SYMPOSIUM SERIES NO.

155

Hazards XXI

# 2009 IChemE

INHERENTLY SAFER DESIGN CASE STUDY OF RAPID BLOW DOWN

ON OFFSHORE PLATFORM
Volton Edwards bpTT
Angus Lyon DNV Energy
Alastair Bird DNV Energy

API STD 521 is intended primarily for oil refineries; it

is also applied to oil and gas production facilities. It gives
guidelines examining the principal causes of overpressure;
determining individual relieving rates; and selecting and
designing disposal systems, including such components as
piping, vessels, flares, and vent stacks.
Section 5.20 of API STD 521 which covers vapour
depressuring states:

INTRODUCTION
A term now in common usage within the oil & gas industry
is inherently safer design. The objective of this phrase is
to promote designs for hydrocarbon extraction and processing facilities that, where practicable, eliminate hazards
completely or reduce the magnitude of the consequences
of hazard scenarios sufficiently to eliminate the need for
elaborate safety systems and procedures.
This paper presents a case study where the principles
of inherently safer design were used to challenge the normally accepted interpretation of the requirements for
depressuring (blow down) systems as set out in the standard
API STD 521, Pressure-relieving and depressuring
systems, (API 2007).
Offshore oil and gas extraction platforms have hydrocarbon containing equipment onboard. The hydrocarbon
containing equipment has maximum design operating parameters, such as a maximum design pressure. Hydrocarbon
extraction is a dynamic process. The hydrocarbon containing equipment is generally equipped with sensors which
monitor the value of parameters, such as pressure. The
sensors often have associated alarms which notify the
plant operator that pressure is increasing. The operator can
then take actions to return the parameter to its normal
value. If the operator intervention fails there is often an
executive action also attached to the sensor which initiates
a shutdown of the plant before the design limits are
reached. In case the shutdown system fails there is often a
secondary protection system. In the case of overpressure
this is generally a relief valve that dumps excess pressure
to a vent or flare.
As well as the protection systems described above, a
blow down system is also generally installed. It has two
main purposes:
1.

2.

Depressuring systems can be used to mitigate

the consequences of a vessel leak by reducing
the leakage rate and/or inventory within the
vessel prior to a potential vessel failure. More
often, depressuring systems are used to
reduce the failure potential for scenarios involving overheating (e.g. fire).
If vapour-depressuring is required for both
fire and process reasons, the larger requirement should govern the size of the depressuring
facilities.
For pool-fire exposure . . . this generally
involves reducing equipment pressure from
initial conditions to a level equivalent to 50%
of the vessels design pressure within approximately 15min.
Depressuring to a gauge pressure of 100PSI is
commonly considered when depressuing to
reduce the consequences from a vessel leak.
In addition, BP has a series of engineering technical
practices with which new platform designs are required to
demonstrate compliance. Two which have requirements relevant to the subject of this paper are:

to reduce the pressure in the hydrocarbon containing

equipment to atmospheric pressure to allow for the
breaking of containment for maintenance and other
reasons, and
To get rid of hydrocarbon inventory and reduce the
pressure in the equipment in the event of an emergency
on the facility.

1. Guidance on Practice for Inherently Safer Design,

(BP 2008), and
2. Fire and Explosion Hazard Management (FEHM) of
Offshore Facilities, (BP 2009)
The inherently safer design technical practice requires
a process to be followed which assesses all hazards and produces a design which, as far as possible, eliminates hazards
or reduces the magnitude of hazard scenario consequences
sufficiently to eliminate the need for elaborate safety
systems and procedures.
The fire and explosion hazard management practices
has a similar intent by requiring a fire and explosion
hazard management (HEHM) document to be developed
which delivers a strategy for each hazard such that major

It is this latter design intent that is the subject of

this paper.

BACKGROUND
When designing pressure-relieving and depressuring (blow
down) systems reference is generally made to API STD 521.

349

SYMPOSIUM SERIES NO. 155

Hazards XXI

accidents1 are prevented or adequately managed to assist

demonstrating that sufficient thought has gone into the
FEHM the practice defines three hazard categories:
1.
2.
3.

