accrues from the action of the
deluge in reducing the fire size. The use of dedicated vessel deluge would be expected to
protect an object engulfed in a pool fire, especially in combination with general area deluge
which will, simultaneously, reduce the degree of fire attack.
As for jet fires, the water deluge will also provide benefit to objects not engulfed by the fire by
attenuating the thermal radiation (see Section 5.2.2.2)
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 181 of 493
5.2.3.3 Confined hydrocarbon pool fires
The behaviour of confined pool fires will depend on the degree of ventilation and whether the
confining structure becomes hot and re-radiates heat to the fire. In the case of adequate
ventilation for combustion, the mass burning rate and fire behaviour will be similar to a pool fire
in an unconfined area, unless the walls become hot due to insulation in which case the flame
temperatures may rise significantly (by about 200-400 C) and hence the heat fluxes to objects
within and near the flame will rise. This is associated with soot combustion and can lead to
less smoke being evolved.
However if the ventilation is less than that required for combustion the fire becomes ventilation
controlled and the mass burning rate (and hence the vapour evolution rate) decreases to
match available air flow. Due to the reduced burning rate, the flame size and heat fluxes to
objects from ventilation controlled confined pool fires may be lower than from unconfined fires
unless re-radiation from hot compartment walls increases flame temperatures. The restricted
air flow may result in an external fire at the vent openings and so areas not previously exposed
to fire outside the compartment may now be exposed to flame engulfment and thermal
radiation.
In under-ventilated conditions both the CO and soot levels increase. CO up to 5 % v/v may be
measured at a vent prior to the onset of external flaming although at the end of an external
flame the levels are likely to fall to less than 0.5 % v/v. Soot levels up to 3 g m
-3
might be
expected.
5.2.3.4 Confined hydrocarbon pool fires with deluge
When deluge is activated within a confined space, the residence time of the water droplets in
the flame and hot walls leads to water evaporation within the flame and a significant reduction
in flame temperatures. This then reduces the radiation back to the pool surface and results in
a lower mass burning rate. An initially ventilation controlled pool fire may then become fuel
controlled at this lower burning rate and any external flaming that had formed is likely to be
reduced or to cease entirely.
5.2.3.5 Methanol pool fires
Methanol differs significantly from the hydrocarbon fuels discussed above. It burns with a non-
luminous invisible flame. No soot is produced and the thermal emissions are dominated by the
molecular emissions associated with the production of CO
2
and water vapour. The flame
height is about one third that expected from an equivalent sized hydrocarbon pool. The mass
burning rate increases with increasing pool size and a value of 0.03 kg m
-2
s
-1
has been
measured for a 10 m diameter pool. It is not known if the flame has reached optical thickness
at this scale and hence whether this would increase further for larger fires. The low radiative
emissions of the flame results in a low fraction of heat radiated, F, and low heat fluxes to
engulfed objects. On an offshore platform an important hazard may be to personnel entering
the flame unwittingly due to its invisibility.
5.2.3.6 Hydrocarbon pool fires on the sea
Once established, a hydrocarbon pool fire on the sea will behave in a similar manner to an
unconfined pool fire on an installation (See Section 5.2.3.1). Consequently, depending on the
size of the fire, engulfment of the installation legs and the underside of the platform are
possibilities. Flame temperatures of typically 900 to 1200 C can be expected and heat fluxes
to engulfed objects up to 250 kW m
-2
.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 182 of 493
Following initial ignition, the flame spread across the surface of a spill on the sea will depend
upon the volatility of the fuel, and the wind speed and direction. For oil spills, the rate of flame
spread downwind increases with increasing wind speed. The flames tend to spread from the
ignition source downwind across the spill without significant crosswind spread and flame
spread upwind is slow. The presence of sea currents or regular waves (swell) does not appear
to influence flame spread but it may be curtailed by choppy conditions or steep waves.
The significant difference between liquid spills on an installation and liquid spills on the sea is
that on the sea it is unlikely that ignition will occur at all. Overall, the likelihood of ignition is low
(especially for less volatile hydrocarbons such as crude oil) due to a number of factors which
are discussed below. The likelihood of ignition also decreases with time following a spill,
sometimes rapidly, so spills where immediate ignition could occur (or ignition has already
occurred) are likely to be the main focus of attention.
Firstly, and perhaps most importantly, the likelihood of an ignition source being present near
the sea surface would generally be low. Assuming an ignition source is present, there are
three main factors that influence the ignitability of liquid spills onto the sea, all of which are
time dependent. Their significance in inhibiting ignition increases with time resulting in lower
ignition probabilities. These are: pool thickness; fuel flashpoint; and emulsification.
Following an initial spillage, the pool will spread out quickly reaching an equilibrium thickness
within a few hours, even for a large spillage. This equilibrium thickness depends upon fuel type
with typical values of less than 0.1 mm for light crude oils and 0.05-0.5 mm for heavy crude
oils. However, there is a minimum pool thickness which is capable of supporting a stable
flame; about 0.5 mm for condensate; 1 mm for light crude; and 1-3 mm for heavier oils. When
the thickness falls below these levels, the cooling effect of the sea prevents evaporation of the
fuel from the pool surface which is required for combustion. This is because the temperatures
at the pool/water interface are never above 100 C and are generally close to ambient
temperatures. When the pool is thick, a steep temperature gradient through the pool allows
evaporation at the pool surface and potential ignition, especially if a high energy ignition
source is present such as another fire which will enhance evaporation rates.
Therefore, the fuel flashpoint is also a factor in determining the likelihood of ignition. Fuels with
a flashpoint lower than the ambient temperature will ignite readily but those with a flashpoint
over 100 C (such as stabilised crude oil) will require the presence of a major heat source to
achieve ignition, such as a pre-existing fire on the platform. Therefore, the likelihood of ignition
of a liquid spill reduces with time as the lighter fractions evaporate.
Emulsification of a hydrocarbon fuel with sea water will reduce significantly its flammability. For
crude oils, emulsions with over 25 % water are considered to be not ignitable. The cut-off point
for condensate is unknown, but is likely to be higher. Emulsification of the fuel and water
arises primarily as a result of the initial spill conditions and the subsequent weather/sea
conditions. Breaking waves and wind speeds over 15 m s
-1
will promote emulsification and
result in a low probability of ignition. (The wave action will also cause fluctuations in the pool
thickness and may result in breaking up of the pool and thereby prevent sustained burning).
Spills which plunge into the sea from the platform, (which, if burning, may be extinguished in
the process) are likely to break up and begin to emulsify. The least emulsification is likely to
result if spills run down an installation leg or occur close to the sea surface.
In the case of sub-sea oil pipeline failures in shallow water (<200 m), the oil plume widens as it
rises through the water and breaks up into small droplets. Any significant gas component in
the oil provides additional initial upward momentum and the oil droplets are likely to break the
surface in a location above the original failure and then spread radially. However, the pool may
then be carried along by tidal currents and wind. This process provides significant opportunity
for emulsification and reduces the ignitability of any resulting pool.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 183 of 493
In case of stabilised crude, the lower initial buoyancy will result in the rising plume being more
affected by tidal currents and the oil may reach the surface at a location displaced laterally
from the original leak site.
In deep water, some or all of the gas component may form gas hydrate solids and this results
in a reduced initial upward velocity for the leak, leaving the oil droplets to rise purely as a result
of their buoyancy. In these circumstances the lateral movement of the rising plume may be
significant and the oil eventually reaches the surface some distance from the original leak
location. Again, significant emulsification will have occurred resulting in very low ignition
probabilities.
In summary, a low velocity, ignited, large volume spillage of a volatile liquid hydrocarbon close
to the sea surface near to the installation in calm or moderate conditions represents the worst
case scenario in terms of a pool fire on the sea. Most other scenarios have a low likelihood of
producing a pool fire. Experiments have been carried out by Sintef in two experiment series at
Spitzbergen in 1994.
5.2.4 Gas fires from sub sea releases
In shallow water, failure of a sub-sea gas pipeline (or a pipeline containing a gas-oil or
gas-condensate mixture with a high GOR) could give rise to a flammable gas release at the
sea surface. However, the likelihood depends primarily on the depth of sea water. In shallow
water the plume of bubbles will increase in radius approximately linearly as it rises through the
water producing a conical plume. When close to the water surface, the streamlines diverge
horizontally and tidal currents interact with the plume and this may result in the area where the
gas bubbles break the surface being twice that expected by conical plume development only.
Whether the resulting gas breaking the surface is flammable will depend on the rate of gas
released and the area over which it breaks the surface which, as already noted, is related to
the water depth. However, unless the water is very shallow (<10 m), the resulting gas release
at the sea surface is likely to be a dispersed low velocity source and burn as a weakly
turbulent diffusion flame, strongly affected by the wind. It could be considered as a pool fire
with an effective mass burning rate given by the release rate divided by the area over which
the gas surfaces. A full bore rupture of a sub-sea pipeline will result in a highly transient
outflow, so the resulting fire hazard will also vary with time. The operation of a sub-sea ESDV
valve may limit the duration of the release and also give rise to a rapidly changing release rate
with time.
In deep water (>300 m) some formation of gas hydrates is likely and over 500 m some
researchers report complete conversion to hydrates, although this also depends on gas
composition and water temperature. In such cases, the hydrates will rise solely as a result of
buoyancy and are likely to reach the sea surface some distance laterally from the original leak
site. Some researchers suggest that water turbulence may keep the hydrates in suspension
and the gas may never reach the surface.
5.2.5 BLEVE
Fire impingement on a vessel containing a pressure liquefied gas causes the pressure to rise
within the vessel and the vessel wall to weaken. Even within a short timeframe, this may lead
to catastrophic failure and the total loss of inventory. The liquefied gas which is released
flashes producing a vapour cloud which is usually ignited. These events are known as Boiling
Liquid Expanding Vapour Cloud Explosions, BLEVEs. This highly transient event generates a
pressure wave and fragments of the vessel may produce a missile hazard leading to failure of
other items in the vicinity and hence the potential for escalation. In addition, there is a flame
engulfment and thermal radiation hazard produced by the fireball.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 184 of 493
Onshore, BLEVEs are generally associated with the storage of pressure liquefied fuels such
as LPG. Experimental work has shown that a standard LPG storage vessel, incorporating the
normal pressure relief valve, can fail catastrophically within 5 minutes of being subjected to a
medium sized (<2 kg s
-1
or ~100 MW) jet fire, despite operation of the relief valve. Following
failure, a large approximately spherical fireball is produced which is highly radiative with little
smoke obscuration due to the fuel atomisation and vaporisation leading to good mixing with
the air. Consequently, the fraction of heat radiated, F, is higher than for a large pool fire
involving the same fuel. The initial upward momentum and vorticity of the fireball causes it to
rise into the air as it develops and eventually it burns out when all the fuel is consumed. How
much of the initially liquid fuel vaporises and takes part in the fireball depends upon the degree
of superheat of the fuel at the time of failure and also whether liquid becomes entrained into
the flashing vapour.
In the offshore context, a BLEVE hazard might be considered, for example, in relation to a
pressurised separator vessel containing unstabilised condensate and gas. However, a BLEVE
is unlikely to develop in the same way as described above for an onshore facility as the vessel
will probably be located within a module amongst other vessels and pipework. The potential
for escalation is thus much increased due to the proximity of other vessels and pipework which
may be struck by missiles. Additionally, the presence of this other equipment may lead to
increased overpressures being developed as the burning gas cloud expands through the
congested region. The presence of roof confinement will significantly modify the shape of the
developing fireball and lead to increased lateral development. Even a small inventory of fuel
being involved in a BLEVE event (<100 kg) would be expected to produce a fireball extending
throughout the entire volume a typical module. Consequently, apart from the risk of the BLEVE
causing escalation, the event presents a severe hazard to exposed personnel.
Whilst pre-activation of deluge (area and dedicated vessel deluge) may prevent or delay the
occurrence of a BLEVE, the deluge is unlikely to provide any significant benefit in terms of
mitigation of the event, especially within the region of potential flame engulfment.
5.3 Fire and smoke loading
5.3.1 Fire loading to the surroundings
An obvious hazard presented by a fire is the thermal radiation to the surroundings, in particular
to personnel during escape and evacuation. The incident thermal radiation, q, to a person or
object from a fire can be described as:
q = V E t (kW m
-2
) ................................................................. Equation 5-1
Where:
V is the view factor of the flame by the receiver,
E is the average surface emissive power of the flame (kWm
-2
) (Note the surface
emissive power varies over the surface of the flame and hence an area-based
average is required to represent the whole surface)
is the atmospheric transmissivity
The view factor is a function of the flame shape. Consequently, most integral or empirical
mathematical models will assume some kind of simplified flame shape which is then used to
calculate the view factor. The flame average surface emissive power is also a function of the
flame shape. Therefore, average surface emissive powers used by the model will not
necessarily be the same as those measured during an actual fire.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 185 of 493
In the far field, (typically more than 2 flame lengths away) the flame shape is not critical, so a
simplified approach can be taken using the point source model, whereby the difficulties of
defining a flame shape and associated average surface emissive power can be avoided. In
this approach, the fraction of the heat of combustion of the fuel radiated to the surroundings is
defined as:
E A
F
Q
= ....................................................................................... Equation 5-2
Where:
A is the surface area of the flame (m
2
)
Q is the net rate of energy release by combustion of the fuel (kW) and Q m H = &
m& is the rate of fuel combustion (kg s
-1
)
H is the net calorific value (kJ kg
-1
)
The incident radiation received in the far field at a distance, d (m), from the fire is then
expressed as:
2
4
d
F m H
q
d

=
&
................................................................................ Equation 5-3
The atmospheric transmissivity will depend upon the prevailing atmospheric conditions
(absolute humidity) and the path length, but might typically be 0.8 on a dry day. However, fog
would significantly reduce this value.
The activation of water deluge on an offshore installation, producing water droplets in the air,
effectively reduces the transmissivity by absorbing radiation. However, for the purposes of this
document, a revised effective fraction of heat radiated is defined as F , accounting for the
reduced transmissivity in the area being deluged, (but not including the transmissivity of the
atmosphere between the fire and the receiver which is outside the deluged area). The incident
radiation at a distance, d(m), from the fire can be estimated using:
2
4
d
F m H
q
d

=
&
.............................................................................. Equation 5-4
Note that the above equation does not necessarily take account of any effect of the deluge on
the flame behaviour itself such as lowering the flame temperature or size. As will be noted
later, jet fires are little affected by deluge, but pool fires can reduce significantly in size. In the
case of pool fires, this reduction in size (area of the surface actually burning) would result in a
reduced value of m& and hence would be reflected in calculations made using the above
equation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 186 of 493
This point source model can be useful for estimating the distance to a given radiation level. In
the case of personnel, it is important to consider both the level of radiation and the duration of
exposure and the consequences for personnel (in terms of burn injuries or fatality) are often
related quantitatively to the dosage level,
d
S , given by:
( )
4
3
d d
S q dt =

............................................................................... Equation 5-5


As a guide, a radiation level of about 5 kWm
-2
can be tolerated for about one minute and
consequently represents a level from which it is reasonable to assume that escape, without
significant injury, would usually be possible for an average employee wearing typical protective
clothing, (see also Section 5.5.1.13).
However, the point source model is not suitable for estimating incident radiation to locations
close to (certainly within one flame length) of the flame, where it may be significantly in error.
In the near field, a mathematical model which defines a realistic flame shape (and ideally a
variation of surface emissive power over the flame to allow for smoke obscuration) should be
used.. Typical values of F and F are provided in Section 5.4.2 for a range of fire types.
5.3.2 Thermal loading to engulfed objects
The thermal load per unit area to an object engulfed by fire will be a combination of radiation
from the flame (q
rl
) and convection from the hot combustion products (q
cl
) passing over the
object surface. Hence the thermal load can be written as:
1 rl cl
q q q = +
( )
4 4
1 f f f a f s
q T T h T T = + + ............................................... Equation 5-6
where
,
f f
are the flame emissivity and transmissivity respectively,
is the Stefan-Boltzmann constant (5.6697 x 10
-11
kWm
-2
K
-4
)
and ,
f s a
T T T are the flame, object surface and ambient temperatures respectively
(K)
h is the convective heat transfer coefficient (kWm
-2
K
-1
)
However, not all the thermal loading is necessarily absorbed by the surface, some may be
reflected back and the surface will also lose heat by radiation. Hence the total absorbed load
per unit area (
t
q ) is given by:
( )
4 4 4 4
t f s f s f s s f a s f s f s
q T T T T h T T = + + Equation 5-7
where ,
s f
are the absorptivities of the surface and flame respectively. Assuming that both
the flame and surface can be considered as diffuse grey bodies, then
s s
= ,
f f
= and
1
f f
= . Furthermore, the term involving
a
T is small and can be neglected, giving:
t r c
q q q = +
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 187 of 493
( ) ( )
4 4
t s f f s f s
q T T h T T = + ............................................... Equation 5-8
When considering an actual object engulfed by a fire, the flame temperature exposed to
different parts of the object surface may vary; similarly the flame velocities (and hence
convective heat transfer coefficient) may vary. Hence, to determine the total load absorbed by
an object, Equation 5-8 should be summed over the area of the object.
Also, as the object engulfed in the flame heats up, the absorbed load will reduce. This is
particularly the case with the convective load which reduces linearly with increasing object
temperature. Therefore, for an accurate transient calculation of the temperature rise of an
object, the parameters
f
T ,
f
and h are required, together with the emissivity of the surface
(which itself may change as the surface heats up). Where possible, typical values of these
parameters are provided in Section 5.4.2.
However, researchers often quote heat fluxes measured during experiments using
calorimeters (for total heat flux) and radiometers (for radiative flux). These instruments are
designed to have a surface emissivity close to 1 and are maintained at a low temperature
throughout the experiments. Hence the fluxes measured and reported for calorimeters are
given by Equation 5-8 with 1
s
= and 333 K
s
T and can be regarded as a conservative
estimate of the total heat flux absorbed by an engulfed object. Radiometers are designed and
calibrated to measure
4
f f
T . At an early stage, whilst
s
T is low, the flux measured by a
radiometer is approximately ( )
r s
q and so, if
s
is taken as 1, it provides a conservative
estimate of the radiative flux absorbed by an object.
Subtracting the measured radiative flux from the measured total heat flux enables the initial
convective flux absorbed by the object to be determined. Using an estimated or measured
value for
f
T enables h to be determined at the measurement location. In this way,
experimentally measured flux levels can be used to derive input data for transient heat-up
calculations (see also Section 5.5.1.6).
Consequently, typical values of the total, radiative and convective fluxes (as defined in
Equation 5-8 above with 1
s
= and 333 K
s
T ) are also provided in Section 5.4.2 for the
range of fire types.
5.3.3 Smoke loading
The combustion of hydrocarbons produces large volumes of initially high temperature
combustion products which disperse and cool down. If combustion is efficient and complete
then the products from burning a hydrocarbon mixture comprise carbon dioxide and water
vapour. These are not toxic or harmful, providing the ambient oxygen levels are not
significantly affected. (The foregoing excludes fuels containing sulphur or sulphur compounds
which can present a toxic hazard). However, the combustion process of non-premixed
hydrocarbon fuels is rarely so efficient (especially for higher hydrocarbons) and intermediate
combustion products such as carbon monoxide (CO) and soot (carbon particles) are usually
formed within the flame and may persist beyond the flame envelope within the stream of
combustion products. Incomplete combustion may also lead to unburnt fuel being carried over
in the products as well. CO is toxic and soot particles are an irritant to the lungs. The soot also
reduces visibility and may affect the ability to escape.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 188 of 493
The amount and nature of the combustion products produced by a fire is determined by the
fuel combustion rate and the amount of air involved in the combustion reaction or entrained
within it. A rough estimate of the mass flow rate of combustion products evolving from a fire
can be made by multiplying the fuel mass burning rate by the ratio of air needed for complete
combustion. For methane this figure is about 17.2 and for higher hydrocarbons it is about 15.
The equivalence ratio, , defined as:
m
r
a
=
&
&
........................................................................................ Equation 5-9
Where;
m& is the mass burning rate of fuel
a& is the mass rate of air entrained
r is the mass ratio of air to fuel required for stoichiometric burning (that is ~15)
Hence, for stoichiometric burning, 1 = and the rate of formation of products will be (r + 1)
times the mass burning rate of fuel. For well ventilated fires where plentiful air mixes with the
fuel, 1 < and more products may be produced compared to the case of stoichiometric
combustion. However, the excess air in the products dilutes the smoke, reducing both the
concentration of toxic products and soot and also lowering the temperature. For fires where
the ventilation is restricted to an extent that insufficient air is available for complete
combustion, 1 > and the concentrations of intermediate combustion products (for example
CO and soot) will increase and are more likely to persist beyond the flame envelope.
The amount of CO within the combustion products is usually quantified in terms of its volume
concentration as a volume percentage (or ppm). For soot, the mass concentration of particles
in the combustion products is difficult to measure and an alternative approach is to determine
the optical density by measuring the attenuation of a beam of light passing through the smoke.
The optical density,
10
D , is given by:
10 10
0
10
10
2 303
log
.
I
D C L
I


