18th Annual International Symposium

October 27-29, 2015 College Station, Texas

Is Your Temporary Refuge Truly Safe?

Chandra Gulati
Shell Upstream Americas
This title was presented at the 2015 International Symposium.

Is Your Temporary Refuge Truly Safe?

Chandra Gulati
Shell Exploration & Production Co.
150C N. Dairy Ashford, WCK A416-D
Houston, TX - 77079
Email: cmgulati@gmail.com

ABSTRACT
The increasing complexity and size of offshore facilities are resulting in increasingly larger
numbers of people working and residing at these installations. The Temporary Refuge (TR) is a
key safety system to keep the personnel staying on board offshore oil & gas facilities safe from
hazards of fire and explosion. The UK Health and Safety Executive (HSE) define the TR as: "a
place where personnel can muster safely in an emergency, monitor and assess the developing
situation, and either take control action or initiate evacuation.
The application of a structured approach for the management of hazards through the lifecycle of
an offshore facility is essential to keeping people safe. The paper outlines lessons learned from
Gulf of Mexico (GoM) experience with the decay of the Temporary Refuge System integrity due
to aging. Further, the paper will discuss how changes and additions to facilities can impact TR
integrity throughout its lifecycle.
To ensure the integrity of the Temporary Refuge System throughout the life of the facility, it is
essential that programs are in place to periodically identify how changes to facility design and
operation can result in new threats to the TR. The process to identify and manage these potential
threats is described in the paper, along with an outline of the program implementation at Shell in
the GoM. In addition the paper will detail how changes in corporate risk acceptance have driven
changes and retroactive upgrades to the TR, along with the associated process used to identify
the gaps and implement the identified additional mitigation measures. Additionally the processes
used to ensure the performance of maintenance and inspection and to effectively meet the
required integrity levels are discussed. In summary this paper discusses the challenges of
sustaining the integrity of TRs and the learnings gained over the years from the management
process in the GoM.
INTRODUCTION
Offshore oil & gas facilities have become larger and more complex as production has moved into
deeper and deeper waters. The enlarged size and complexity of the facilities has resulted in
increased congestion on one hand while increasing the likelihood of the release on the other.
The two factors combine to increase risk to people, environment and assets. Growing numbers of
people on board (PoB) these facilities has further increased the severity. It is imperative that the
facilities are designed to protect the personnel from credible accident events.
The provision of Temporary Refuge (TR) on offshore installations was first recommended by the
Cullen Report which published the results of the investigation into the Piper Alpha disaster. The
2

UK Health and Safety Executive (HSE) define the TR as: "a place where personnel can muster
safely in an emergency, monitor and assess the developing situation, and either take control
action or initiate evacuation. The TR provides protection to personnel from hazards of fire,
explosion and associated consequences while they remain on the installation. In general the
facility living quarter is designed to be a TR though it doesnt have to be enclosed or integrated
with the living quarters. The temporary refuge is also equipped with facilities for monitoring and
control of the incident and for organising safe and complete evacuation, if necessary. The
temporary refuge is required to maintain its integrity during the period required to complete safe
evacuation. This period includes full muster, situation assessment, response and control actions
(to mitigate) and time to complete the evacuation.
While the facilities are typically designed with the prevailing industry and company best
practices, industry and company practices continue to evolve. The evolution of industry practices
and company practices is due to learnings from operations and accidents, innovation in
technology and software tools (used for fire and explosion hazard assessment) and changes to
risk acceptance in industry and within the company.
The potential combination of scenarios which may render TR ineffective are;

Facilities designed and built based on the prevailing design standards and practices prior
to the evolution of sophisticated fire and explosion models.
Significant changes to the facility in terms of the addition of new equipment resulting in
increased fire and explosion hazards (e.g., increased overpressure, degradation over time
etc.).