ASSESSMENT METHOD
The assessment was based on evaluating the impact on the
consequences of leaks from the process equipment rather
than protecting the equipment from overpressure in a fire
scenario. In particular, the impact on the escalation potential
of fire and explosion hazard scenarios was evaluated as this
is the primary criterion for distinguishing controllable from
evacuation hazard scenarios.
If a process release on the platforms under study
ignites early, it is characterized by a jet fire and if the
ignition is delayed, a vapour cloud explosion will occur,
possibly followed by a jet fire.
Escalation can be through failure of other process
equipment or structures with the explosion.
There are many references which give details of
impacts of fires on components, characteristics of jet fires
and rules of thumb regarding the time taken for items to
fail under fire loading and explosion overpressure. The following is typical and reproduced from Spouge 1999.
Figure 1 demonstrates that steel loses it strength at
elevated temperatures.
A point in time is reached when the heat absorbed by
the steel component reduces its strength to the point at
which the stress in the component5 is greater than the
remaining strength of the steel and the component fails.
The greater the heat flux from the fire the quicker it will fail.
The heat flux at the boundary of a gas jet flame
depends on the composition of the gas and other factors
but is of the order of 200300 kW/m2. This value drops
of dramatically with distance from the flame as shown in
Figure 2.6

Controllable hazards2
Evacuation hazards3
Catastrophic Hazards,4

and requires that every fire and explosion hazard scenario on

the facility is categorized as above. Clearly the desired
outcome is that where practicable all Fire and Explosion
hazard scenarios are categorized as Controllable hazards.
This is in line with the intent of Inherently Safe Design.
BPTT has recently commissioned a series of small
normally unmanned installations (NUIs) (4 6 wells). The
initial platforms had their blow down systems deigned to
reduce the operating pressure to 50% within 15 min. in compliance with the perceived requirements of API STD 521.

CHALLENGE TO THE BLOW DOWN

SYSTEM DESIGN
The perception that designing the blow down system to
achieve 50% reduction in operating pressure in 15 min. is
optimum was challenged for the most recent platform
design in the series. The challenge was based on:
1.

2.

3.
4.

# 2009 IChemE

It ignores the fact that the platforms are producing gas

and not oil and pool fires are not therefore a credible
fire scenario,
It ignores the possible benefits of depressuring on reducing the consequences of unplanned process releases
from whatever cause.
Does it meet the principle of inherently safe design? and
Have the maximum number of fire and explosion
hazard scenarios been categorized as controllable?

To assess whether the challenge was justified the following questions were addressed:
Does a more rapid blow down system produce
an inherently safer design?
Does a more rapid blow down system significantly impact the number of controllable
hazard scenarios?
Is a more rapid blow down system
practicable?
1

An event that can lead to multiple fatalities.

Hazard scenarios that allow personnel to remain safely on the facility .
Precautionary evacuation may take place if it is safe to do so.
3
Hazard scenarios which have the potential to escalate and cause eventual impairment of the protected muster area and evacuation facilities
after a period of time (e.g. endurance period of the protected muster
area).
4
Hazard scenarios which preservation of life of personnel on facility
cannot be demonstrated and the effects of the hazard scenario cannot
be controlled or mitigated such that controlled evacuation can be
performed.
2

Figure 1. Steel strength v. temperature (Spouge 1999)

Either from a structural load or internal pressure.

The heat flux at the flame boundary of a liquid pool fire is significantly
less, approximately 150 Kw/m2.
6

350

SYMPOSIUM SERIES NO. 155

Hazards XXI

# 2009 IChemE

large10 for the purpose of risk assessments. Statistically

the chance of small leaks predominates. The modeling
was based on the most likely hole size (small).
Screens shots of the spreadsheet model are presented
in Appendix A.
Figure A1 displays the spreadsheet with the system
operating pressure and inventory volume of the platforms
discussed in this paper. The blow down is modeled based
on reducing operating pressure to 50% in 15 minutes.
Figure A2 is the same spreadsheet with the same blow
down characteristics and a 10 mm dia. leak. From Figure A2
it can be seen that with blow down11 the flame length starts
at approximately 10.8 m in length, after 5 mins. It is 9.3 m
and after 20 mins. It is still 6m in length. This is a significant
flame size.
In an ideal world, provided that isolation and blow
down are successful, all escalations due to fires would be
avoided. In reality this requires reducing the jet fire length
to less than, says, 1m after 5 minutes.12 To achieve this
requires an initial blow down rate of 41 Kg/sec (see
Figure A3).
The larger the initial blow down rate, in general, the
further the tip of the blow down vent needs to be to the
boundary of the platform to ensure that:

Figure 2. Scale diagram of heat flux from a gas jet fire

. flammable gas clouds cannot be blown back onto the

platform during a blow down and,
. If the vent discharge ignites the level of thermal radiation at the boundary of the platform is within acceptable levels.

Typical failure time for components is presented

in Table 1.
From Table 1 it can be seen that the failure times of
components are significantly shorter if engulfed in the
flame. For example, pipes and vessels can be expected to
fail after 5 minutes if engulfed in a jet fire, but would last
for 60 minutes if the flame is very close but not engulfing.
This information was used to establish a simple escalation rule set as follows7:

In practice, achieving an acceptable vent design for

41 Kg/sec proved impracticable, primarily because the platform design was one of a series of clone designs and the
required location of the vent tip would have required a complete structural redesign of the topsides. A compromise was
reached which reduced system pressure as quickly as possible, commensurate with an initial blow down rate that
allowed a vent to be designed without a total topside structural redesign. The initial blow down rate selected was
approximately 16 Kg/sec which reduces flame length to
approximately 5 m after 5 mins and 1 m after 15 mins (see
Figure A4).

Escalation to process equipment and structures occurs if the component is engulfed in a

jet flame for more than 5 minutes
When a system containing pressurized gas leaks is
isolated, the leak release rate and associated jet flame
length decay exponentially. If the system is equipped with
a blow down system its activation removes gas from the
system, reducing the system pressure, and thus reducing
the leak release rate8 and associated jet flame length. This
is shown diagrammatically in Figure 3.
A simple spreadsheet was prepared to model leak
release rate versus time for given blow down rates and
leak holes sizes using the Chamberlain flame length correlation.9
Leaks can vary in equivalent hole size and are often
characterized under the titles of small, medium and

EVALUATION OF INCREASED SAFETY

ASSOCIATED WITH THE INSTALLED
BLOW DOWN
Although not ideal, the compromise initial blow down rate
reduces the severity of process fires associated with
small releases measurably. What impact does this have
on safety?
One of the main driving forces behind this initiative
was to influence the decisions that the offshore installation
10
Small leaks 10 mm dia.; medium: leaks 25 mm dia.; large
leaks 100 mm dia.
11
It is assumed that isolation has occurred.
12
The actual desired flame length is dependent on the distance of critical
equipment to leak sources.

Assuming no passive fire protection or active water cooling.

8
The leak release rate is a function of the pressure in the system at any
point in time.
9
Flame length (m) 11.14Q0.447 Q release rate (kg/sec).

351

SYMPOSIUM SERIES NO. 155

# 2009 IChemE

Hazards XXI

Table 1. Typical component failure time from fire loading (Spouge 1999)
Times to failure (minutes)
Component

Type of failure

Jet flame

Pool flame

37.5 kW/m2

Steel plate
Steel plate
Steel beam
Steel beam
Jacket leg
Pipe/riser/process vessel
A rated fire wall
H rated fire wall

Yield
Fire penetration
Yield
Collapse
Buckling
Rupture
Fire penetration
Fire penetration

1
5
1
5
15
5
15
100

3
10
2
10
30
10
45
260

20
60
60
120
150
60
70
400

Table 2. Hazard scenario totals

Hazard scenario
category
Controllable
Evacuation
Total

Slow blow
down

Rapid blow
down

28
95
113

42
71
113

chance of each of each hazard scenario escalating is

assessed as part of the QRA. A sensitivity was run on the
QRA model simulating the more rapid blow down. The
change in risk values and the change in number of fire and
explosion hazard scenarios categorized as controllable
and evacuation15 were calculated.
The number of fire and explosion hazard scenarios
that change their category due to the rapid blow down is
shown in Table 2.
The Rapid blow down reduces the number of evacuation hazard scenarios by 24 representing a reduction
of 25%. The increase in the number of controllable fire
& explosion hazard scenarios demonstrates a meaningful
contribution to an inherently safer design.