= =


............................................. Equation 5-10
Where;
I is light intensity through the smoke
I
0
is the intensity without smoke
is the extinction coefficient
C is the mass concentration of soot (g m
-3
)
L is the path length of the optical beam through the smoke
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 189 of 493
The optical density, expressed in terms of unit path length (D
10
/ L in db m
-1
) correlates
reasonably well with visibility with 1 db m
-1
corresponding to a visibility of about 10 m and
10 db m
-1
corresponding to about 1 m. The visibility of exit signs can be significantly improved
if they are back-illuminated and may be seen at 2.5 times the distance of a surface illuminated
sign. For more information on smoke and its effects on people, refer to Section 7.8.5.2.
5.4 Estimating fire and smoke loadings
5.4.1 Inventories and release rates
The inventories of isolatable sections between ESDVs may vary considerably but typically
would be less than 10 tonnes for gas and 25 tonnes for liquids, excluding those associated
with the well and risers and utility fuels such as diesel and methanol. The inventory of an
isolatable section and the size of a leak will determine the maximum duration of resulting fire.
For gas inventories, this duration may be further reduced by a successful blowdown of the
isolated section. Hence, the duration of large gas leaks may be relatively short. For liquid
spills, an effective drainage system may limit the inventory involved in a fire. Historical data
also shows that the likelihood of a release is also related to its size, with the smallest leaks
being more common.
The resulting fire size following an accidental release will be strongly dependent on the mass
release rate of the fuel, which will be determined by the hole size and pressure. For a QRA a
range of representative scenarios should be considered (see also Section 2.6.5.9).
A leak classification often used is:
Small leaks typically 0.1kg s
-1

Medium leaks typically 1kg s
-1

Large leaks typically 10 kg s
-1

Major failures typically >30 kg s
-1

For high pressure gas releases, these correspond to failure sizes of the order of 1, 10, 30 and
100 mm diameter respectively.
In the following section, these leak sizes are considered for the gas jet fires and two-phase jet
fires. For leak sizes 10 kg s
-1
and above, the fire is large compared with the average module
and it may be necessary to consider the fire to be confined with the consequent effects on fire
characteristics as discussed in Sections 5.2.2.3 and 5.2.3.3.
For pool fires, two sizes are considered:
Small pool (typically less than 5 m diameter)
Large pool (typically >10 m in diameter)
A small pool fire might typically result for a leak rate in the region of 1 to 2 kg s
-1
and, within a
typical open module, would be expected to burn in the fuel controlled regime, that is, sufficient
air for combustion should be available and the fire behaviour would not be affected by
confinement or restricted ventilation. A large pool fire would be expected to produce a flame
reaching to the roof of a module and be affected by the confinement. It may also suffer from
restricted ventilation. Consequently, the effects of confinement on fire characteristics as
discussed in Section 5.2.3.3 need to be considered.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 190 of 493
A similar effect might arise for a small pool fire within a compartment within a module and
these fires should be considered as behaving like a large pool fire.
For pool fires on the sea, only large spills are considered, as small spills are unlikely to affect
the installation. Similarly, only a gas fed fire at the sea surface due to major failure of a 24
diameter sub-sea pipeline is considered.
For BLEVEs, as discussed in Section 5.2.5 even a small inventory would be expected to give
rise to a fireball extending throughout a module resulting in serious consequences for
personnel within the immediate area.
5.4.2 Typical values
5.4.2.1 General
Ideally, the fire size and thermal loading from fires should be assessed using mathematical
models which have been extensively validated against large scale data. A range of such
models are available on a licence or consultancy basis. (See Section 5.4.3 and Annex F).
However, a simplified approach was proposed in the Interim Guidance Notes, whereby
correlations for flame dimensions were suggested for jet and pool fires together with guidance
on typical heat loadings to engulfed objects. In this section a similar approach to the Interim
Guidance Notes is taken and updated to reflect recent knowledge and experimental work. For
the six fire types identified and discussed in Section 5.2, tabulated values are provided giving
guidance on typical fire sizes and heat loadings for the release rates identified in Section 5.4.1.
The values presented were derived from information in the literature; the results of an
extensive body of large scale experimental data (some of which is unpublished but to which
Advantica has kindly provided access); and predictions made by Shell and Advantica. In
essence the fire loading data presented here is an updated, more detailed and comprehensive
version of the guidance values provided in the Energy Institute document Guidelines for the
design and protection of pressure systems to withstand severe fires Information on smoke
loading is also based on experimental data gathered by Advantica and Shell, much of which is
unpublished.
5.4.2.2 High pressure jet fires gas and two-phase
Wherever possible, the following information is provided for the four release rates of
Section 5.4.1:
The expected flame extent, so that items or personnel within that range can be
identified and the consequences of flame engulfment considered.
The Fraction of Heat Radiated, F, so that estimates of the far field incident radiation
hazard can be made using Equation 5-3 in Section 5.3.1.
The CO level and soot concentration in the smoke produced.
The total heat flux to an engulfed object together with the radiative and convective
components, so that calculations of the object heat-up can be performed (see
Section 5.5 Heat transfer). Note that these fluxes represent the initial values when the
engulfed object is cold. Values of typical flame temperature, emissivity and convective
heat transfer coefficients are also provided.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 191 of 493
The effect of deluge (where appropriate) in terms of the reduction in the heat flux to
engulfed objects and the enhanced attenuation of incident radiation to the surroundings
using the Effective Fraction of Heat Radiated, F (see Equation 5-4).
The effect of confinement on fire characteristics and the combined effect of
confinement and deluge.
This information is presented in Table 5.1 for gas jet fires and Table 5.2 for two-phase jet fires.
As discussed in Section 5.2.2.5, for two-phase jet fires, the maximum heat fluxes to engulfed
objects have been found to occur when the mixture is about 30 % gas and 70 % liquid by
mass. Consequently, the values shown in Table 5.2 correspond to this worst case condition.
Table 5.1 - High pressure gas jet fires
Size (kg s
-1
)
0.1 1.0 10 >30 Effect of confinement
Flame length (m) 5 15 40 65 Affected by enclosure shape and
openings
Fraction of heat
radiated, F
0.05 0.08 0.13 0.13
CO < 0.1 CO < 0.1 CO < 0.1 CO < 0.1 CO level (% v/v)
and smoke
concentration
(g m
-3
)
Soot
~0.01
Soot
~0.01
Soot
~0.01
Soot
~0.01
Increased CO up to about 5 % v/v at
a vent prior to external flaming, but
after external flaming <0.5 % v/v at
the end of the flame. Soot levels
depend on equivalence ratio from
about 0.1 g m
-3
at = 1.3 to
2.5 g m
-3
at = 2.0
Total heat flux
(kWm
-2
)
180 250 300 350 Increased heat loadings up to
400 kWm
-2
. (280 kWm
-2
radiative,
120 kWm
-2
convective, T
f
= 1600K,

f
= 0.75, h = 0.09)
Radiative flux
(kWm
-2
)
80 130 180 230
Convective flux
(kWm
-2
)
100 120 120 120
Flame
temperature, T
f

(K)
1560 1560 1560 1560
Flame emissivity,

f

0.25 0.40 0.55 0.70
Convective heat
transfer
coefficient, h
(kWm
-2
K
-1
)
0.08 0.095 0.095 0.095
Effect of deluge
No effect on heat loadings to engulfed objects.
In far field, take F=0.8F for 1 row of water
sprays, F=0.7F for 2 rows and F=0.5F for >2
rows at 12 l min
-1
m
-2
, for use in Equation 5-4.
May improve combustion efficiency and
reduce CO levels within flame.
Risk of extinguishment and explosion
hazard if deluge activated when
enclosure is already hot and fire is
well established.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 192 of 493

It should be noted in Table 5.1 and Table 5.2 that for the largest leaks (i.e. a flow rate
>30 kg s
-1
a single number is given for the total heat flux which could be interpreted as
implying a constant value for all of these larger release rates. Where heat flux calculations are
required for larger leak rates, the heat flux figures should be used with caution, CFD
simulations can be used to obtain data on the effects of larger fires.
Table 5.2 - High pressure two-phase jet fires

Fuel mix of 30 % gas, 70 % liquid by
mass
Flashing
liquid
fires (e.g.
propane/
butane).

Size (kg s
-1
)
0.1 1.0 10 30 1.0 Effect of Confinement
Flame length
(m)
5 13 35 60 Affected by enclosure
shape and openings
Fraction of
heat radiated,
F
See equation below table

CO level
(% v/v) and
smoke
concentration
(g m
-3
)
CO < 0.1
Soot
~0.01
CO < 0.1
Soot
~0.01
CO < 0.1
Soot
~0.01
CO < 0.1
Soot
~0.01
Increased CO up to
about 5 % v/v at a vent
prior to external flaming,
but after external flaming
<0.5 % v/v at the end of
the flame. Soot levels
depend on equivalence
ratio from about 0.1 g m
-
3
at = 1.3 to 2.5 g m
-3

at = 2.0
Total heat flux
(kWm
-2
)
200 300 350 400 230
Radiative flux
(kWm
-2
)
100 180 230 280 160
Convective
flux (kWm
-2
)
100 120 120 120 70
Flame
temperature, T
f

(K)
1560 1560 1560 1560 1300
Flame
emissivity,
f

0.30 0.55 0.70 0.85 1.00
Convective
heat transfer
coefficient, h
(kWm
-2
K
-1
)
0.080 0.095 0.095 0.095 0.070
Increased heat fluxes,
take values as per
30 kg s
-1
two-phase jet
fire.
Effect of
deluge
Some benefit to engulfed objects but temperature may
still rise although at a slower rate. Combined area and
dedicated deluge may prevent temperature rise if
effectively applied. See Section 5.2.2.6.
In far field take F as per Table 5.1.
Risk of extinguishment
and potential formation
of pool.

FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 193 of 493
Fraction of Heat Radiated,
m
F , of mixture involving x% liquid by mass:
Use ( )
100
m L G G
x
F F F F

= +


where
G
F is the fraction of heat radiated for natural gas as
given in Table 5.1 and
L
F is the fraction of heat radiated for the liquid fuel involved. Take
L
F = 0.24 for C3; 0.32 for C4, 0.45 for C6-C25 (including condensate and diesel); and
0.5 for crude oil.
5.4.2.3 Pool fires on the installation
The following information is provided for pool fires on an installation:
The expected flame extent, so that items or personnel within that range can be
identified and the consequences of flame engulfment considered.
The mass burning, so that the duration of a fire following a spillage might be assessed
and to provide input to calculations of the incident radiation field.
The Fraction of Heat Radiated, F, so that estimates of the far field incident radiation
hazard can be made using Equation 5-3 in Section 5.3.1, where the rate of fuel
combustion, m& , is taken as the mass burning rate times the area of the pool.
The CO level and soot concentration in the smoke produced.
The total heat flux to an engulfed object together with the radiative and convective
components, so that calculations of the object heat-up can be performed (see
Section 5.5). Note that these fluxes represent the initial values when the engulfed
object is cold. Values of typical flame temperature, emissivity and convective heat
transfer coefficients are also provided.
The effect of deluge in terms of the reduction in the heat flux to engulfed objects and
the enhanced attenuation of incident radiation to the surroundings using the Effective
Fraction of Heat Radiated, F (see Equation 5-4).
The effect of confinement on fire characteristics and the combined effect of
confinement and deluge.
This information is presented in Table 5.3.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 194 of 493
Table 5.3 Pool fires on the installation
Pool fire
parameter
Methanol
pool
Small
hydrocarbon
pool
Large
hydrocarbon
pool
Effect of
confinement
Typical Pool
Diameter (m)
5 <5 >5 Any
Flame Length
(m)
Equal to pool
diameter
Twice pool diameter Up to twice pool
diameter
Mass Burning
Rate
(kg m
-2
s
-1
)
0.03 Crude 0.045-0.06
Diesel 0.055
Kerosene 0.06
Condensate - 0.09
C3/C4s 0.09
Crude 0.045-0.06
Diesel 0.055
Kerosene 0.06
Condensate - 0.10
C3/C4s 0.12
Fraction of
Heat Radiated,
F
0.15 0.25 0.15
See Section 5.4.2.3.
Take values as per
large hydrocarbon
pool fire for worst
case. If confinement
is severe then mass
burning rate will
decrease to match
available air flow and
large external fire at
vent expected.
CO level (%
v/v) and
Smoke
Concentration
(g m
-3
)
Negligible CO < 0.5
Soot 0.5 2.5
CO < 0.5
Soot 0.5 2.5
Increased CO up to
about 5 % v/v at a
vent prior to external
flaming, but after
external flaming
about 0.5 % v/v at
the end of the flame.
Soot levels up to
3 g m
-3
.
Total Heat Flux
(kWm
-2
)
35 125 250
Radiative Flux
(kWm
-2
)
35 125 230
Convective
Flux (kWm
-2
)
0 0 20
Flame
temperature, T
f

(K)
1250 1250 1460
Flame
emissivity,
f

0.25 0.90 0.90
Convective
Heat Transfer,
h Coefficient
(kWm
-2
K
-1
)
- - 0.02
See Section 5.4.2.3
Take values as per
large hydrocarbon
pool fire.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 195 of 493
Pool fire
parameter
Methanol
pool
Small
hydrocarbon
pool
Large
hydrocarbon
pool
Effect of
confinement
Effect of
Deluge
Extinguishable
using AFFF.
Water soluble
but effect of
water deluge
unknown.
See Section 5.2.3.2
Considerable fire control and potential
extinguishment can be achieved. Expect a
reduction in flame coverage (and hence
flame size) of up to 90 % within 10minutes.
Rapid extinguishment with AFFF.
Up to 50 % reduction in radiative heat flux
to engulfed objects.
In far field take F = 0.8F for 1 row of water
sprays, F=0.7F for 2 rows and F=0.4F for
>2 rows at 12 l min
-1
m
-2

See Section 5.2.3.4.
Expect reduced
flame temperatures
and reduced or no
external flaming.
Mass burning rate
reduces to match
available air flow.

5.4.2.4 Fires on the sea
The following information is provided in Table 5.4 for hydrocarbon pool fires on the sea:
The expected flame extent, so that items within that range can be identified and the
consequences of flame engulfment considered.
The mass burning, so that the duration of a fire following a spillage might be assessed
and to provide input to calculations of the incident radiation field.
The Fraction of Heat Radiated, F, so that calculations of the far field incident radiation
hazard can be made using Equation 5-3, where the rate of fuel combustion, m& , is
taken as the mass burning rate times the area of the pool.
The CO level and soot concentration in the smoke produced.
The total heat flux to an engulfed object together with the radiative and convective
components, so that calculations of the object heat-up can be performed (see
Section 5.5 Heat transfer). Values of typical flame temperature, emissivity and
convective heat transfer coefficients are also provided.
The gas outflow from a sub-sea pipeline will depend on the pressure and the pipeline size.
The release will also vary with time; this variation depending upon the length of pipeline which
is depressurising. Similarly, the area at the sea surface over which the gas emerges will
depend on the depth and the gas release rate. Furthermore, depending on the gas outflow and
the depth, the gas plume at the sea surface may not be within flammable limits. For these
reasons, simplified guidance cannot be readily provided and the use of a model is
recommended. This topic is an area of some uncertainty and model predictions vary
considerably. For illustrative purposes, predictions of the fire hazard following the rupture of a
long 24 diameter natural gas pipeline operating at 100 barg at a depth of 50 m suggest that
the fire diameter might be of the order of 100 m with a flame length of 150-200 m. On the basis
that the fire is a low velocity laminar flame, it can be regarded as a large pool fire and the
values presented in Table 5.4 for fraction of heat radiated and heat fluxes are recommended.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 196 of 493
Table 5.4 - Hydrocarbon pool fire on the sea
Pool fire on sea parameters Value
Typical Pool Diameter (m) >10
Flame Length (m) Up to twice diameter
Mass Burning Rate (kg m 2 s 1) Crude 0.045-0.060
Diesel 0.055
Kerosene 0.060
Condensate 0.100
C3/C4s 0.200
Fraction of Heat Radiated, F 0.12
CO level (% v/v) and Smoke
Concentration (g m
-3
)
CO < 0.5
Soot 0.5 2.5
Total Heat Flux (kWm
-2
) 250
Radiative Flux (kWm
-2
) 230
Convective Flux (kWm
-2
) 20
Flame Temperature (K) 1460
Flame Emissivity, 0.90
Convective Heat Transfer Coefficient, h
(kWm
-2
K
-1
)
0.02

5.4.2.5 BLEVEs
BLEVEs are highly transient events in which a fixed inventory is instantaneously released. The
subsequent combustion gives rise to a fireball which grows in size to a maximum before
burning out as all the fuel is consumed. Consequently, the key parameters of interest in terms
of a consequence assessment are the extent of the flame and the incident radiation hazard to
personnel outside the flame. These parameters are also highly transient. In relation to incident
radiation levels outside the fireball, both the maximum level experienced and the dosage over
the duration of the event are of interest in order to determine the effect on people.
Consequently, Table 5.5 presents the following data in relation to BLEVEs:
Typical maximum fireball diameter (assuming unconfined) based on the mass of fuel
involved in the BLEVE, and the maximum flame volume calculated assuming a
spherical geometry. Hence the area of a module which would be expected to be
engulfed in flame can be assessed by dividing the volume of the fireball by the height
of the module.
The expected duration as a function of the mass of fuel involved in the BLEVE.
The Modified Fraction of Heat Radiated F*, which can be used to calculate the
maximum incident radiation received at a location d, remote from the fireball (more
than one fireball diameter distant from edge of fireball) using the equation:
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 197 of 493
-2
2
kWm
4
,max
*
d
F M H
q
d t

= ...................................................... Equation 5-11


where: t is the duration of the BLEVE event (s)
is the atmospheric transmissivity
M is the mass of fuel involved in the BLEVE (kg)
H is the calorific value (kJ kg
-1
)
d is the distance from the centre of the fireball where the dosage is
experienced (m)
Various correlations have been developed relating the maximum diameter (D), maximum
height (h) and duration (t) of the fireball following an unconfined BLEVE to the mass of fuel
released, for example CCPS Guidelines for Chemical Process Quantitative Risk Analysis [5.1]
suggests that:
D = 6.48 x M
0.325
h = 0.75 x D
t = 0.825 x M
0.26

These equations have been used to derive the values presented in Table 5.5 for maximum
diameter and duration. Comparisons with large scale data showed reasonable agreement.
Table 5.5 - BLEVEs
Parameter Characteristic expressed as function of
BLEVE fuel mass (kg of fuel)
Maximum Diameter (m) D = 6.48 x M
0.325

Maximum Flame Volume (m
3
) V = 142.47 x M
0.975

Duration (s) t = 0.825 x M
0.26

Modified Fraction of Heat Radiated, F*
0.35
(ONLY for use in Equation 5-11 to derive
maximum incident radiation at a locations remote
from the fireball)

5.4.3 Predictive models for fire loading
There are basically three types of predictive models which can be used to predict fire
characteristics and the thermal loading from fires, these being:
Empirical models;
Integral (or phenomenological) models;
Numerical (CFD) models.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 198 of 493
Empirical models contain, to varying degrees, a physical basis combined with correlations
which have been derived from experimental data. They are generally easy to use, but their
applicability is limited to the range of experimental data used to derive them.
Integral models use equations relating the fire characteristics to the physical processes
involved, such as mixing, combustion and thermal emissions. However, the relationships are
simplified and are generally one-dimensional. Such models will also often contain some
parameters which have been empirically derived from experimental data. Nevertheless,
integral models provide an effective method for predicting fire characteristics and are generally
easy to use. Strictly speaking, they should only be applied to the range of circumstances for
which they have been validated by experimental data. However, because of the physical basis
of the equations, the models can be applied, within reason, to situations outside this range.
Numerical models (CFD) attempt to model in 3-dimensions the time varying processes within a
fire such as the fluid flow and combustion processes. In principle, this physical basis enables
these models to study complex geometries and conditions far removed from experimental data
used to validate them. It is noted that resulting predictions may be sensitive to small changes
in input parameters if not used properly. Therefore these models generally require expert
users.. For these reasons, CFD codes are not routinely used for general risk assessments.
However, they can be useful to study in detail a particular fire scenario of interest due to its
severity. The impact of potential design changes (such as increased ventilation) can then
compared and provide at least qualitative guidance on how to reduce the hazard. The CFD
predictions use more realistic geometry and dynamic models and may require the risk
assessment to take into account new parameters such as the leak jet direction, leak location,
and the dynamic behaviour of the fire. This makes the risk analysis larger. For explosion risk,
the CFD method is well established following the NORSOK Z13 standard [5.2]. However, for
fire risk calculations, it is not routinely used.
Annex F discusses the above model types in more detail and provides an in-depth review of
different fire modes currently available.
5.5 Heat transfer
5.5.1 Mechanisms for heat transfer
5.5.1.1 General
Basic heat transfer by radiation, convection and conduction is well covered in the standard text
books (e.g. Incropera and De Witt, 2002 [5.3]). This section concentrates on determination of
heat transfer using the values identified in Table 5.1 through to Table 5.5 for key parameters
measured in intermediate and large scale trials as; previously, these have not been readily
available. This follows on from the approach recommended by the Energy Institute (formerly
the Institute of Petroleum) in assessing the effect of severe fires on pressure vessels (Energy
Institute, 2003) [5.4].
5.5.1.2 Radiation
Radiation from the hot gases and incandescent soot particles is the main mechanism for
transferring heat. For flames with relatively little momentum, e.g. pool fires, radiative transfer to
an impinged object represents at least 80 % of the heat transferred. Even with impinging high
velocity jet fires, radiative heat transfer still represents 50 % to 60 % of the heat load.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 199 of 493
The radiative heat emission process is modelled by assuming that the radiation comes from
the flame surface. The surface emissive power (SEP) of a flame is the heat radiated outwards
per unit surface area of the flame. Generally, a uniform SEP is taken over the whole flame
shape but this a gross simplification of what may happen in practice. For example, in a large
pool fire, the base of the flame may have the relatively high SEP of 180 kW m
-2
whereas the
smoke obscured flames, which may comprise two thirds of the flame shape, may have the
relatively low SEP of 60 kW m
-2
.
If an object is definitely not directly impinged by flame, the radiative heat transfer is given by
Equation 5-12 below.
rad F
q V E = .................................................................................. Equation 5-12
where V
F
is the geometric view factor, E (kW m
-2
) is the surface emissive power of the flames
and is the atmospheric transmissivity.
The view factor is purely a geometrical parameter determining the proportion of radiation
leaving one surface which reaches a second surface. As radiation travels in straight lines, only
those parts of the respective surfaces that can see one another contribute to the value of the
view factor. Analytical expressions for the view factor are available for standard geometries,
e.g. McGuire J H, 1953 [5.5]. For example, pool fires may be represented by tilted cylinders,
jet fires by a conical frustum and fireballs by circular discs through the centre of the fireball.
Numerical integration may be used for more complex geometries where the flame surface is
divided into a series of regular shapes (e.g. triangles or squares) and the view factors for each
of these summed.
Atmospheric attenuation is primarily caused by absorption of radiation by carbon dioxide and
by water vapour and scattering by dust particles. The atmospheric transmissivity over a
specified path length, due to the presence of water vapour and carbon dioxide, can be
calculated from the temperature and relative humidity of the atmosphere provided that the
emission spectrum is known. Usually it is assumed that there is emission at every wave length
(black or grey body). For path lengths of 10 m or less it is usual to take the atmospheric
transmissivity as 1. Expressions of differing complexity are available ranging from those that
just take distance into account to those that also consider water and carbon dioxide
concentration. The following empirical expression can be used, which takes both water vapour
and carbon dioxide concentrations into account:
( ) ( )
( ) ( )
2
2 10 2
2
10 2 10 2
1.006 0.01171 log10 0.02368 log
0.03188 log 0.001164 log
t X H O X H O
X CO X CO
=

+

Equation 5-13
Where
( )
2 h mm
288.651
X H O R d S
T
= ..................................................... Equation 5-14
R
h
is the fractional relative humidity, d is the path length (m), S
mm
is the saturated vapour
pressure of water (mmHg) at atmospheric temperature T (K). This expression assumes that
the flame is 1500 K, which was chosen as an average between that of a propane fire and a
LNG fire. The transmissivity given by this expression at 15 C is illustrated by Figure 5.5.1.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 200 of 493

Figure 5.5.1 - Variation of atmospheric transmissivity with distance at 15 C
The 0.8 transmissivity suggested in Section 5.3.1 corresponds to that at a distance of 25 m at
a relative humidity of 60 %.
As indicated in Section 5.3.1, the radiation to the surroundings may be represented by a point
source model. For a point source model, the radiation received (q
d
, kWm
-2
) at a distance d (m)
is given by:
d 2
4
F m H
q
d

=
&
.............................................................................. Equation 5-15
Generally, the heat of combustion (H, kJ kg
-1
) will be known from the literature (e.g.
Weast [5.6]) and typical values for the fraction (F) of the heat of combustion radiated for six
main fire scenarios considered are given in Section 5.4.2. The mass burning rates ( m& ) for
hydrocarbon pool fires are given in Table 5.3. Slightly higher values are given for C3/C4 and
condensate pool fires if the pool diameter is greater than 5 m. For jet fires, the mass burning
rate is based on the leakage rate and, for QRA, these are generally assumed to be 0.1, 1, 10
or > 30 kg s
-1
. In the case of fireballs, the mass burning rate is based on the total amount of
fuel released divided by a fireball duration calculated using an expression (0.825. mass
0.26
)
based on the mass released.
Application of the two techniques is illustrated using data from the BLEVE of a 2 tonne LPG
tank (Roberts et al., 2000 [5.7]). The relevant data are summarised in Table 5.6 below.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 201 of 493
Table 5.6 - Example LPG BLEVE fireball data
Parameter Value
Heat of combustion
46000 kJ kg
-1

Amount of fuel released 1708 kg
Duration 7 s
Mass burning rate
244 kg s
-1

Fraction of heat of combustion radiated 0.38
Surface emissive power 312 kW m
-2

Fireball diameter 71 m

The full data set indicated that the maximum output from the fireball was at the lift off point.
This situation can be modelled by treating the fireball as a disc through the centre of the
fireball just touching the surface and the target as a vertical receiver (normally it is necessary
to determine both the vertical and the horizontal component of the view factor) on the surface
(see Figure 5.2).

Figure 5.2 - View factor for circular disc with receiver off axis but parallel
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 202 of 493
The view factor is given by, [5.5]:
( ) ( )
2 2 2
2
4 2 2 2 2 2
0.5 1
2
F
y z R
V
R y z R y z

+
=


+ +

.......................... Equation 5-16
Hence, if z = R and y = n.R
2
0.5 1
4
F
n
V
n

=

+

................................................................. Equation 5-17
Table 5.1 provides the data for applying both a solid flame and point source model. Assuming
an atmospheric transmissivity of 1, the results from application of each model are plotted in
Figure 5.3.

Figure 5.3 - Comparison of solid flame and point source model for a fireball
Figure 5.3 suggests that a solid flame model should be used if the object of interest is closer
than two flame widths/lengths from the flame as, at these distances, the receiver cannot see
all of the flame.
The above models are only applicable if there is no direct flame impingement. If the flames are
impinging on an object then the radiation received may be approximated (ignoring reflection
and re-radiation, see Section 5.3.2 for the derivation) by Equation 5-18.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 203 of 493
( )
4 4
rad s f f s
q T T = ................................................................ Equation 5-18
where
f
,
s
are the flame and surface emissivities, is the Stefan-Boltzmann constant
(5.6697 x 10
-8
Wm
-2
K
-4
), and T
f
, T
s
are the flame and object surface temperatures (K).
Section 5.4.2 gives typical values for these coefficients for a range of fire types and sizes.
5.5.1.3 Convection
Heat transfer by convection occurs when there are hot gases flowing over the surface of the
object. Convective heat transfer will always occur to some extent if there is direct flame
impingement and, in these circumstances, at least as much radiative heat transfer will
accompany it. Convective heat transfer can occur without significant radiative heat transfer if a
plume of hot gases is channelled to an object not in direct (or reflected) line of site with the
flames. Heat transfer by convection from impinging flames is represented by Equation 5-19.
( )
conv f s
q h T T = ......................................................................... Equation 5-19
where T
f
and T
s
are the flame and object surface temperatures respectively (K) and h is the
convective heat transfer coefficient (W m
-2
K
-1
). The convective heat transfer coefficient varies
with geometry, boundary layer conditions, gas velocity and temperature. Typical values for the
heat transfer coefficient for a range of types and sizes of fire are given in Section 5.4.2. In
cases where there is convective heat transfer from a hot plume, the plume temperature can be
used in Equation 5-17 instead of the flame temperature if it can be reasonably estimated.
5.5.1.4 Conduction
Heat transfer by conduction is very small compared to the other methods of heat transfer but
needs to be taken into account in some circumstances. One-dimensional heat conduction
under steady state conditions is represented by Equation 5-20 below.
( )
s l
cond
T T
q k
L

= ......................................................................... Equation 5-20


where T
s
is the temperature (K) of the surface exposed to flame, T
l
is the temperature (K) at a
thickness L (m) and k is the thermal conductivity (Wm
-1
K
-1
). The thermal conductivity of carbon
steel is about 45 Wm
-1
K
-1
and hence, even with a fairly large temperature differential, the heat
transmitted is low. Hence, in most circumstances, the heat transmitted by conduction can be
ignored. However, there can be problems through differential heating at the joints between
thick and thin thick-walled structures. The other conditions where conduction is normally taken
into account are where heat is transferred through passive fire protection or through the walls
of a vessel or pipe to a fluid inside.
5.5.1.5 Flame position relative to the receiver
Generally, flames are not static. They will move around in the wind and will vary with the fuel
release rate, amount of back radiation etc. For a pool fire, the wind may tilt the flame towards,
away from or sideways to the receiver. With jet fires, a co-flowing wind will elongate the flames
and a variable crosswind will move the flames from side to side. A fireball will present a
smaller flame area up and down wind compared to the crosswind area. An understanding of
the geometry of the flame is essential in order to apply the heat transfer mechanisms identified
in the previous section.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 204 of 493
Modern, validated empirical and phenomenological models are now available for most of the
standard situations but the user needs to be aware of the limitations and simplifications made
in the model used if the results are to be relied upon. Summaries and comparisons of these
models are available in the standard reference books e.g. Yellow book (1997) [5.8], SFPE
Handbook (2002) [5.9], Lees (2005) [5.10]. Some of these models have been incorporated in
commercially available suites of programmes e.g. Shell Global Solutions FRED and DNVs
PHAST. The following are given as examples:
Carsley (1995) [5.11] has developed a model for predicting the probability of
impingement of jet fires;
Cracknell et al. (1995) [5.12] have developed one for the heat flux on a cylindrical target
due to the impingement of a large-scale natural gas jet fire;
Chamberlain (1995) [5.13] considered the hazards from confined pool fires in offshore
modules.
A feature of most of these models is that the surface emissive power used for a particular
situation will depend on how the flame geometry is modelled for that situation. Hence a model
using a high surface emissive power and relatively low flame area may/should give the same
answer as a model using a relatively low surface emissive power but larger flame area.
Combustion models used in computational fluid dynamics (CFD) have advanced, enabling
more realistic modelling in situations where the fire scenario can be fully described (this is
discussed further in Annex F). However, in preparing a safety case, only general assumptions
are normally made and in practice, CFD would only be used to look at a particular case in
detail when the extent of the safety issues or costs at risk justify it.
In assessing the heat transferred, the key decision is on whether or not the object is impinged
by flame. For the general case, it may be sufficient to apply a safety margin, e.g. 50 %, to the
flame lengths given by a model or the relevant table in Section 5.4.2. If a key structural item is
of particular concern, e.g. a platform support leg, one approach used by industry is to estimate
(using a solid flame model) the distance for 50 kW m
-2
received radiation and assume that
everything within this distance is impinged by flame and that everything outside this distance
only receives radiation.
In practice, the heat transferred to a receiver will depend on whether it is fully, partially or not
enveloped in flame and, in partially or totally enclosed modules, how much re-radiation there is
from walls, ceilings and process plant. Even when there is full engulfment, the situation is still
complicated as the:
Relative proportions of radiative and convective load from a flame will vary depending on
the fuel type and location of the object within the flame.
Total heat loads will vary depending on the fuel type, the size and shape of the object
and the location of the object within the fire:
Particularly with jet fires, the flames can be channelled along and around an object where heat
loads will vary over the surface of the object and the heat absorbed by the object will vary with
time.
Whilst detailed analysis may now be made using CFD and finite element analysis, calculations
for an initial analysis can be readily performed if some of the above factors are simplified.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 205 of 493
As indicated in Section 5.3, the main simplifying assumptions are that:
There are no heat losses;
The flame and receiver surface are considered grey bodies;
The ambient temperature can be neglected; and
In most circumstances, heat conduction can be ignored.
In these circumstances, the heat transferred to the object surface from an impinging flame
may be represented by Equation 5-8.
( ) ( )
4 4
total rad conv s f f s f s
q q q T T h T T = + = + ...................... Equation 5-21
If the object is not impinged by flame (e.g. beyond the 50 kWm
-2
distance) then, ignoring the
hot plume case, the heat transfer is by radiation and the solid flame model (Equation 5-1)
should be applied.
rad f
q V E = ................................................................................ Equation 5-22
If the object is more than two flame widths/lengths away then the point source (Equation 5-3)
or a multipoint source model (where the source is split into a number of zones, each
representing a fraction of the total radiation emitted and each zone represented by a point
source emitting this fraction of the radiation) may be used as an alternative to the solid flame
model. It may be used at closer distances but the results will be very conservative. This may
be acceptable in some situations.
2
4
rad
F m H
q
d

=
&
............................................................................ Equation 5-23
5.5.1.6 Temperature rise
All the equations given above provide the heat flux to the surface of the receiver. The key
requirement is to determine the temperature rise in the item being considered and the time
taken to reach the critical temperature for that particular component. The main situations
considered are:
Unprotected steel;
Fire protected steel;
Pressure vessels (unprotected and protected);
People.
As the heat absorbed is a time dependent process. Mathematical models, particularly finite
difference methods, are available which can undertake these calculations from first principles
or with the input parameters
s
,

,, T
f
and h as determined by the particular model used or as
provided in the tables in Section 5.4.2. Such models may also simultaneously calculate the
heat up of a structure, a vessel or pipe work contents. However, conservative calculations of
heat up can be undertaken on the basis that, at any particular time, steady state conditions
exist.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 206 of 493
5.5.1.7 Unprotected steel
The equations given in FABIG Technical Note 1 [5.14] are still valid. However, those equations
used a section factor (H
p
/A, m
-1
) defined as the heated perimeter (H
p
, m) divided by the steel
cross-sectional area (A, m
2
). ASFP (2002) [5.15] comment that in new European fire testing
and design standards (e.g. ENV 13381-4 2002 [5.16], BS EN 1993-1-2 2005 [5.17] and
BS EN 1994-1-2 [5.18],) the section factor (the unit remains the same, i.e. m
-1
) is defined as
A
steel
/V
steel
(note: the steel subscripts are provided here to avoid confusion with other
parameters) where A
steel
is the surface area of steel exposed to fire per unit length and V
steel
is
the volume of the section per unit length. Using the A
steel
and V
steel
notation, for a fully engulfed
steel member, e.g. an I - beam, the heat up of the steel member is described by Equation 5-24
below.
( ) ( )
4 4
d
d
steel
s f f s f s steel steel
steel
V T
T T h T T C
A t
+ = .................... Equation 5-24
Where C
steel
is the steel heat capacity (Jkg
-1
K
-1
) and
steel
is the steel density (kg m
-3
). A steel
section with a large surface area will receive more heat than one with a smaller surface area
and the greater the volume the greater the heat sink. Hence the lower the section factor the
slower an I - beam will heat up. For an I - beam, the heated perimeter (ASFP still use this in
their examples and data sheets) is calculated as:

Figure 5.4 - I beam heated perimeter
Where B and D are the overall breadth and depth of the section and W is the web thickness. A
comprehensive list of heated perimeter equations for different types of beams, columns etc are
given by ASFP [5.15].
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 207 of 493
For a steel section that is not engulfed in flame, the heat up of the steel member is described
by Equation 5-25 below.
d
d
steel
rad f steel steel
steel
V T
q V E C
A t
= = ............................................... Equation 5-25
In this case, the heated perimeter is the projected area of the member that sees the radiation.
Equation 5-24 and Equation 5-25 can be solved numerically (e.g. by using a spreadsheet with
fixed cell addresses for the constants) by using incremental time steps. An example is given in
Section 5.5.1.9 on pressure vessels.
5.5.1.8 Fire protected steel
The Interim Guidance Notes [5.19] advocate a heated perimeter approach when the steel is
insulated. The equation assuming that the fire protection material has negligible heat capacity
is shown below (Equation 5-26). It is assumed that the insulation surface temperature (T
s
)
rapidly reaches the flame temperature.
( )
steel PFP
s
steel steel steel
A K
dT T T dt
V C L
= .................................................... Equation 5-26
where K
PFP
is the thermal conductivity of the protection material and L the thickness of the
insulation material.
It should be noted that the thermal conductivity and heat capacity of both the steel and the
insulation material will vary with temperature and, for accurate calculations; these would have
to be expressed as parametric equations. The problem is that it is very difficult to obtain a
realistic value for both the thermal conductivity and heat capacity as most forms of passive fire
protection react in a complex way.
Generally, steel may be protected from fire by passive fire protection, which may take the form
of a cladding or a coating (cementitious, vermiculite or intumescent). Summaries of their
properties are reiterated below and should be read in conjunction with further detail in
Section 3.2.8.1, Firewalls and 3.2.8.9 Passive fire protection methods.
1. Inert cladding e.g. ceramic boards, a thin steel panel backed by mineral wool, a removal
jacket or a composite panel. The insulation backed steel panels act as passive insulator
until the insulating materials melts leaving voids. Insulation materials such as rock wool
contain resins that will melt and migrate. Composite panels may comprise a series of
panels of different materials with either air gaps between them or some or all of the gaps
filled with insulating material. In most of these cases, the thermal conductivity needs to
take account of different materials and of internal voids giving rise to internal convection
effects and heat capacity will vary with each material used.
2. Cementitious coatings. These will act as passive insulator with a thermal conductivity
dependent on the amount of water present until the temperature reaches about 100 C.
The temperature will be kept at this until all the chemically and physically bound water
has been driven off. The temperature will then rise with the material again acting as
passive insulator but with a different thermal conductivity. Hence, an overall thermal
conductivity value must account for movement and evaporation of water in a situation
where the total amount of physically bound water is not likely to be known.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 208 of 493
3. An intumescent coating. These react to flames by melting and then swelling to form a
hard char five to ten times thicker than the unreacted material thickness. The char is
gradually eroded away exposing unreacted material, which then reacts to form more
char. Hence the unreacted material is gradually being used and, once it has all been
used, bare steel will be exposed. In this case, the thermal conductivity needs to take
account of the unreacted material and the char and the fact that there are continual
boundary and phase changes.
Not withstanding all the problems identified, the manufacturers will have data from furnace
tests with cellulosic and hydrocarbon heat up curves and will have resistance to jet fire test
data. In general, the manufacturers will use the ASFP (2002) [5.15] method to derive the
thickness of material required to protect against a particular fire scenario or combination of fire
scenarios e.g. jet fire preceding a pool fire. The manufacturers will have performed a series of
furnace tests conducted on structural elements with varying section factors, usually between
50 and 350 m
-1
, to various fire durations and limiting temperatures. The thickness of material
(L) required to provide specific standards of fire resistance e.g. at least 1 hour for a mean
temperature rise of 140 C, is derived by means of the empirical relationship:
0 1 2
steel
resist
steel
V
t a a L a L
A
= + + ............................................................ Equation 5-27
where t
resist
is the fire resistance time (minutes). The furnace tests are chosen to cover the
range of section factors, thicknesses and duration required. The constants, a
0
, a
1
and a
2
,
applicable to each material are determined by multiple linear regressions. Once a satisfactory
correlation has been obtained, the protection thicknesses for a given section factor and
required fire resistance time can be derived using the rearranged equation:
0
1 2
resist
steel
steel
t a
L
V
a a
A

=
+
.......................................................................... Equation 5-28
Generally, interpolation of fire test data is allowed but extrapolation is not. ASFP (2002) [5.15]
give illustrations of how this works with product data sheets based on cellulosic fire curve
furnace tests.
A method of combining the results from furnace and jet fire tests is to compare results from
tests on substrates with similar section factors (usually about 100 m
-1
) and use this to derive
an erosion factor which is added to the value obtained from the expression derived from the
furnace tests. This data can also allow approximate thermal conductivities and heat capacities
to be determined but they will be product specific and the manufacturers of the products being
considered should be consulted.
5.5.1.9 Pressure vessels
There are many different processes occurring when a flame interacts with a pressure vessel
due to the complex behaviour of the flame, the vessel and the vessel contents. API has
considered the requirements for pressure relief valves (API 520, 1997) [5.21] and emergency
depressurisation systems (ISO 23251:2006, 2005) [5.20] and these are considered in
Section 7.7 discussing relieving and other process responses. However, API only considers
relatively small hydrocarbon pool fires and, if it is a realistic fire scenario, a pressure vessel is
much more likely to fail in a jet fire. This was reviewed by Roberts et al. (2000) [5.22] and the
Institute of Petroleum (2003) [5.4] have published guidance on the effects of severe fires on
pressure vessels and Scandpower (2004) [5.23] have considered this in regard to emergency
depressurisation.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 209 of 493
The key processes occurring during jet-fire impingement on pressure vessels include:
Heat transfer between the fire and outer surface of the vessel, in the vapour and liquid
'zones', by radiation and convection;
Heat transfer through the vessel walls by conduction. The wall may comprise of an outer
passive fire protection (PFP) coating plus the underlying steel wall;
Heat transfer into the vessel fluids by predominantly radiation in the vapour space, and
by natural convection or nucleate boiling in the liquid phase;
Mass transfer from the bulk liquid or vapour to the outside environment through any holes
in the vessel;
Mass transfer out of the vessel through any open or partially open pressure safety valves
(PSVs);
Mass transfer within the liquid phase by flow of heated fluid into a stratified 'hot' layer
lying above the bulk liquid. The hot layer may or may not be stable;
Mass transfer between the liquid and vapour phases by evaporation;
Pressure, enthalpy and composition changes (e.g. relative fractions of mixed
hydrocarbons in a separator) in the fluids during each of the above processes;
Catastrophic vessel failure resulting in a possible BLEVE.
The heat transfer processes described above are shown schematically in Figure 5.5.

Figure 5.5 - Heat and mass transfer
Various models have been proposed that take these factors into account although few have
been fully validated. Persaud et al. (2001) [5.24] have applied the Shell HEATUP model to the
heat up and failure of LPG tanks. They give equations for all the physics describing heat and
mass transfer processes and predict vessel failure by comparing the hoop stress with the
ultimate tensile strength of steel.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 210 of 493
In practice, when a fire impinges on a vessel containing liquid, the wall in contact with vapour
will heat up very quickly and the wall in contact with liquid will stay at a relatively low
temperature unless film boiling occurs. In flashing liquid propane jet fire trials on unprotected
2 tonne LPG tanks (Roberts et al., 2000) [5.25] the vapour wall reached up to 870 C on failure
whilst the wall in contact with liquid did not exceed 230 C.
5.5.1.10 Vessel walls
LPG trials indicate that the prime cause of failure, at least for relatively thin walled vessels,
was heating the wall in contact with vapour to a temperature where the steel weakened rather
than due to over pressurisation although over pressurisation will be an important factor if a
vessel becomes hydraulically full. Gayton and Murphy (1995) [5.26] also suggest that time to
metal plate rupture is used in depressurisation system design. On this basis, a conservative
estimate can be made of the time to failure by ignoring the heat transfer to the contents. As
indicated above, the iterative process for solving the time dependent heat transfer equations is
illustrated for the vessel vapour wall case.
In a time step t, the object will heat up by T given by:
0

steel steel
t q
T
C L
= .......................................................................... Equation 5-29
where the initial heat absorbed by the wall (ignoring heat losses to the contents) is given by
Equation 5-30 below.
( ) ( )
4 4
0 s f f 0 f 0
q T T h T T = + .................................................. Equation 5-30
At time t
1
= t
0
+ t, the surface temperature will be T
1
= T
0
+ T, where T
0
is the initial surface
temperature.
Using the new T
1
and substituting into Equation 5-30, then the heat absorbed at time t
1
is,
( ) ( )
4 4
1 s f f 1 f 1
q T T h T T = + .................................................. Equation 5-31
So, in general, at time ti, the thermal flux absorbed by the object is given by:
( ) ( )
4 4
s f f i f i i
q T T h T T = + ................................................... Equation 5-32
and the temperature of the object will increase to Ti+1 = Ti + Ti where
i
i
steel steel

t q
T
C L
= .......................................................................... Equation 5-33
In order to illustrate the conservatism of the data in Section 5.4.2, both trials data and data
derived from Table 5.1 are given below in Table 5.7.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 211 of 493
Table 5.7 - Data for calculation of LPG tank failure
Parameter
Flashing liquid
fires
1 kg s
-1

(From Table 5.1)
Trials
data
Total incident flux (kWm
-2
) 230 170
Radiative flux (kWm
-2
) 160 110
Convective flux (kWm
-2
) 70 60
Emissivity of flame
f
1.0 0.8
Emissivity of steel
s
0.8 0.8
Temperature of flame, T
f
(K) 1300 1320
Heat transfer coefficient, h (Wm
-2
K
-1
) 70 60
Stefan-Boltzman constant, (Wm
-2
K
-4
) 5.67 x 10
-8
5.67 x 10
-8

Wall thickness, L (m) 0.0071 0.0071
Density of steel, (kg m
-3
) 7850 7850
Heat capacity of steel, C (J kg
-1
K
-1
) 520 520

The predicted rise in wall temperature, for an initial temperature of 20 C, is illustrated in
Figure 5.6. The measured times to failure and maximum wall temperatures (all at positions in
contact with vapour) for each degree of fill are summarised in Table 5.8, the same failure
points also shown in Figure 5.6.
Table 5.8 - LPG tank failure data
Degree of fill
of 2 tonne tank
(%)
Time to
failure
(s)
Maximum wall
temperature at failure
(Celsius)
Pressure at
failure
(barg)
20 250 870 16.5
41 286 704 21.3
60 217 821 18.6
85 254 848 24.4

FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 212 of 493
Heat up times
0
200
400
600
800
1000
1200
0 60 120 180 240 300
Time (s)
W
a
l
l

t
e
m
p
e
r
a
t
u
r
e

(
o
C
)
Flashing liquid jet fire data
Trials data
Failure data

Figure 5.6 - Comparison of heat up time with LPG failure times and temperatures
A comparison can also be made with data for an unwetted 25.4 mm plate, which .gives
12 minutes to reach 593 C. Use of the small hydrocarbon pool fire data in Table 5.3, gives
about 11 minutes as the time; (the data quoted above are based on calculations from a
gasoline trial with a 0.125 plate).
5.5.1.11 Vessel contents
More discussion of the response of process systems including pressure vessels is considered
further in Section 7.7. As indicated above, the actual heat transfer processes are very
complex. Traditionally, the API approach has been used to calculate the heat transfer to a
vessel contents. For vessels containing only gas, vapour or super-critical fluid the vessel wall
is considered to be unwetted and the heat transfer to the contents is not directly calculated.
For vessels containing liquid, the approach is based on the heat transfer to the wetted surface
of vessels up to a height of 7.6 m; as only relatively small hydrocarbon pool fires are
considered. Two expressions are given; one (Equation 5-34) where adequate drainage and
fire fighting equipment exists and one (Equation 5-35) where it does not.
0.82
absorb
43200 Q F A = .................................................................. Equation 5-34
0.82
absorb
70900 Q F A = .................................................................. Equation 5-35
where Q
absorb
is the total heat absorbed (W), F is an environment factor and A is the total
wetted surface area (m
2
). The expression A
0.82
is an area exposure factor which recognises
that large vessels are less likely than small ones to be completely exposed to the flame of an
open fire. In the likely confinement offshore, it would be more appropriate to use A rather than
A
0.82
. The environment factors are given in Table 5.9.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 213 of 493
Table 5.9 - ISO 23251:2006 environment factors
Type of equipment Environment factor (F)
Bare vessel 1.000
Water deluge protected vessel 1.000
Depressurising and emptying facilities 1.000
Insulated (conductance 22.71 kWm
-2
K
-1
) vessel
0.300
Insulated (conductance 11.36 kWm
-2
K
-1
) vessel
0.150
Insulated (conductance 5.68 kWm
-2
K
-1
) vessel
0.075
Insulated (conductance 3.80 kWm
-2
K
-1
) vessel
0.050
Insulated (conductance 2.84 kWm
-2
K
-1
) vessel
0.038
Insulated (conductance 2.27 kWm
-2
K
-1
) vessel
0.030
Insulated (conductance 1.87 kWm
-2
K
-1
) vessel
0.026

Note that credit is only given for insulated vessels. API now makes it clear that the insulation
must be passive fire protection but the requirement is that the insulation material should
function effectively up to 904 C. As is recognised by API, their approach is not suitable if the
fire scenario identified is more severe than a 110 kW m
-2
, that is, it is not suitable for a jet fire
or a confined hydrocarbon pool fire.
Hekkelstrand and Skulstad (2004) [5.27] consider slightly higher heat fluxes than API. They
consider small to medium size fires on the basis that the aim is to prevent escalation to a large
fire. Two figures are given for the incident heat fluxes from fuel-controlled fires. The local peak
heat load is used to calculate the rise in steel temperature and global average heat load is
used to calculate the pressure profile. Their incident heat fluxes for jet and pool fires are
summarised in Table 5.10.
Table 5.10 - Global and local peak loads
Jet fire
Heat load
Leak rate
> 2 kgs
-1

Leak rate*
> 0.1 kgs
-1

Pool
fire
Local peak
(kWm
-2
)
350 250 150
Global
average
(kWm
-2
)
100 0 100
* This calculation is
for an object close
to the fire.


Various rules are given for the application of these values and the original publication [5.27]
should be consulted before using the values given.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 214 of 493
5.5.1.12 Effect of fire protection on heat transfer to vessels
Directed water deluge
No credit is given for directed deluge systems in ISO 23251:2006 [5.20] as the reliability of
water application is uncertain because of freezing weather, high winds, clogged systems,
unreliable water supply and vessel surface conditions that can prevent uniform water
coverage. However, it is suggested that systems designed to NFPA 15 [5.28] can be effective.
NFPA specifies an application rate of 12 l m
-2
min
-1
. This is derived from small-scale pool fire
trials where the application rate is taken as the amount of water leaving the nozzles divided by
the vessel surface area. The NFPA requirements for nozzle spacing and spray angle are very
general. In practice, it is the amount of water flowing over the surface of the vessel, which has
the greatest influence on fire resistance. As only between 35 % and 45 % of the water leaving
the nozzles actually forms a film on the vessel surface, a poorly designed system delivering
the minimum requirement of 12 l m
-2
min
-1
may not even fully protect against a pool fire.
Although the application requirement of 10 l m
-2
min
-1
in the FOC tentative rules (1979) [5.29] is
lower than the NFPA requirement, systems designed to the latter standard will, in general,
apply more water to the surface of the vessel as there is a more detailed specification of the
nozzle spacing (longitudinal and stand-off from the surface), numbers of rows of nozzles and
spray angle relative to the size of vessel.
There has been considerable interest in the use of directed deluge in protecting against jet
fires. Shirvill and White (1992) [5.30] have shown that deluge systems with the usual medium
velocity nozzles are not effective in protecting against natural gas jet fires. Lev (1995) [5.31]
has suggested that it may be possible with systems using high velocity nozzles and Shirvill
and White suggest it may be possible with high velocity water monitors. Shirvill (2004) [5.32]
has shown that a system delivering about 17 l m
-2
min
-1
is not effective in fully protecting
vessels (keeping the wall temperature to 100 C

or less) against 2 to 10 kg s
-1
flashing liquid
propane and butane jet fires. Roberts et al. have shown that about 30 l m
-2
min
-1
will protect
2 tonne vessels against 2 kg s
-1
flashing liquid propane jet fires. Hankinson and Lowesmith
(2003) [5.33] have looked at the effectiveness of area and directed deluge in protecting
against live jet fires and all these recent results are summarised in a special edition of the
Journal of Loss Prevention in the Process industries (March, 2003) [5.34]. Even though a
directed deluge system may not be fully effective (primarily in protecting the unwetted wall) in
protecting against flashing liquid propane and butane jet fires, Shirvill [5.32] suggested that the
overall rate of heat transfer is reduced by 50 %. This is consistent with results (Roberts, 2003)
[5.35, 5.36 and 5.37] from 20 % filled LPG tanks.
Passive fire protection
Roberts and Moodie (1989) [5.38] have shown that a range of fire protection materials are
suitable for protecting LPG tanks against hydrocarbon pool fires. As indicated previously, API
[5.21] takes reduced heat input into account by the use of environment factors. These
environment factors are calculated using Equation 5-36.
( )
PFP relief
904
66570
k T
F
L

= .................................................................. Equation 5-36


where k
PFP
is the thermal conductivity (Wm
-1
K
-1
) of the PFP, T
relief
the temperature (C) of the
vessel contents at relieving conditions and L is the thickness (m) of the insulation. API
provides thermal conductivities for a range of materials but these may only be strictly
applicable to hydrocarbon pool fires.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 215 of 493
In general, PFP materials that have successfully passed a test illustrating resistance to jet fire
by meeting the required time to critical temperature (Jet Fire Working Group, 1995) [5.39] will
be suitable for protecting pressure vessels against jet fires. At present, there appear to be no
standardised criteria for the protection of pressure vessels. LPGA [5.40] suggest that
90 minutes to reach 300 C (the temperature at which carbon steel starts to lose its strength)
is suitable for LPG vessels. Higher temperature criteria may be suitable for thicker walled
(> 12 mm) vessels and for vessels made from steel alloys, which maintain their strength to
higher temperatures.
5.5.1.13 People
The response of people to fires is considered in Section 7.8. Hymes et al. (1996) [5.41] have
considered the physiological and pathological effects of thermal radiation and relate these to a
thermal dose (note: dosage is usually taken as irradiation x time).
The thermal dose T
L
(s (W m
-2
)
4/3
10
-4
) is given by:
( )
4
4
3
L rad
10 T t q

= ........................................................................ Equation 5-37
where t is the exposure time (s), q
rad
the radiation (Wm
-2
) received and 10
-4
a convenient
scaling factor. The radiation received should be calculated from either the solid flame model, if
close to the fire, or the point source model if more than two flame widths/lengths away from
the source.
From a major hazard perspective, there are two issues:
1. How long can a worker continue to operate in an emergency system whilst exposed to a
given level of radiation?
2. What fraction of the population will die or sustain injury given exposure to a certain dose of
radiation?
In regard to the former, API [5.21] provides permissible design thermal radiation levels for
personnel. These are given in Table 5.11 below (Note: ISO 23251:2006 [5.20] should be
consulted to consider these in the context - disposal by flaring - in which they are given).
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 216 of 493
Table 5.11 - ISO 23251:2006 permissible radiation design levels
Permissible
design level
(kWm
-2
)
Conditions
9.46
Maximum radiant heat intensity at any location where urgent emergency action by
personnel is required. When personnel enter or work in an area with the potential for
radiant heat intensity greater than 6.31 kW m
-2
, then radiation shielding and/or
special protective apparel (e.g. a fire approach suit) should be considered
a