Figure 3. Leak Release rate with Blow down

manager (OIM) must make subsequent to a confirmed

process release on his/her facility. Soon after the release
event the OIM must decide whether to keep personnel on
the facility or carry out a precautionary evacuation.
Evacuation via lifeboat, or other means such as barrel
rafts, have their own set of hazards and are not risk free. It is
not a decision to that should be made lightly.
One of the main considerations that the OIM will base
his/her decision on is whether the event is controllable,
i.e. are the characteristics of the event such that, provided
personnel are protected from the immediate effects, the
overall integrity of the facility will not be compromised,
in other words the event will not escalate.13
This fits neatly with the BP requirement to categorise
all fire and explosion hazard scenarios as described in
Section 2. The difference in the number of controllable
and evacuation hazard scenarios was therefore evaluated
as a measure of improved safety.
Quantified risk assessments (QRAs) have been
completed for the clone design NUI platforms. The QRAs
evaluate all14 fire and explosion hazard scenarios. The

DISCUSSION
The initial blow down rate is not the only variable that influences the number of controllable hazard scenarios. The
volume of the inventory isolated when shut-in also has a significant impact. If, for example, the isolated inventory was
reduced by one third, the flame length after 5 minutes
would be reduced to 1m rather than the 5 m with the
revised blow down rate.16 The reason for discussing this
volume is because the present design of the NUI platforms
has emergency shut-down valves at the wells and export
riser. The topside is effectively a single inventory. There

13
Escalation is the failure of critical equipment e.g. other pipes, vessels,
key structural members or evacuation equipment.
14
Various leak hole sizes and leak locations within the process area.

15
Evacuation hazard scenarios include fire & explosion hazard scenarios with the potential to escalate.
16
Based on a 10 mm dia. leak.

352

SYMPOSIUM SERIES NO. 155

Hazards XXI

are two manifolds which have manual isolation valves separating them from the remainder of the topside pipe-work.17
Both manifolds and the topside pipe-work have blow down
valves installed. If these isolation valves were actuated and
tied into the shut-down system there would have been three
isolatable sections each with approximately one third of the
inventory.
As can be seen form the above when developing the
hazard management strategy for process fires there is
value in considering variations in both blow down characteristics and isolation philosophy.
One item not discussed so far which should not be
overlooked when developing the design of a blow down
system is the effect that rapid blow down has on the temperature of the hydrocarbon, both upstream and downstream
of the blow down valves. Very low temperatures can be generated at high blow down rates and appropriate pipe and

17

# 2009 IChemE

vessel materials must be selected. The previous vent

design used material good for 2208F. During a rapid
blow down the gas temperature was calculated to drop to
2608F. However detailed heat transfer calculations
determined that the steel wall temperature never dropped
below 2408F. Material suitable for 2408F was procured
for the vent.

REFERENCES
API 2007, Pressure-relieving and Depressuring Systems, Standard 521
BP 2008, Inherently Safer Design bp Group GP 48-04
BP 2009, Fire and Explosion Hazard Management (FEHM) of
Offshore Facilities GP24-20
Spouge, John 1999, A guide to Quantified Risk Assessment for
Offshore Installations CMPT publication 99/100a

Used to isolate a manifold for maintenance purposes.

353

SYMPOSIUM SERIES NO. 155

Hazards XXI

APPENDIX A: BLOW DOWN SPREADSHEET

SCREEN SHOTS

Figure A1. Blow down to 50% of Operating Pressure in 15 mins.

354

# 2009 IChemE

SYMPOSIUM SERIES NO. 155

Hazards XXI

Figure A2. Blow down to 50% of Operating Pressure in 15 mins. 10 mm dia. leak

355

# 2009 IChemE

SYMPOSIUM SERIES NO. 155

Hazards XXI

Figure A3. Rapid blow down

356

# 2009 IChemE

SYMPOSIUM SERIES NO. 155

Hazards XXI

Figure A4. As installed blow down

357

# 2009 IChemE