6.31
Maximum radiant heat intensity in areas where emergency actions lasting up to 30 s
may be required by personnel without shielding but with appropriate clothing
b

4.73
Maximum radiant heat intensity in areas where emergency actions lasting 2 to
3 minutes may be required by personnel without shielding but with appropriate
clothing
b

1.58
Maximum radiant heat intensity at any location where personnel with appropriate
clothing
b
may be continuously exposed.
Superscript notes:
It is important to recognise that personnel with appropriate clothing
b
cannot tolerate thermal
radiation at 6.31 kW m
-2
for more than a few seconds.
Appropriate clothing consists of hard hat, long-sleeved shirts with cuffs buttoned, work gloves,
long-legged pants and work shoes. Appropriate clothing minimises direct skin exposure to
thermal radiation.
The lethality to the population is usually addressed by probit or logit analysis. The two
commonly used probit relations for fatality are:
Eisenberg (based on nuclear bomb data) ........... ( ) 14.9 2.56ln Y X = + Equation 5-38
Where
4 3
rad
X t q =
Lees (valid up to 70% mortality) ......................... ( ) 10.7 1.99ln
X
Y Z = + Equation 5-39
where Z
X
is a function of X depending on whether clothing ignites.
Hymes et al. [5.41] gives doses for probability of 1 % and 50 % lethality as 1050 s(W m
-2
)
4/3
10
-
4
and 2300 s (W m
-2
)
4/3
10
-4
respectively. These correspond to a radiation dose of 8.6 kW m
-2

for 1 minute or 2.6 kW m
-2
for 5 minutes for 1 % lethality and 15.4 kW m
-2
for 5 minutes for
50 % lethality.
More details on using these and other methods are given by Lees et al. (1996) [5.42]. The
response of personnel is considered further in Section 7.8.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 217 of 493
6 Derivation of explosion loads
6.1 Introduction to explosion load determination
6.1.1 General
This Chapter is based on the basis documents developed during the generation of this
Guidance [6.1, 6.2, 6.3] and describes the process of derivation of explosion loads. These
basis documents contain more detailed information.
Gas explosions can be defined as the combustion of a premixed gas cloud containing fuel and
an oxidiser that can result in a rapid rise in pressure. Gas explosions can occur in enclosed
volumes such as industrial process equipment or pipes and in more open areas such as
ventilated offshore modules or onshore process areas [6.4].
For an explosion to occur a gas cloud with a concentration between the Upper Flammability
Limit (UFL) and Lower Flammability Limit (LFL) must be ignited. The overpressure caused by
the explosion will depend, amongst other things, on:
The gas or gas mixture present
The cloud volume and concentration
Ignition source type and location
The confinement or venting surrounding the gas cloud
The congestion or obstacles within the cloud (size, shape, number, location)
For stoichiometric hydrocarbon gas clouds, filling a closed volume initially at atmospheric
pressure, combustion without heat loss will result in overpressures of close to 8 barg. This
pressure rise is mainly due to the temperature rise caused by the combustion process and is
generally not dependent on the congestion within the volume. This type of explosion is
referred to as confined. A stoichiometric air/fuel mixture is such that it contains exactly the
required amount of oxygen to completely consume the fuel.
Gas explosions in more open environments can also lead to significant overpressures
depending on the rate of combustion and the mode of flame propagation in the cloud. All of the
above points can affect the explosion overpressures in this type of environment.
If the rate of volume generation within the explosive region is greater than the ability of the
vents to release this volume then the overpressure will continue to rise.
Two types of explosion can be identified depending on the flame propagation rate:
1. A deflagration is propagated by the conduction and diffusion of heat. It develops by
feedback with the expansion flow. The disturbance is subsonic relative to the un-burnt gas
immediately ahead of the wave. Typical flame speeds range from 1-1000 ms
-1
and
overpressures may reach values of several bars. The overpressures are not limited to the
8 barg maximum typical of completely confined explosions.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 218 of 493
2. A detonation is propagated by a shock that compresses the flammable mixture to a state
where it is beyond its auto-ignition temperature. The combustion wave travels at
supersonic velocity relative to the un-burnt gas immediately ahead of the flame. The shock
wave and combustion wave are coupled and in a gas-air cloud the detonation wave will
typically propagate at 1500-2000 ms
-1
and result in overpressures of 15-20 barg.
Most vapour cloud explosions offshore would fall into the category of deflagrations.
In an environment typical of gas explosions on offshore platforms the gas cloud engulfs many
obstacles including equipment, piping, structure etc, often referred to as congestion. It is also
usually confined by a number of solid planes such as plated decks, blast walls, equipment
rooms etc. The explosion typically starts as a slow laminar flame ignited by a weak ignition
source such as a spark. As the gas mixture burns, hot combustion products are created that
expand to approximately the surrounding pressure. As the surrounding mixture flows past the
obstacles within the gas cloud turbulence is created. This turbulence increases the flame
surface area and the combustion rate. This further increases the velocity and turbulence in the
flow field ahead of the flame potentially leading to a strong positive feedback mechanism for
flame acceleration and high explosion overpressures. The behaviour of the explosion will be
influenced by both the degree of confinement and the congestion within the combustion
region.
6.1.2 Dynamic pressures and overpressures
Gas explosions can generate both high overpressure and high-speed gas flows as a result of
the gas combustion process.
Large components of the structure such as solid decks or walls experience loads due to the
pressure differences on opposite sides of the structure. Typically within an explosion there will
be a strong variation of the spatial and temporal pressure distribution. There will typically be
localised high regions of overpressure with lower values of average pressure acting on large
components. The overpressure at a location within a gas explosion will typically rise to a peak
value and then fall to a sub atmospheric value before returning to zero overpressure. The
duration of the positive phase in an explosion can vary greatly with shorter durations
associated with higher overpressure explosions. Typical durations range from 50 to 200 ms.
For smaller objects such as piping the overpressures applied to the front and reverse side of
such items will be of approximately the same magnitude at any moment in time and in this
case the overpressure will not apply any net load to the object. For this type of object the
dynamic pressure associated with the gas flow in the explosion will dominate the applied
loads.
Methods for calculating loads acting on intermediate sized objects such as large vessels are
described in Section 6.11.3.
6.1.3 External explosions
Secondary or external explosions may result as vented unburnt fuel/air mixture comes into
contact with the external (oxygen rich) atmosphere. As the flame front progresses outside the
compartment, an external explosion may occur, which may distort the pressure time history
and result in double peaked pressure traces inside and outside the compartment. This may
have consequences for the escape ways and may give rise to a blast wave which may
impinge on neighbouring structures, and in particularly the TR.
Further descriptions of the external explosion phenomenon are available [6.5].
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 219 of 493
6.1.4 Far field effects
Following a gas explosion that generates significant overpressures, a pressure pulse will
propagate into the surrounding atmosphere. The convection in the flow will tend to make
pressure disturbances at the back of the pulse catch up with those at the leading edge of the
pulse. This has the effect of decreasing the duration of the positive part of the pulse and
causes a faster rate of increase of the leading pressure wave. A blast wave with near zero rise
time will then develop. Often this wave has zero net impulse as it travels away from the
explosion. Simple methods exist for calculating the form of this blast wave and its effects on
targets in its path [6.6, 6.7]. Some are taken from military and nuclear codes.
The peak overpressure in this blast wave will then decrease with distance while the blast wave
duration will typically increase and as a result the impulse will decrease more slowly than the
overpressure. The blast wave will be affected by other confining objects such as decks, blast
walls and accommodation blocks that will result in reflection and diffraction of the blast wave.
This may affect the decay of the blast wave and in some cases can increase local
overpressures where a blast wave is reflected from a surface or object. The received pressure
on a flat surface may be greater than that in the incident blast wave. At pressure levels typical
of a blast wave generated by a hydrocarbon explosion, this received pressure may be up to
twice the incident pressure, a process which is referred to as pressure doubling.
6.2 Tasks for the determination of explosion loads
As described in Sections 2.8.4, 2.8.5 2.8.6 there are suggested approaches by level of
sophistication.
The category of the installation does not preclude the use of more sophisticated methods of
assessment which may result in reduced conservatism and potentially reduced cost. The
treatment in this section concentrates on higher risk methodology techniques with
simplifications for the low risk methodology suggested for each of the tasks described.
An explosion assessment is performed in the following steps, for the earlier steps, the reader
will note the similarity for preparing for a fire risk assessment.
1. A hole of a given size is assumed to be present in a vessel, piping or riser, leading to a
gas or spray release. Immediate ignition is assumed not to occur [6.8].
2. The time history of the release rate is calculated. The probability of the occurrence of
the release may be estimated from published failure statistics or even from simulation.
3. A dispersion analysis will predict how the gas or vapour cloud develops and disperses
under wind and ventilation conditions. Part of this cloud will be within the explosive
concentration limits of the gas/air mixture.
4. An ignition source within the explosive part of the gas cloud is then assumed to ignite
the local fuel/air mix causing expansion resulting from combustion in the region
surrounding the ignition point [6.8].
5. Explosion loading software is then used to calculate how the flame front accelerates
through the surrounding environment. Interaction with obstacles gives rise to increased
turbulence, flame folding, increased flame area, increasing overpressures and
increasing gas velocities within and outside the gas cloud.
6. Overpressures may then be calculated for any barriers in the vicinity.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 220 of 493
7. Fuel/air particle velocities are also calculated to determine dynamic pressures or drag
loads on any structural members, piping or vessels in the vicinity.
8. Small objects may be picked up during the explosion, creating secondary projectiles.
The peak energy for typical projectiles may be calculated from the dynamic pressure
load time history and their mass.
9. Secondary, external explosions may result as the unburnt fuel/air mixture comes into
contact with the external (oxygen rich) atmosphere.
10. The explosion loads on piping and equipment may result in further releases with
consequent fires or explosions.
11. A blast wave will propagate away from the explosion region and impinge on adjacent
structures.
This section deals with tasks 3 to 11, effectively the Consequence Analysis.
It is unlikely that the SCEs will withstand a worst case explosion scenario defined as that
scenario which considers a maximum stoichiometric cloud filling the compartment or engulfing
the installation ignited at the worst position. Design explosion loads with a known probability
must then be derived, which the structure and other SCEs must resist. A method is discussed
which uses exceedance curves for representative peak overpressures for the
compartment/installation. This is discussed in Section 6.10 on the generation of exceedance
curves and Section 8.5.2 on the classification of SCEs for explosion response assessment.
In order to provide some measure of asset protection as well as protecting life and the
environment two levels of explosion should be considered, the strength level blast (SLB) and
the ductility level blast (DLB).
6.3 Determination of explosion frequency
The main reason for using a probabilistic assessment method is to derive relationships for the
probability of exceedance of a given explosion parameter such as overpressure or dynamic
pressure at a specified location or in a specified region. This enables the range of scenarios to
be compared with their probability of occurrence leading to the definition of design explosion
loads which can and must be designed against. Some possible methods of deriving
exceedance curves are described in Section 6.10 and the Century Dynamics basis document
[6.1].
The first step in the compilation of a frequency versus overpressure curve is the determination
of overall explosion frequency. This can be achieved by standard means used in Fire Risk
Analysis (FRA) using the following steps:
1. Select representative leak sizes
2. Determine leak frequencies from equipment item counts and generic release frequency
data per item
3. Calculate representative release rates based on release size, composition and
pressure
4. Calculate ignition frequency, dependent on release rate or the rate of generation of
new flammable volume
5. Determine proportion of ignitions for which explosions occur (delayed ignitions).
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 221 of 493
The above steps are familiar to most safety practitioners and who will use generic data
collected from past hazard events in the UK petrochemical industry [6.9, 6.10,6.11, 6.12, 6.13,
6.14]. There is no specific guidance on the above process; companies undertaking QRA tend
to have their own individual procedures. The following table however gives an indication of
where the data can be located.
Table 6.1 - Release and ignition data sources
Item Possible data source
Release Sizes Selected to a give spread of potential consequences (from low release rate
long duration to high release rate short duration).
A typical spread might be:
3 mm representing small releases (0-6.5 mm)
10 mm representing medium releases (6.5-20 mm)
30 mm representing large releases (20-60 mm)
100 mm representing catastrophic releases (>60 mm)
(Optional) Full bore if significantly different consequence from
100 mm
Leak frequency data Accident statistics for fixed offshore units on the UK continental shelf
[6.13], the WOAD database [6.10], OREDA [6.12] and the UKOOA release
statistics review [6.14].
Leak Rate Calculated from release size, inventory pressure and gas properties [6.15].
Ignition frequency Accident statistics for fixed offshore units on the UK continental shelf [6.13]
or Classification of Hazardous Locations [6.16].
Proportion of ignitions
giving explosion
Classification of Hazardous Locations [6.16]].
The weak points in the estimation are the variability of gas cloud size with ventilation and
environmental conditions and the choice of ignition time and location. A Monte Carlo approach
may be used to explicitly represent the variability of these and other parameters. Usually a
phenomenological method of calculation of overpressures is used in view of the large number
of simulations necessary. The increased accuracy in the representation of frequency and
consequence variability will offset the reduced accuracy in load determination in the
determination of explosion risk.
6.4 Dispersion
6.4.1 General
Once the release rate and frequency has been determined then the dispersion characteristics
of the gas cloud, vapour cloud or liquid spray release must be calculated. This may include a
time history of the clouds extent and the identification of the likely ignition sources in the
flammable range.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 222 of 493
Three main methods are discussed in this document for the determination of the extent of the
gas cloud after a release. They are the direct CFD method whereby the cloud evolution is
tracked through time, the workbook approach developed in the JIP on Gas build up from high
pressure natural gas releases in naturally ventilated offshore modules [6.18], and the
simplified method is given in the Explosion Handbook, [6.19]. Other approaches include the
zonal and Shell DICE methods.
The direct CFD method has the advantage that ignition sources and their position in the gas
cloud may be modeled with the effect of wind speed and direction being represented. The
software used for the dispersion simulations may be the same as that used for the explosion
simulation itself. The disadvantage is that at present these simulations do take some time to
perform in view of the long time scale of the dispersion process as compared with the
explosion simulation. This approach is discussed further in the section on the NORSOK
procedure Section 6.13.
6.4.2 Workbook approach for calculation of gas cloud size
Cleaver [6.20] describes an investigation of gas build up in naturally ventilated offshore
modules following high-pressure releases. This work was based on an experimental program
of 66 experiments in the full size Spadeadam test rig. The objective of these experiments was
to investigate the effects on the dispersion process of release location, orientation, pressure
and diameter as well as module perimeter confinement and the wind driven ventilation rate.
The majority of the releases were at a constant rate of between 0.5 to 10 kg s
-1
but the effects
of declining release rates were also considered. Gas concentration during the gas release
event was recorded at up to 200 locations within the rig. A correlation for the flammable
volume of gas within the rig (between 5 and 15 % concentration) was derived based on simple
experiments and dimensional considerations. A plot of an upper bound estimate of the fraction
of the module filled with flammable gas against the non-dimensional parameter R is given
below:
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 223 of 493

Figure 6.1 - Non-dimensional flammable volume vs. release parameter [6.18]
The Release parameter R is defined as:
R= (dm/dt) / (
s

V
U L
2
)
Where: dm/dt = mass flow rate of gas released into module (kg s
-1
)

s
= The density of the released gas
U
v
= The average ventilation velocity in the module before the gas is released
(m s
-1
)
L = cube root of the module volume
It was generally found that greater confinement gave lower ventilation rates and larger
flammable cloud volumes, however, it should be noted that the larger rate releases
themselves changed the ventilation flow within the test rig.
In reference [6.18] this approach is extended to a workbook form. This requires the separate
determination of the ventilation flow rate through a confined and congested region and the
determination of the flammable gas cloud volume. Two estimates of the flammable volume are
made:
A upper but realistic estimate of the flammable volume that a given release would produce
for use at the screening stage
A mid-range estimate of a typical flammable volume that a release will produce to give a
best estimate of the likely outcome.
The flow through the module is characterised by a representative ventilation velocity that is
assumed to be related to the external wind velocity. Four generic module layouts are referred
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 224 of 493
to specific details are not described. The normalised volume of the flammable gas cloud is
also defined by a non-dimensional relationship. Finally, a relationship for flammable gas
volume between two given concentrations is given. It is stated that the workbook could be
combined with accidental release rate/frequency data held by regulatory authorities.
6.4.3 Explosion Handbook approach
A further simple method of calculating gas accumulation in a module is described in the
Explosion Handbook by Czujko [6.19]:
3600
n Ventilatio
Leak
Module
Vent
g
R
R
L
L
M =
Where: M
g
= Mass of gas in the process area (kg)
L
Vent
= Distance to module vent of end of congested area (m)
L
Module
= Length of module (m)
R
Leak
= Gas leak rate (kg s
-1
)
R
Ventilation
= Ventilation rate in air changes per hour
It is stated that this simple model will often give a good estimate of the amount of gas within
the module, provided that the ventilation flow field is close to uniform. For more complex flow
fields the model uncertainty increases.
6.4.4 Equivalent Stoichiometric Clouds
At the current time it is not recommended to directly use dispersed non-homogenous and
turbulent gas clouds in CFD or phenomenological explosion simulations due to a lack of
testing/validation and therefore there is a lack of confidence in the codes for this application
[6.19]. Instead an equivalent quiescent stoichiometric gas cloud intended to give
overpressures similar to the non-homogenous and strongly turbulent clouds ignited in some
full scale tests should be used. Three methods for the conversion of dispersed clouds into
equivalent stoichiometric clouds are summarised in this section.
Hansen [6.21] describes a parameter called Q5 that is calculated during FLACS dispersion
simulations. To calculate the Q5 parameter the mass of gas at non-stoichiometric
concentrations is multiplied by the burning velocity and the volume expansion ratio at the
concentration, both normalised to that for a stoichiometric mixture. This process calculates the
total mass of gas in the equivalent stoichiometric gas cloud. The filters used in this process
are shown in Figure 4, on page 10 of this reference [6.21]. It is also stated that for very
confined modules the burning rate filter becomes less important and in the case of a fully
closed vessel, only the volume expansion filter should be used.
Pappas [6.22] describes how the complex shape of a dispersed cloud can be represented
using a cubic cloud typically extending from floor to ceiling in the module of interest. It is stated
[6.18] that this method will generally give pressures of similar strength for the equivalent
quiescent clouds as for the non-homogenous and strongly turbulent clouds ignited in full-scale
tests. It is also stated that the explosion overpressure durations may be shorter than for the
non-stoichiometric clouds that may in turn affect the structural response.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 225 of 493
In the full-scale dispersion and explosion tests conducted in Phase 3b [6.23] Advantica
proposed an alternative method for calculating a stoichiometric gas cloud volume equivalent to
the dispersed cloud in an experiment. This was used to generate an equivalent volume based
on the dispersed clouds with results from partial stoichiometric fills of the test rig.
For non-stoichiometric concentrations a weighting proportional to the square of the product of
the laminar burning velocity times the expansion ratio, both normalised to a stoichiometric
concentration was used. This method was proposed for data evaluation purposes. It has not
been validated as a methodology for general use.
A curve relating the likely overpressure to the fraction of the module filled with a gas cloud
normalised to the fully filled case was derived. For fill fractions above 80 % the explosion
overpressures are predicted to be as high as those with a stoichiometric cloud completely
filling the test rig. The experimental data and a possible curve fit to it are shown in Figure 6.2.
It is suggested [6.19] that a simple straight line could be added to this figure to form an upper
bound for the likely overpressures at small fractional equivalent stoichiometric fill volumes.

Figure 6.2 - Normalised overpressure vs. equivalent stoichiometric fill fraction
Data are shown for each large-scale realistic release experiment. The data and correlation for
the idealised partial fill experiments are also shown [6.24].
The process of the representation of a dispersed gas cloud of varying concentration as an
equivalent stoichiometric cloud is considered by Advantica to introduce uncertainties in the
chain of calculations leading to the calculation of the explosion loads. This has a bearing on
the accuracy of the overall process and whether high levels of detail in other parts of the chain
are needed or can be justified.
It is hoped that this process can be improved or that the CFD/phenomenological codes may be
validated against experiment for the case of varying density within the gas cloud.
6.5 Ignition
6.5.1 General
The probability of the occurrence of a detectable overpressure being developed Pr
expl
is the
product of the probability of the release Pr
rel
and the probability of delayed ignition Pr
ign
.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 226 of 493
The estimation of probability of ignition and the time to ignition are key aspects of the risk
assessments presented in the Safety Case. There has been limited information available but
at the time of compiling the Guidance, recent published information has been made available
[6.25].
6.5.2 Estimation of delayed ignition probability Pr
ign

Delayed ignition of a gas cloud implies that the resultant combustion would produce
overpressure effects and can be characterised as an explosion. An overpressure will result
from the ignition of an accumulation of mixed air and fuel. This may occur during ignition of a
jet fire and may then escalate to a fire ball. A significant overpressure is defined in this
Guidance as above 50 mbar and may serve to provide a workable definition of an explosion.
50 mbar is the commonly accepted lower limit for the opening of pressure relief panels.
The IP review [6.25] of the estimation of ignition probability and noted that adopting generic
correlations for the probability of ignition based on the mass release rate was overly simplistic
and potentially overly conservative. The correlations have been developed to support the use
of ignition probability calculations in QRAs. A model workbook and look-up correlations have
been provided.
The report reviews a range of sources of ignition probability data and benchmarks against
collected incident and reported data. The review looks at linkages with dispersion and
fractional module fill as well as reporting on the effect of ignition source density.
A comparison table [6.25] is reproduced below, see Table 6.2, to illustrate the
comprehensiveness of the review undertaken and upon which the model is based.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 227 of 493
Table 6.2 Comparison of ignition probabilities by model for selected scenarios
Scenario
Basis 20x10x6 m
module
Area
(m
2
of
cloud to
LFL)
DNV
TDIM
[6.26]
Ignition
intensity
(per m
2
)
P
ign
by
DNV
TDIM
method
[6.26]
(Area
basis)
P
ign
by
W S
Atkins
method
[6.27]
(Area
basis)
P
ign
by
DNV
TDIM
method
[6.26]
(Volume
basis)
P
ign
by
Cox,
Lees
and Ang
[6.28]
(Flow
basis)
Hot work 50 hr/yr 120 2.85x10
-5
3.42x10
-3
1.7x10
-3
5.71x10
-3
--
Light equipment in
process area 60 % of
full module, very short
contact time for gas to
reach LFL
120 2.70x10
-5
3.42x10
-3
5.8x10
-2
3.24x10
-3
2.44x10
-2

Light equipment in
process area
1 kgs
-1
medium leak,
so medium contact
time
3.6 2.70x10
-5
9.72x10
-5
1.8x10
-3
1.05x10
-5
1.56x10
-2

Light equipment in
process area
0.1 kgs
-1
small leak, so
long contact time
0.04 2.70x10
-5
1.08x10
-5
2.1x10
-4
3.33x10
-7
3.56x10
-3

Heavy equipment in
process area
60 % of full module,
short contact time for
gas to reach LFL
120 8.51x10
-5
1.02x10
-2
2.6x10
-1
1.02x10
-2
2.44x10
-2

Heavy equipment in
process area
1 kgs
-1
medium leak,
so medium contact
time
3.6 8.51x10
-5
3.06x10
-4
9.0x10
-3
3.32x10
-5
1.56x10
-2

Heavy equipment in
process area
0.1 kgs
-1
small leak, so
long contact time
0.04 8.51x10
-5
3.40x10
-5
1.1x10
-5
1.05x10
-6
3.56x10
-3


Note: 60 % of full module cases, [6.25], probability based on a mass release rate of 2 kgs
-1
,
the flow indicated by the JIP Gas Build-up Workbook as at transition point at which an open
ended module would become saturated with gas. Other volumes are based on simple
momentum jet representation.
The probability review Table 6.3, presents compressed data into a coarser ranking, this
summary is shown below.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 228 of 493
Table 6.3 - Generic ignition probabilities
Release rate
category
Release rate
(kgs
-1
)
Cox et al,
gas leak
Cox et al,
oil leak
Revised oil &
gas
Minor <1 0.01 0.01 0.01
Major 1-50 0.07 0.03 0.03
Massive >50 0.3 0.08 0.10

In addition, an overview of timing is presented [6.25].
Table 6.4 - Ignition timings review
Relative probability of ignition within time t, (s)
Plant type
1 10 30 100 1000 >1000
Plant 0.22 0.29 0.36 0.63 0.94 1.0
Transport 0.53 0.53 0.53 0.60 0.86 1.0
Pipelines 0.24 0.30 0.31 0.39 0.61 1.0
CMPT blowouts 0.10 0.40 0.67 1.0
OIR12 offshore 0.94 0.98 1.0

During the Phase 3b tests [6.24] it was observed that for realistic releases giving a non-
uniform cloud density, the ignition of the cloud did not occur every time the ignition source was
activated. This was due to the fact that the source may be located in a non-flammable region
of the cloud or that the initial combustion ceased as the small initial flame front progressed to
non-flammable regions before it could develop. Further information may be found in the E&P
Forum hydrocarbon leak and ignition database [6.29].
If a full dispersion analysis is performed then intermittent and continuous time dependent
ignition may be considered. Assuming a largely uniform distribution in space of ignition
sources will result in a time dependent probability of ignition proportion to the rate of
generation of flammable cloud volume.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 229 of 493
6.6 Explosion overpressure determination
6.6.1 Explosion prediction methods and tools
The commonly used methods for predicting gas explosion loads have been reviewed [6.4]:
Empirical models based on correlations with experimental data and usually used to predict far
field blast effects outside the gas cloud combustion region. The limits of applicability and
accuracy of these methods are generally determined by the extent of the experimental data
that they are based on. They can be simple and quick to use so they can be a practical design
aid but in general the least accurate and cannot address general scenarios, as they should
strictly be used within the range of data on which they are based. Examples of empirical
models include Baker-Strehlow, Congestion Assessment Method and Multi-energy method
and-equivalency [6.1].
Phenomenological methods are simplified physical models that attempt to model the essential
physics of explosions. Generally they represent the actual scenario geometry using a
simplified system, for example a small number of interconnected chambers with turbulence
generating source terms between them, to represent the fully 3 dimensional nature of the real
geometry. This can be a reasonable representation of some geometries such as an offshore
module but may not be adequate for more complex situations. Phenomenological models
typically generate a peak overpressure or a single pressure-time history taken as
representative throughout the area under consideration. Some codes can also predict the blast
wave that will propagate away from the gas combustion region into the far field. Short run
times make this type of model suitable for running large numbers of explosion scenarios.
Examples of phenomenological models include CLICHE/CHAOS, SCOPE (note CLICH and
CHAOS are now included in the Advantica ARAMAS package).
A Monte Carlo approach may be used to explicitly represent the variability of these and other
parameters. Usually a phenomenological method of calculation of overpressures is used in
view of the large number of simulations necessary. The increased accuracy in the
representation of frequency and consequence variability will offset the reduced accuracy in
load determination as compared with CFD simulations in the determination of explosion risk.
Computational Fluid Dynamics (CFD) are in principal the most fundamentally based of the
methods discussed here and have the best potential for accurate prediction of gas explosion
behaviour over a wide range of geometries and explosion scenarios and in both the near and
far field. These tools solve the conservation equations of mass, momentum and energy
including turbulence and combustion in a large number of relatively small control volumes
covering the region of interest. These tools can provide a wide range of information about the
flow field and the explosion behaviour at the expense of significant effort required to set up a
suitable geometry model and significant computational power requirements. In practice
accuracy is limited by:
Available computation power limiting the numerical resolution that can practically be
used;
Accuracy of numerical models;
The underlying empirical sub models for;
o Reaction zone,
o Turbulence generation,
o Turbulence length scale,
o Turbulent combustion.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 230 of 493
In addition the numerical grid is typically insufficient to resolve smaller items of equipment and
most pipe work. These items must be represented as they are responsible for a large
proportion of the turbulence generated during an explosion so they are represented as drag
and turbulence source terms within each cell (so called subgrid modelling or Porosity, Drag
Resistance (PDR) models).
These models are therefore calibrated against experimental data of which full-scale data is
preferable to avoid scaling effects known to exist in gas explosions [6.30]. The full-scale tests
performed in the Spadeadam test rig during Phases 2, 3a and 3b of the Fire and explosion JIP
therefore provide important reference data for CFD explosion prediction tools. Importantly
Phase 2 of this JIP [6.31] gives a comparison of predictive capabilities for selected explosion
simulation tools.
Examples of specialist CFD gas explosion simulation tools include: AutoReaGas, FLACS,
EXSIM. A simplified formulation CEBAM has been developed in the US.
6.6.2 Limitations of CFD codes
Whilst CFD codes are considered to be the most accurate and stable codes for the generation
of explosion loads and are in widespread use, they all have the following properties:-
The codes are mostly designed to deal with fully turbulent flames.
The codes do not directly model flame distortion and diffusion/hydrodynamic instabilities
that occur between ignition and fully turbulent combustion. Consequently the codes must
rely on empirical flame folding models that are valid for a limited range of fuel-air
concentrations and boundary conditions.
The codes do not model flame propagation phenomena involving instabilities associated
with acoustic waves and shocks.
The codes should not be expected to accurately model flame quenching due to
deficiencies in the models, and due to lack of validation with experiments where
quenching can be directly observed.
Many of these deficiencies are partly due to the current limited understanding of the various
flame propagation phenomena, and due to inadequate computer resources which prevent
sufficient spatial and temporal resolution.
Important inputs to the analysis are the laminar and turbulent flame velocities. The turbulent
flame velocity is related to the laminar flame velocity in Appendix A of the basis document
[6.1]. Further data are available [6.32, 6.33].
6.6.3 Explosion code review/selection
The relatively limited time available for the preparation of this Guidance precluded a detailed
survey of the current status of explosion prediction tools. The information described here was
instead based on a recent survey conducted by the Health and Safety Laboratories [6.4].
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 231 of 493
Some of the relevant conclusions/discussion from this recent review by HSL are summarised
below:
The phenomenological code SCOPE and simple CFD codes AutoReaGas, EXSIM and
FLACS are in widespread use
Phenomenological and CFD methods generally give fairly good accuracy (within an factor
of two*) so these models yield solutions that are approximately correct
The limitations associated with empirical and phenomenological methods (simplified
physics and relatively crude representation of geometry) can only be overcome through
additional calibration
It is recommended to develop advanced CFD codes that will allow fully realistic
combustion models and resolution of all obstacles but is stated that it is likely to be 10 or
more years before such tools are available. This is primarily due to the large
computational expense of this type of model.
It is considered however that the present phenomenological and CFD models are adequate for
the assessment process being carried out given the uncertainties in the other stages of the
process.
It should be noted that the view in Norway is that a correct application of the NORSOK
protocol for explosion simulation will result in an accuracy of +/- 30 % in peak overpressures
[6.18, 6.22].
Further extracts from this report can be found [6.1] along with a brief description of the
empirical, phenomenological, and simple CFD codes that are described in the report.
6.6.4 Summary of main conclusions of HSL report [6.4]
The limitations associated with empirical and phenomenological models i.e. simplified physics
and relatively crude representation of the geometry, can only be overcome through additional
calibration. This limits the scope for improvements.
In light of the fact that gas explosion predictions are needed now, but that it will probably be
ten or more years before the CFD-based models will incorporate fully realistic combustion
models, be able to more adequately model turbulence and turbulence-combustion interaction
as well as being able to accurately represent all important obstacles in real, complex
geometries, one must make the best use of the currently available models. However, it may
be unwise to rely on the predictions of one model only, given the uncertainties that remain
especially if the model is used outside its range of validation. One must also be aware of the
uncertainties associated with whatever modelling approach is used.
The accuracy expected from, say phenomenological and simple CFD models is generally
fairly good (to within a factor of two), e.g. the models yield solutions which are approximately
correct, but, importantly, only for a scenario for which the model parameters have been tuned.
This limits the accuracy of these models as truly predictive tools. (no. 8 of main findings).
Perhaps the safest that can be advised at this point is that it would be unwise to rely on the
predictions of one model only, i.e. better to use a judicious combination of models of different
types, especially if a model is being used outside its range of validation. (no. 9, of main
recommendations).
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 232 of 493
Note All phenomenological and CFD codes represent to greater or lesser degree the physics
of combustion and flame behaviour and all are calibrated or validated against experiments. It
could be said that all could not therefore be used outside their experimental validation, but it
should be recognised that because there is an understanding of the physics involved, it is not
unreasonable to move the models outside there region of experimental validation as long as
this is done with a knowledge and understanding of the limitations.
6.6.5 Practical use of CFD explosion prediction tools
6.6.5.1 Geometry requirements, methods for early project phases
During the early stages of a typical offshore project, only the general layout and location of the
major pieces of equipment are known. The level of geometric detail usually increases as the
project proceeds as smaller pieces of equipment and objects such as piping and cable trays
are defined. For explosion overpressures predictions at each project stage the likely effects of
geometry detail to be added later in the project should be accounted for. If this is not done it is
likely that the calculated explosion characteristics such as overpressure and impulse will
increase significantly as detail is added throughout the project duration. Two possible methods
of addressing this have been postulated [6.23].
Make allowance for later increases in explosion loads by multiplying the explosion
overpressures predicted for a given level of geometry detail by applying a factor for
equipment growth (and hence congestion) based on previous project experience
Addition of anticipated probable congestion into the explosion geometry model to allow for
as yet undefined geometry
Detailed investigation of an integrated deck platform typical of the central/northern North Sea
showed that reasonable prediction of the likely final overpressures required the definition of all
major equipment, boundaries (decks, TR/accommodation blocks), all piping with diameters
> 8, Primary structure, secondary structure with cross section dimensions > 5.
The anticipated additional congestion likely to be added as the design is progressed can be
based on historical data for similar previous projects, equivalent equipment with all of its
associated pipe work. Several possible measures of the completeness of the current
geometry model such as the total length of the defined obstacles or various measures of the
blockage ratio have also been proposed.
6.6.5.2 Hints, tips and recommendations for use
Further details of these methods are summarised in reference [6.29].
Uniform cells should be used in the region of a CFD model where turbulent combustion will
take place
It is recommended that in FLACS simulations there should be at least 13 cells across an
unconfined gas cloud. Fewer cells are necessary with confinement, [6.29, 6.34, 6.35].
For AutoReaGas the recommended constants provided for turbulent combustion modelling
(factor slope and turbulent combustion modelling constant) should be used with close to
1 m
3
cells.
It is recommend that uniform stoichiometric concentration gas clouds are used in explosion
modelling due to lack of calibration/validation for non-uniform non-stoichiometric
concentration clouds
A sufficiently detailed geometry model should be used with explosion prediction models
that rely on a detailed geometry model of the facility
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 233 of 493
An explosion prediction code with a demonstrated predictive capability should be used,
consult your code supplier.
The numerical mesh should be extended sufficiently far from the region of interest to
prevent boundary conditions from affecting the simulation results of interest to the project
The computer code EXSIMPO is available for use with EXSIM which determines the
appropriate cell size from the layout.
6.6.6 Validation/calibration of gas explosion prediction tools
It has been found experimentally that gas explosion behaviour in confined and congested
environments is dependent on the scale of the test [6.30, 6.31]. Thus one of the main
objectives of the Phase 2 BFETS JIP [6.31] was to provide specific information on the
characteristics of explosions in a full-scale test rig intended to be representative of an offshore
module. Comparison between results for complete stoichiometric methane fills of a 1:3.2 scale
and full size Spadeadam test rig showed overpressures between 5 and 2.5 times greater at full
scale. The full-scale test results from the Phases 2 and 3a can now be obtained from the UK
HSE and are an important resource for validating/calibrating explosion assessment tools.
It is therefore recommended that the suitability of explosion assessment tools should be at
least partly assessed by comparison of simulation results with a selection of test cases taken
from full scale tests in the Spadeadam test rig.
It is worth noting that the only assessment of full scale blind explosion predictions, made
before the relevant test results were publicly available, were conducted in Phase C of the
Model Evaluation Exercise conducted during Phase 2 of the Fire and Explosion JIP [6.31].
This was a demonstration of certain predictive capabilities of the range of gas explosion
simulation tools available at this time.
The validation process should demonstrate the predictive capability of the proposed tool
rather than simply calibrate a result to one set of experiments.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 234 of 493
6.6.7 Example overpressure traces
Results from the explosion tests at the Advantica Spadeadam test site, revealed that the
overpressure time histories had a large number of short duration spikes which seemed to be
superimposed on a generally smooth curve. Figure 6.3 shows a typical trace from inside the
test rig.

Figure 6.3 - Example overpressure trace (inside a compartment)
The origin of these spikes could be:
local supersonic flow and the resulting generated shock waves
localised centres of combustion and pressure generation
acceleration of the pressure transducers during the explosion
local response and subsequent generation of shock waves through the (bolted) structure.
Whatever the cause investigations have shown [6.36] that the influence of these short duration
loads is insignificant for components with natural periods more than 0.02 seconds (natural
frequency less than 50 Hz) which includes most components. These spikes which can take the
observed overpressures beyond 12 bar may therefore be ignored and pressure traces may be
smoothed by time averaging over a period of 1.5 milliseconds. Other more refined smoothing
techniques have been investigated [6.37].
Existing CFD explosion simulation codes do not generate these spikes as they cannot
represent any of the processes identified above so overpressure traces from CFD simulations
may be used directly as the input loading for some finite element packages (FEA) packages.
This form is not characteristic of far field blast waves outside a compartment. A typical trace
for this case is shown in Figure 6.4.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 235 of 493

Figure 6.4 - Typical pressure trace at some distance from a vent blast wave.
6.6.8 Extrapolation of the results of a worst case explosion simulation
For an initial screening analysis the following method from reference [6.17] is a method for the
extrapolation of the results from a simulation based on a worst case scenario with the whole
volume is full of a stoichiometric mix of gas for use when partial fills are more realistic. This
may occur if the released inventory cannot be sufficient to form a cloud of this size. The peak
smoothed overpressure for this worst case scenario simulation will be P
ult

The reliability of the results of this method will depend on the reliability of the base simulation.
The method is based on the assumption that any gas within the module is perfectly mixed and
that the probabilities of an explosion occurring at any concentration within the flammable range
are equal.
It is recommended that the variation of explosion overpressure with ignition point location is
investigated by considering at least three ignition points at representative points, such as both
ends and the centre of the module, again assuming that the module is fully filled with a
stoichiometric concentration cloud.
The variation of explosion overpressure with concentration for unmitigated explosions is
defined by the following relationship:
] ) 0563 . 1 ( ) 0563 . 1 [( 693 . 17
1 2
2
1
2
2

=
E E
e PE PE

Where: PE
1
= overpressure at concentration equivalence E
1
(P
ult
for a stoichiometric mix)
PE
2
= overpressure at concentration equivalence E
2

E = Concentration of Interest/Stoichiometric Concentration
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 236 of 493
This relationship for the variation of the maximum peak explosion overpressure with cloud size
has been developed based on limited medium-scale experimental evidence and FLACS
simulations of these events. The method was developed based on experiments for one
explosion geometry. The relationship between the fraction of the module filled with
stoichiometric concentration and the fraction of the overpressure corresponding to a fully filled
module, produced by a given cloud is shown below in Figure 6.5:
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
0 0.1 0.4 1
Normalised Cloud Volume
N
o
r
m
a
l
i
s
e
d

O
v
e
r
p
r
e
s
s
u
r
e

Figure 6.5 - Normalised overpressure vs. Normalised cloud volume
The influence of water spray mitigation, based on a small data set, is quantified by the use of a
ratio of the unmitigated overpressure to the mitigated pressure P
r
.. This varies with the
unmitigated explosion overpressure as given below:
Table 6.5 - P
r
- unmitigated/mitigated peak overpressure
Maximum unmitigated
explosion overpressure
(Bar)
P
r

0 to 0.2 1
0.2 to 0.5 2
0.5 to 1.0 3
1.0 to 2.0 3.4
2.0 to 4.0 6
> 4.0 8

FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 237 of 493
A relationship for mitigated explosion peak overpressure is also given in the same form as the
earlier relationship for unmitigated explosions:
] ) 0007 . 1 ( ) 0007 . 1 [( 215 . 18
1 2
2
1
2
2

=
E E
e PE PE
The factors given in Table 6.2 represent median values, with a large spread in the data for all
overpressure ranges. The use of these factors may considerably under or over estimate the
real local overpressure peak values.
6.7 Development and application of nominal explosion loads
6.7.1 Intended use of nominal explosion loads
During the concept selection/definition phase of a project it would be useful to have an
indication of likely gas explosion loads for use in assessing alternative concepts. At this stage
of the project very little detailed information will be available and this will almost certainly be
insufficient to allow the use of explosion prediction methods that require the input of geometry
models with any level of detail. In addition normal project timescales will not allow time for
detailed explosion assessments to be carried out at this time.
As the spatial variation of explosion loads will not be well represented, it is not recommended
that nominal overpressures or dynamic pressures are used as a design basis at later project
stages, for the assessment of existing platforms or for high risk or novel installations. Nominal
overpressures are defined as peak representative overpressures by installation/module type
determined on a non-statistical basis from acquired experience or simulation for a
demonstrably similar situation.
If it is necessary to calculate blast wave effects in the far field, for example at an adjacent
platform, this could be done using one of empirical blast wave propagation methods from a
knowledge of the vent areas and the mass of fuel in the gas cloud. The external explosion
which may occur as a result of the ignition of a vented unburnt fuel/air mixture is not explicitly
included in the approach although in some of the data the external explosion may have
contributed to blockage of the vents and increased the overpressures in the combustion
region.
At later project stages, and for re-assessment of existing facilities it is recommended that a
suitably validated phenomenological or a specialist CFD explosion simulation tool is used.
A Rule Set defining nominal, space averaged, peak explosion overpressures or nominal
overpressures may be developed to assess alternative concepts at early project phases. This
could be based on data from previous explosion load simulations for the range of concepts,
module sizes, module types and process characteristics.
6.7.2 Factors influencing the overpressure values
The Rule set could also include information on the expected variation of the nominal
overpressures with respect to but not limited to a subset of the following factors:
Production rate
Gas compression pressure
Gas composition
Number of production trains
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 238 of 493
Module area/footprint
Confinement measures
Congestion measures
Aspect ratio
It would be desirable if these factors could be as near as possible independent to aid
processing of the base data.
6.7.3 Characteristics of a suitable data set
Some data have been collected on a range of concept types and are given in Appendix A of
one of the base documents for this Guidance [6.2]. These data were found to be unsuitable for
the generation of reliable nominal overpressures. The overpressures are not defined precisely
and may not be representative of the general level of severity of the explosion event
simulated.
The desirable characteristics of a suitable data set are:
The values need to represent space-averaged overpressures over the affected area, they
are defined as the average of all simulated (or measured) overpressure peaks within the
affected region. It is assumed that in the case of measured overpressures they have
been smoothed by time averaging over a window of 1.5 ms.
There should be sufficient gauge points to represent the spatial variation of pressure
within the explosion.
The scenarios simulated should represent the DLB design level explosion for the ductility
level event occurring at the appropriate frequency level.
A CFD or validated phenomenological simulation method should be used for all the data.
Contemporary analysis methods and up to date software should be used.
A number of ignition points should be considered preferably with information on the
probability of ignition associated with each one. The detail on the model representing the
geometry should represent obstacles down to piping of 3 diameter.
An indication of the variability of the overpressure peaks throughout the compartment
should also be part of the data set.
An indication of the form of the overpressure traces (duration, and impulse) should be
included.
Peak dynamic overpressures at SCEs of Criticality 1 and 2 should be included.
The resulting nominal overpressures, frequencies and durations should then be a good
indicator of the expected severity of the design explosion event and the level of risk arising
from the explosion hazard.
6.7.4 Bounding (minimum) overpressures and durations
DNV Offshore Standard DNV-OS-A101 [6.38] provides a source of bounding overpressures.
(It should be noted that the bounding overpressures represent space averaged peak
overpressure values). These values are the minimum overpressures that will be acceptable for
design, if they are used, they will need to be justified with respect to ALARP.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 239 of 493
Section D600, P9 of these rules [6.38] provides guidance for hydrocarbon explosions. It should
be noted that large quantities of ethylene, acetylene and hydrogen require special
consideration. The following extracts are taken from this reference:
In a ventilated compartment the explosion load given by overpressure and duration is mainly
determined by the relative ventilation and the level of congestion.
For compartment volumes of up to 1000 m3, with relative ventilation area of about 0.5,
stoichiometric gas cloud ignition expected to give approximately 1bar with a medium level of
congestion. High congestion levels may increase overpressures by a factors of 2 to 3. Larger
volumes also tend to increase overpressures.
Design overpressure in a ventilated shale shaker room with less than 1000 m3 volume and
moderate congestion may be taken as 2 bar, combined with a pulse duration of 0.2 s
(200 milliseconds) unless a more detailed assessment is carried out.
Design overpressure on an open drill floor area may be 0.1 bar combined with a pulse duration
of 0.2 s unless a more detailed assessment is carried out.
The vent area A
v
may be taken as sum of free opening and blow out panel areas where static
opening overpressure is less than 0.05 bar.
Durations for explosions is expected to vary from 0.2 s for fairly open compartments to 1 s for
quite closed compartments.
If panels or walls are intended to give explosion relief by failing a peak overpressure of 2-3
times their failure pressure can still be expected in the compartment. This is only the case if
ventilation dominates. For large and congested compartments local overpressures may be
greater.
Long compartments with length/diameter ratio greater than 3 will tend to give higher
overpressures due to long flame acceleration lengths. The effective diameter can be estimated
as D = A where A is the smallest cross-section area and L is the largest compartment
dimension.
For completely enclosed compartments generally, bulkheads that must survive an explosion
will be designed for 4 bar.
For process areas on open deck covering not more than 20 m x 20 m with an uncongested
arrangement a design overpressure of 0.2 bar with a pulse duration of 0.2 s may be used.
Volume blockage ratios (VBRs) of 0.05 may be considered as not congested, where VBR is
the ratio of the blocked volume to the total volume considered.
For larger or congested process areas a design overpressure peak of 0.5 bar with a pulse
duration of 0.2 s may be used. A volume blockage ratio of 0.05 may be considered not to be
congested.
See Table D1 in paragraph 617 of the reference [6.38] for a summary of these results.
6.7.5 Other sources of bounding or generic overpressures.
Puttock [6.39] describes a negative feedback mechanism between confinement and
congestion that tends to limit the typical pressures within an explosion to an overpressure of
8 bar. If an explosion is completely confined typical pressures will reach 8 bar but there will be
only limited flow within the explosion due to the confinement, and therefore little turbulence.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 240 of 493
Conversely with a very open layout strong flows and rapid turbulent combustion can result in
high localised pressures but the typical space averaged overpressures within the region are
likely to be lower than the peaks because hot combustion products will be able to dissipate.
Thus the congestion must be considered to account for the phenomena likely to be seen in an
offshore gas explosion.
6.8 Impulse and duration related to peak overpressure
It has been observed that faster combustion results in higher peak overpressures but the gas
is consumed in a shorter period. This may be used to estimate durations and impulses
associated with given peak overpressures.
Without undertaking detailed modelling it is not practicable to establish the overpressure time
history for the specific situation, however, by establishing the blast duration, the peak
overpressure loads can be translated into useable loads for preliminary response calculations.
This load time history may be translated into an equivalent static load which is more readily
usable in the concept definition and FEED stages.
It is recommended that in the absence of project specific data the relationship between
impulse and peak overpressure described in Hoiset [6.40] is used to derive a positive duration
for the overpressure based on the assumption of a triangular pressure-time history with equal
rise and fall times. These relationships are based on CFD simulations of a small number of
geometries and should only be considered as approximate example values. The explosion
overpressure impulse, I, is given by:-
I = 0.042 P + 6,500 (Figure 6.6)
The positive phase duration, t
+
, in seconds is then:
t
+
= 0.084 + 13,000/ P (Figure 6.7)
where P is the peak overpressure in Pascals (1 bar = 100,000 pascals)
I is the impulse in Pascal.seconds
t
+
is the positive phase of overpressure duration in the combustion region in seconds.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 241 of 493
Impulse kPas Vs OP Bar
0
5
10
15
20
25
0 0.5 1 1.5 2 2.5 3 3.5 4 4.5
Overpressur e (Bar)
I
m
p
u
l
s
e

k
P
a
s
Impulse kPas

Figure 6.6 - Generic variation of impulse with overpressure
The curves given [6.40] in Figure 6.6 and Figure 6.7 may not be applicable for large open
areas such as occur on F(P)SOs and Spars, as it was derived for enclosed compartments.
These curves do not apply to blast waves from a distant explosion as in this case the impulse
may be near zero and the positive phase duration may be much shorter. The blast wave from
a distant explosion (>20 m from the vent) will develop into a sharp fronted wave with a
negative phase often represented with duration twice that of the positive phase.
If an overpressure simulation is available then a point may be positioned on the
impulse/overpressure chart in Figure 6.6. This will serve to calibrate the model for the specific
situation. A line may then be drawn through this point parallel to the line given. This new line
may then be used for extrapolation of nominal impulse and duration.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 242 of 493
Dur at ion Vs Over pr essur e (Hoiset )
0
0.2
0.4
0.6
0.8
1
1.2
1.4
1.6
0 0.5 1 1.5 2 2.5 3 3.5 4 4.5
Over pr essur e (Bar )
D
u
r
a
t
i
o
n

(
s
)
Duration s

Figure 6.7 - Overpressure duration relationship
Note that the assumption of a symmetrical triangular positive phase will not apply if there are
two clear paths for the pressure disturbance to reach the observation point such as would be
observed on the deck below an explosion. An external explosion may result in a double peak
in the overpressure.
6.9 Design explosion loads
6.9.1 Load cases for explosion response
Two levels of explosion loading are recommended for explosion assessment by analogy with
earthquake assessment. They are the ductility level blast (DLB) and the strength level blast
(SLB). Low risk installations may be assessed using only the DLB.
The ductility level blast is the design level overpressure used to represent the extreme design
event.
The strength level blast represents a more frequent design event where it is required that the
structure does not deform plastically and that the SCEs remain operational. This load case is
recommended for the following reasons:-
The SLB may detect additional weaknesses in the design not identified by the DLB
(robustness check).
An SLB event could give rise to a DLB by escalation this should ideally not occur as
elastic response of SLB and supports should be maintained.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 243 of 493
The prediction of equipment and piping response in the elastic regime is much better
understood than the conditions which give rise to rupture. The SLB enables these
checks to be made at a lower load level often resulting in good performance at the
higher level (strength in depth).
The SLB is a low consequence event important for the establishment of operability.
This load case offers a degree of asset protection.
6.9.2 Determination of explosion design loads
Overpressure acts directly on loaded surfaces and is available directly from computational fluid
dynamics (CFD) and some phenomenological explosion codes.
Design explosion loads were in the past derived from a worst credible event assuming a gas
cloud of maximal extent with stoichiometric composition ignited at the worst time in the worst
position. Usually the ultimate peak overpressure P
ult
derived in this way is far too large to be
accommodated by the structure. ALARP arguments are appropriate and can be used to
demonstrate that risk has been reduced to satisfactory levels, relying on frequency and risk
arguments. P
ult
will often correspond to an event with an adequately low probability of
occurrence.
A probability of between 10
-4
and 10
-5
per year is considered reasonable for the ductility level
design event by comparison with the treatment of environmental and ship impact loads which
are often considered at the 10
-5
level. The assessment principles for offshore safety cases
document APOSC [6.41] states that the frequency with which accidental events result in loss
of integrity of the temporary refuge within the minimum stated endurance time, does not
exceed the order of 1 in 1000 per year. Earlier versions of the safety code previously issued
by NPD (now under the jurisdiction of the Petroleum Safety Authority in Norway) [6.42] gave a
limit on TR impairment probability of 10
-3
per year. The revised regulations, (available for view
on the internet [6.43]) have now been redrafted into a more risk based approach. It is
reasonable and conservative to assume that the threat from fires exceeds that from explosions
by a factor of 10 to 1 and an impairment frequency of 1 in 10,000 per year is a reasonable
estimate for explosion impairment. Hence a target of 10
-5
exceedance per year for an
explosion event which directly impinges on the TR is reasonable. An explosion event in the
process area will be separated from the TR by a barrier or blast wall which should withstand
the load and have an impairment frequency of much less than 10 % giving a target frequency
for such an event of the order of 10
-4
exceedance per year.
The space averaged peak overpressure for the compartment is used for determination of the
design explosion loads as it is more generally representative of the severity of the event. A
local overpressure peak may be used to generate exceedance curves for the determination of
load cases for local design of blast wall for instance. Impulse exceedance curves may also be
generated which take into account the duration of the load and its peak value are a better
measure of the expected response of the target which will be dynamic in nature.
The SLB may then be identified from a space averaged peak overpressure exceedance curve,
as that overpressure corresponding to a frequency one order of magnitude more frequent or
with a magnitude of one third of the DLB overpressure whichever is the greater. The reason
for the reduction factor of one third is related to the expected reserves of strength in the
structure and the observation that the primary structure will often only experience received
loads of this reduced magnitude. Section 8 and its various sub-sections provide more detail of
the issues related to explosion loads.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 244 of 493
Figure 6.8 represents an example (simplified) overpressure exceedance diagram. This curve
is conventionally plotted with a logarithmic scale for the vertical frequency axis which gives the
frequency of per year which the given overpressure will be exceeded. The horizontal axis is a
linear scale usually with the peak space averaged overpressure for the combustion region
plotted in bar. This parameter gives a good general measure for the choice of design
scenarios. Each of these scenarios may have a large range of local peak overpressures and
associated durations within it.

Figure 6.8 - Example overpressure exceedance curve location of DLB and SLB design
load cases (P
str
and P
duct
)
The SLB overpressure, Pstr may then be identified as that overpressure corresponding to a
frequency one order of magnitude more frequent or with a magnitude of one third of the DLB
overpressure, Pduct whichever is the greater. The reason for the reduction factor of one third
is related to the expected reserves of strength in the structure and the observation that the
primary structure will often only experience received loads of this magnitude [6.44, 6.45].
Many other forms of this curve have been produced with various combinations of log and
linear axes, this gives the impression that the curves differ in shape which depends on the axis
choice. Other forms of curve may be plots of local peak overpressures for a particular location
There is some evidence that the curve has underlying exponential distribution characteristics
[6.45, 6.46] which gives a straight line when plotted with log-linear axes as in Figure 6.8.
The same convention may be used for plotting other measures such as dynamic pressure
exceedance curves for a particular part of the combustion region. The dynamic pressures
corresponding to the SLB and DLB load cases may then be obtained in the same way by
selection of the appropriate frequencies of exceedance.
The generation of exceedance curves is discussed in detail in Section 6.10.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 245 of 493
6.9.3 The COSAC risk assessment tool
COSAC [6.47] is a commercially available risk analysis software tool intended for concept
evaluation and screening at earl project phases.
The program is used by building an approximate model of the various field development
concepts from a list of elements so that each concept can be ranked and potential concept
stoppers can be identified at an early stage.
The tool includes an explosion assessment method based on FLACS simulations of more than
15 modules/geometries conducted using the NORSOK procedure to generate an explosion
pressure exceedance curve. For a specified solid barrier the model can be used to calculate
the explosion pressure for a defined annual frequency of occurrence e.g. 10
-4
per year.
The model has been developed based on data from ordinary offshore modules and is
therefore not recommended for extreme cases.
6.9.4 The PRESTO screening model
Advantica have recently undertaken some work to produce a simple screening model for
overpressure prediction. This is based on the Phase 2 and 3 data and proprietary test data.
The model includes parameters that characterise the degree of congestion and confinement
explicitly. They make no claims for the validity or otherwise of the present version which is still
very much at an early stage of development.
6.10 Generating exceedance curves
6.10.1 General
There is currently much industry interest in the generation of curves of the probability of
exceeding a specified explosion load at a given location. These curves can relate to
overpressure at a point, or averaged over a wall, or other explosion properties such as
dynamic pressure or impulse. Exceedance curves are typically plotted on a graph with
overpressure plotted on a linear scale on the horizontal axis and annual exceedance
frequency plotted on a log scale on the vertical axis. An exceedance curve will always be a
monotonically decreasing (discrete) function.
Several methods of generating exceedance curves are in use, [6.1]. The range of methods
represents the fact that at an early stage of a project the available information may be
sufficient only to apply a relatively simple methodology with more complex methodologies
applied as the project develops. However, the range is also due to the number of factors that
can contribute to an explosion occurring with different methodologies accounting for these
factors. The release, cloud formation, ignition and explosion must all be considered in
generating exceedance curves. Decisions must therefore be made about how to represent
these influences on the explosion. Natural variability, in for example, release or ventilation
rate, and uncertainty in both the data and models should be considered.
There are methods of extrapolating from a small number of explosion simulations representing
differing ignition points to represent various (equivalent stoichiometric) cloud sizes and the
expected overpressures [6.17] and Section 6.10.5. An exceedance curve may be constructed
using these extrapolated results.
Section 6.10.5 presents a simplified method based on the assumption of exceedance curve
shape which in theory requires only requires a small number of simulations to be performed.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 246 of 493
The other point uses the probability of a release forming a cloud combined with the probability
of a late ignition Pr
exp
, corresponding to the zero overpressure exceedance probability. This
method may be used only at an early project phase when sufficient information for more
sophisticated methods is not available.
6.10.2 Exceedance curves for design explosion load case determination
The process below is a method of medium complexity for the generation of exceedance
curves for the purpose of identification of the design explosion events corresponding to the
SLB and DLB. It is advisable to consider space averaged peak overpressures for this purpose
as they are more representative of the general severity of the load case. The chosen
scenarios will themselves give rise to simulations which have large local variations of peak
overpressure. The most rigorous and repeatable method of exceedance curve generation is
that following the NORSOK procedure [6.8] described later in Section 6.13.
It is important to identify the explosion scenarios with the higher overpressures as these will
determine the required exceedance probabilities in the required range (10
-5
to 10
-4

exceedance). Explosions with a frequency of exceedance of greater than 10
-3
will also
dominate the accuracy of the exceedance curve around the 10
-4
exceedance level. The total
probability of an explosion gives a method of determining if adequate scenarios have been
considered and convergence is being achieved.
Figure 6.9 illustrates the sequence of tasks for exceedance curve generation.
1. select leak scenarios and determine release probabilities
2. calculate release rate time history
3. calculate cloud size time history
At the highest level of sophistication this would involve consideration of ventilation rates
by wind speed and direction by CFD simulation. At a lower level the expected higher
explosion overpressures would occur in situations of poor ventilation with the wind from
a direction blocked by a barrier or equipment. A simplified method might assume a near
constant release rate to generate a series of cloud sizes with equal probability, a
workbook approach [6.18] is described in Section 6.4.2 could be used.
4. calculate ignition probability
At the highest level the probability of ignition from a continuous source, will be
estimated as a time history and will be proportional to the rate of generation of
inflammable cloud volume which should be available from a CFD dispersion calculation.
At a lower level the ignition probability could be assumed constant irrespective of cloud
size but with say 3 widely spread locations for the ignition sources.
5. calculate equivalent stoichiometric cloud size (Section 6.4.4) note the reservations
quoted in this section on the accuracy of this step in the analysis process.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 247 of 493
6. calculate the space averaged peak overpressure discussed earlier in Section 6.7.4.
A high level of sophistication method could use CFD for the cases where the highest
overpressures are expected with calibrated phenomenological simulations for
interpolation between scenarios if required.
Alternatively, a Monte Carlo simulation method may be used based on a
phenomenological model used such as ARAMAS which generates space averaged
overpressures implicitly. Several thousand simulations may be performed for variations
of all input parameters governing environmental, release and ignition. The wider range
of parameter variations offsets some of the uncertainties in the extrapolation techniques
which could be used if a CFD approach with fewer simulations is used. A low
sophistication method may use one of the larger cloud size cases with interpolation for
smaller clouds using approaches described in Section 6.6.8 and Reference [6.17].
7. assemble the space averaged peak overpressure exceedance curve from probabilities
of occurrence of the overpressures for the scenarios simulated.
If local overpressure exceedance curves are needed for a reliability analysis of a blast wall for
example these may be generated based on the probabilities for the averaged pressures and
transfer functions relating these two values for the chosen location [6.48].
The worst credible scenario assuming a stoichiometric cloud filling the module and ignited at
the worst position may not be representative of the general population of explosion events. In
addition it will be difficult to determine its probability of occurrence. A representative scenario
at around the 10
-4
per annum exceedance level or the 10
-5
frequency of occurrence level
should be used if it can be identified.
A simplified method which may be used for the purpose of design explosion load
determination, is presented later (see Section 6.10.4).
Bruce [6.49] describes a typical methodology for estimating overpressure exceedance
distributions with associated confidence bounds. The probability distributions of the input
variables are considered in giving these bounds.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 248 of 493

Figure 6.9 - Overview of probabilistic blast modelling approach [6.49]
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 249 of 493
6.10.3 Generic exceedance curves
Puttock [6.48] describes the possible use of generic pressure exceedance curves designed to
give a conservative estimate of the required probability for all modules of one generic
configuration. As the worst-case overpressure will vary from module to module the generic
exceedance curve is plotted as the ratio of overpressure to the worst-case overpressure.
One problem with the use of this type of generic curve is that they do not allow for the fact that
the level of overpressure will affect the shape of the plot because if the overpressure is already
close to 8 bars it is unlikely to significantly increase. Ratios of a parameter called severity
index rather than the overpressure can be used to allow for this. Severity index, S, is based on
runs of SCOPE 3 [6.48] and tends to infinity at 8 bars which would correspond to adiabatic
combustion of a stoichiometric hydrocarbon without expansion. An expression for S is given
as:

( ) 1.08
1
0.4
.
P
E P
S P e

=
Where P is the overpressure in bars, E is the expansion ratio at atmospheric pressure. Note
that this approach assumes that P is a typical overpressure, for example over a complete
congested region. If P is replaced by S in an expression fitted to some experimental data then
at low overpressures the predicted overpressures will be unchanged. If the correlation is used
for S and S inverted to get P using the above equation it will automatically be limited in a
realistic way to 8 bar.
It is however difficult to prove the general applicability of generic curves as their detail is likely
to vary between different modules/plants. It is stated that the only feasible way to take into
account the complexity of the physical processes in a gas explosion is to use a Monte-Carlo
method that requires performing many thousands of model runs to obtain valid statistics. The
SCOPE model that only takes a few seconds to run is used for this purpose. Where further
detail is required CFD runs are performed using EXSIM. Transform (or transfer) functions that
relate the median overpressure produced by SCOPE to features such as localised high
overpressures or geometry effects such as shielding or pressure wave reflection are then
defined. The method takes account of variations in leak rate, fuel type, wind speed and
direction, ignition location and stoichiometry.
Flammable gas cloud sizes can be calculated in two stages using EXSIM (ventilation flow
followed by dispersion simulation), or using a zone model to predict ventilation flow followed by
a random-walk dispersion method.
Transform functions at each receptor are calculated by running EXSIM for range of initial
conditions. The idealisation of the module used in the SCOPE input is adjusted if necessary so
that with the module fully filled with gas and ignition at the centre of the module would give the
same median overpressure with both models.
Example exceedance frequency and exceedance probability curves are given for pressure and
impulse in the reference.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 250 of 493
6.10.4 Mobil North Sea methodology for early design blast analysis
This methodology [6.17] describes four methods to allow designers to select appropriate gas
explosion overpressures for use in early stages of the design process when only a small
number of simulations have been performed (one for each ignition point considered). The
relationship between overpressures for clouds of different sizes and simplifying assumptions
about the probability of ignition enable the construction of an exceedance curve for use in
identifying design explosion loads in the most sophisticated method described.
The guidance given is conservative in certain aspects in an effort to ensure that the estimated
blast loads remain firm throughout the design process. Four separate approaches are
described in ascending order of complexity. The first two approaches are hazard
consequences based while the last two are risk based.
6.10.5 Simplified methods for pressure exceedance curve generation
This method requires that two overpressure/probability of exceedance points are defined.
These are then plotted on a graph with overpressure plotted on a linear scale on the horizontal
axis and exceedance frequency plotted on a log scale on the vertical axis. The two plotted
points are then joined by a straight line to give a simple relationship between overpressure and
exceedance frequency.
This method is based on the a priori fact that the statistics of random events such as
explosions indicate that the intervals between such events will often have an exponential
distribution. [6.50].
A recent paper by Yasseri [6.46] has processed the historical data on explosions in the North
Sea given by Vinnem [6.51] and has shown that there is a good fit for the data to the
exponential distribution.
An exponential distribution gives a straight line for the exceedance diagram with the axes
chosen.
Possible methods of calculating the two required overpressure and frequency points include
the following:
A point at zero overpressure corresponding to the probability of an ignited gas leak Pr
expl
.
A high overpressure, low frequency event based on the ignition of a full stoichiometric
concentration fill of the module Pult and its associated probability.
A representative explosion overpressure at an exceedance frequency of 10
-4
obtained
using the COSAC software.
A suitable representative overpressure may be defined as the average of the highest 20 % of
the peaks in any particular scenario. This definition is used to avoid distortion of the resulting
curve resulting from the variability of local overpressures. A curve based on local peaks will be
specific to the locations chosen.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 251 of 493
Figure 6.8 shows an exceedance curve generated in this way from a sample representative
overpressure and frequency of exceedance obtained by simulation. If the sample simulation
corresponds to the worst credible case with a full compartment of a stoichiometric gas cloud
ignited in the worst position Pult, then the frequency of exceedance is the absolute frequency.
The difficulty is the determination of this frequency and it is argued that this case is not a
representative point to take.
It is preferred to take a representative sample overpressure nearer to the DLB at a frequency
of exceedance of between 10
-4
and 10
-5
, however there is then the difficulty of estimating the
frequency of exceedance, as there will be some cases where the overpressure exceeds this
value each with their own frequency of occurrence.
6.11 Loads on piping and equipment
6.11.1 Load cases for piping and equipment response
Section 3.5.5 identifies three categories of criticality of safety critical elements (SCEs). The
dynamic pressure loads should be evaluated on SCEs of criticality levels 1 and 2.
SCEs of criticality level 1 and 2 should be assessed against the SLB, SCEs of criticality 1 will
be assessed against the DLB as derived in the previous section.
If the general level of dynamic pressure loads is not known then it is acceptable to take a load
equal to 1/3 of the overpressure at the location for the DLB load case. The duration should be
chosen so that the impulse matches that of the overpressure trace. This load must also be
applied in the reverse direction. In open areas, such as the decks of FPSOs, these loads
should also be applied in the vertical plane.
The performance of the structure and SCEs for these scenarios must then be tested against
the appropriate high level and equipment specific performance standards.
6.11.2 Dynamic pressure loads
The explosion loads on equipment items and piping which are classified as SCEs [6.52, 6.53,
6.54, 6.55] must be determined and are referred to as dynamic pressure loads. These may
also be obtained from CFD simulation results and consist of:
Drag loads (similar to the Morison drag loads experienced in fluid flow) proportional
to the square of the gas velocity, its density and the area presented to the flow by
the obstacle.
Inertia loads proportional to the gas acceleration and the volume of the obstacle.
Pressure difference loads.
Drag loads dominate for obstacles with dimensions less than 0.3 m or on cylindrical obstacles
less than 0.3 m in diameter in particular in regions of high gas velocity near vents. Both drag
and pressure difference loads are significant on objects between 0.3 m and 2 m in the flow
direction.
Exceedance curves for dynamic pressures may be developed from simulations and used in
the same way as for overpressures in deriving design dynamic overpressures.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 252 of 493
The situation in Figure 6.10 represents an explosion in a module compartment. In this
example all walls except the West wall are solid. The blast overpressure causes a pressure
front to move from left to right from the point of ignition at about the speed of sound in the
unburned mixture.
Vessel
Explosion
West wall open
S
N
E W
70kN/m Overpressure load
Dynamic Pressure Load

Figure 6.10 - Explosion within a compartment [6.56, 6.57]
The unburned gas is pushed out of the module through the vented area with a velocity. This
velocity will be available directly from a CFD simulation or by the approximate method given in
the next section.
The air ahead of this front is pushed out through the vent in the West wall over a vessel and
pipe work spanning the vent giving the possibility of vessel or piping failure, with further
release of inventory and consequent escalation. The gas velocities in this case will occur
predominantly near the vent. The magnitude of drag forces on the pipe work (with diameter D
typically less than 0.3 m) at any time is given by the drag term in Morisons Equation.
The force should be calculated for engulfment of the obstacle in the burnt and unburnt gas
mixture as the burnt gas/air mixture may be travelling at a speed of ten times the speed of the
unburnt mixture even though the unburnt mixture is ten times denser.
Drag coefficients are given in Figures 4-55 and 4-56 by Cjujko [6.19] and Table 1 [6.53].
A typical time history for the drag load is shown below in Figure 6.11, [6.55].
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 253 of 493

Figure 6.11 - Example dynamic overpressure trace
Two peaks are shown corresponding to the peak gas velocities ahead of and behind the flame
front. In a vented compartment flow reversal of gases into the compartment could also occur at
a later stage in the explosion. This would give a trace with a negative phase.
Drag loads are particularly important in open areas such as on the deck structures of an
F(P)SO. The gas clouds associated with explosions on FPSOs may be very large and gas
velocities up to 500 ms
-1
could be experienced. The direction of gas flow may also be very
variable for example in the case of the pipe rack of an FPSO acted on by an explosion ignited
at low level. Secondary projectiles may be a problem for FPSOs in view of the higher gas
velocities.
The drag loads may be used to represent the total force on obstacles with in flow dimensions
less than 0.3 m. For larger diameter obstacles or vessels, the pressure difference across the
vessel will also need to be calculated and added to the drag force above.
The IGNs [6.58] state that the validated methods for determination of loading due to blast wind
are strictly only applicable to distant explosions:
there is no equally established methodology for structures either within or close to an
explosion typical of offshore geometry, in particular in the immediate vicinity of the perimeter of
the enclosure where the explosion vents.
These validated methods are based on TNT equivalent explosions with non-turbulent fluid flow
at a distance allowing the use of Morisons Equation to determine the load on a body.
Catlins paper describes some experimental validations of formulae for both vented gas
velocity from a compartment open on one face and the loads on vertical cylinders in the vent
area [6.59].
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 254 of 493
6.11.3 Loads on vessels
It is possible to estimate an upper bound to the pressure difference force from an explosion
pressure trace [6.19] by assuming or from knowledge of the speed of propagation of the
pressure disturbance. If the pressure pulse is considered to propagate with a velocity U then a
time interval t may be associated with the diameter of the vessel D through:
t = D/U
The pressure difference across the vessel P may be read from the indicative trace shown in
Figure 6.12.

Figure 6.12 - Estimation of the pressure difference across a vessel from a pressure
trace
This process is conventionally applied for the phase of the explosion where the vessel is in the
unburnt air/fuel mix using the appropriate speed of sound. The part of the curve relevant to this
calculation is before the peak. Under these assumptions, this same load may be applied after
the peak acting in the opposite direction. A time history of drag load may then be estimated.
For piping the response to the drag load may be estimated using a single degree of freedom
method such as the Biggs method described more fully in Sections 8.7.5 and 8.7.6.
This same model may be used to estimate the tension effects in one-way spanning blast
panels, see the general discussion on response prediction in Section 8.7.
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 255 of 493
6.11.4 Loads on grating
Grating is often used for decking in an effort to allow venting of explosion gases. Tests [6.55]
have shown that the force perpendicular to the grating may be calculated from a Morison drag
formulation using the cross sectional; area of the grating presented to the gas flow.
6.11.5 Considerations in the use of CFD
In references [6.53] and [6.60] dynamic pressure loads were calculated using the conventional
drag formulation given above and directly from CFD simulations, the Direct Load
Measurement (DLM) method. In the DLM method, the pressure differential across equipment
in each direction is taken from gauge (or measurement) points located on the up and down
wind sides of the object and multiplied by the obstacle windage in each direction. It is
recommended that this is used for objects greater than 0.3 m in diameter.
One problem with this method is that overpressures are generally recorded at the cell centres.
This should not be a problem for objects large in relation to the size of the control volumes use
in the simulation (3 times the cell dimensions). If the object is large and the gauge points are
located at the centres of the object cross section then the computed pressure differential may
be multiplied by 2/ to allow for the sinusoidal variation of load direction over the surface of the
object.
It should also be noted that the gauge points would not capture local pressure increases
where the flow stagnates on the object if they are far from the obstacle in relation to the object
diameter. This may add short duration loads (durations of a few milliseconds) particularly a
high Mach number flows.
For intermediate obstacle sizes it is suggested that the CFD numerical grid be locally refined
until the object is sufficiently resolved in the flow field. The DLM can then be applied.
Alternatively, it is stated that near module vents forces calculated by the DLM and drag
methods are similar. Near the centre of a module the loads on obstacles it is recommended in
the references that both approaches should be used and the larger of the two loads used for
design. It is unlikely that drag loads would in any case be large at these locations so the
pressure difference approach is recommended in this Guidance.
For the simulations considered during the referenced work, it was stated that the peak drag
pressures were about 30 % of the maximum local field pressures and 60 % of the average
overpressures experienced within the module.
Methods for dealing with multiple objects that contribute drag forces to the total load on an
item of equipment are briefly outlined [6.53, 6.60], including a method for dealing with groups
of objects that are partially shielded from the blast wind.
6.11.6 Estimation of vented gas velocities
For the situation of a vented compartment open at one end, with the ambient internal pressure
and the instantaneous overpressure is known, the velocity of the unburned gas may be
estimated using the Rankine-Hugoniot equations for the change in pressure and density
across a shock wave [6.59].
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 256 of 493
There are only two published circumstances where explosion gas velocities have been
measured:
1. The SCOPE experiments executed by Shell where gas velocities were measured
directly
2. The Phase 3b tests where an instrumented cylinder was placed in the vent area of the
Spadeadam test rig [6.39].
The general view is that in CFD codes the pressure and gas velocity is so closely linked at
each point in space and time, that validation of pressure may be sufficient to assume that the
gas velocities are being correctly calculated.
The asymmetric expulsion of vented gases from a compartment may give rise to out of
balance loads or strong shock response.
6.11.7 Strong shock and global reaction loads
The two major sources of out of balance loads from explosions are:
Reaction loads from the expulsion of vented gases.
Side loads due to the ignition of an external gas cloud which has drifted to one side
of the platform the external explosion.
During a vented internal explosion there may be an out of balance lateral force on the
compartment depending on the distribution of vent areas around the module.
Initially it seems that the out of balance force on the module will be equal to PA less any net
forces on internal equipment, piping and vent obstructions. In fact the time for pressure
disturbances to cross the module may be appreciable compared with the load duration and the
inertia of the un-burnt products and external atmosphere will affect the net force. The net force
on the gas volume contained in the module may also be calculated from rate of change of
momentum of the enclosed gas. However, if the local speed of sound is exceeded then the
flow becomes choked and a second shock wave front is set up at the vent, which will restrict
the flow. Obstructions at the vent such as louvers may accelerate the flow locally and induce
these standing shock waves. The backpressure for confined flow may be represented by a
loss factor, which represents the loss of momentum encountered by the flow [6.59].
6.12 Reporting template for ALARP demonstration
The following should be considered when preparing the final ALARP justification for the
management of explosion hazards:
Method of selection of explosion scenarios
Available inventories
Hole sizes and leak rates
Leak locations and directions
Wind speeds, directions and ventilation rates
Cloud build up
Summary of explosion scenarios considered
FIRE AND EXPLOSION GUIDANCE
Issue 1 May 2007 Page 257 of 493
Gas type and concentration
Cloud gas concentration, size, shape and location used in simulations
Ignition point locations considered
Summary of explosion overpressure results
Peak/typical overpressures at a point and over structural panels
Peak/typical impulses at a point and over structural panels
Dynamic pressures
Method of derivation of design basis
Selection of equivalent static pressures if used.
Conversion of typical overpressure/dynamic pressure time histories into equivalent
triangular form, with justification that this form is appropriate
Use of full typical overpressure/dynamic pressure time histories
Statement of explosion loads used in design
Structure, blast walls, decks
Equipment
Piping
Far field blast
6.13 The NORSOK procedure f