This can render the TR ineffective and unable to fully protect personnel from credible major
hazard events. This paper discusses the typical design integrity requirements, causes of TR
impairment and how the design integrity can be maintained through the life of the facility.
METHODOLOGY
About a decade ago Shell started an initiative to develop a comprehensive fire explosion and
evacuation strategy for its existing Gulf of Mexico (GoM) facilities which at the time included
five large floating Tension leg platforms and a number of shallow and deepwater fixed leg
facilities. Some of these facilities were in operation before the Piper Alpha incident and were
reflective of the design standards, practices and philosophies in place at that time.
As part of this initiative following seven recovery measures were examined to evaluate the
overall ability of personnel to safely muster and evacuate the facility in the event of potential
major hazard scenarios as shown in figure below.

Figure 1: Managing Major Hazards Primary Recovery Measures

Over 70 minimum functional requirements were identified to evaluate the effectiveness of these
recovery measures, some of which are listed below:

Development of risk based criteria for blast rating of TRs and retrofit to meet these
criteria (many older facilities were developed before design for explosion was the norm)
Leak test on TRs and associated upgrades
Provision of and/or upgrade of electronic fire and gas detections systems
Upgrade of active fire fighting measures
Provision of blowdown systems on all facilities
Automation of emergency shutdown actions, including blowdown
Provision of shutdown valves on all risers and pipelines
Lifeboat weight and capacity upgrades

TR HAZARD ASSESSMENT
The process of TR design requires identification of all credible hazards and assessment of their
potential to cause TR impairment. The design specification is developed based on this
assessment such that TR can survive for specified duration to allow safe and complete
evacuation. The specified duration includes time to muster, time to assess the situation and
respond, time to control the event or complete evacuation and is referred to as endurance time.
The TR is designed to allow for muster of maximum POB (personnel on board).
The TR integrity is defined as the ability of the TR to protect the occupants for a specific time
period (endurance time) until they fully evacuate the installation or recover following a
hazardous event. The TR is considered to be impaired if the environment in the TR is degraded
to an extent that personnel are unable to carry out safety related functions.

The potential sources of TR impairment are major hazard events arising from the following
sources:

Well Blowouts or an uncontrolled release of fluids from a well.

Riser/Pipeline Leaks leaks in sections of pipeline leading from the seabed to the
installation.
Process leaks leaks occurring in the production flow not covered in the above
categories.

This paper is primarily focused on potential hydrocarbon related events and thus the other
potential sources for TR impairment such as ship collision, collapse of tall structures and
helicopter crash etc., are not addressed. The released hydrocarbons from the above leak sources
may ignite and result in fire and/or explosion leading to TR impairment by;

Fire/Radiation: Loss of integrity due to fire /radiation can result from following two
leading scenarios;
Fire/radiation impacting the TR boundary - The integrity loss may result from either
increase in temperature inside TR to unsustainable levels for people, penetration of
the boundary, or collapse of the structure.
Fire/radiation impacting the TR supporting structure - The integrity loss may result
from collapse of structure supporting the TR
Blast Overpressure: Explosion overpressure on any external wall above the rated capacity
resulting in collapse of the wall/TR building or penetration of the boundary allowing
subsequent impairment by smoke, contaminants and heat.
Ingress of Contaminants: TR is likely to experience degradation of air quality if engulfed
by smoke and gases during a major hazard event. The TR is considered impaired when
the concentration levels for contaminants exceed prescribed limits.

TR INTEGRITY ASSESSMENTS
The TR consists of following three systems and the integrity of the TR depends on meeting
minimum functional requirements and proper functioning of each of these systems.

structural integrity;
command support; and
escape and evacuation.

Examples of the minimum functional requirements are noted below;

The Fire and Gas system is designed to take executive action, i.e. shutdown all nonessential equipment or all equipment (electric, fired, etc.) depending on the severity of the
event.
To provide the means for platform management or ICS team to communicate with all
platform personnel and sound alarms throughout the facility during an emergency.

In addition to defining the minimum functional requirements, minimum survivability criteria

were defined for TR. Comprehensive integrity assessments were conducted for each installation
to assess the integrity of the TR with respect to the minimum functional requirements, including
site visits by Subject Matter Experts (SMEs). The SMEs identified gaps in these functional
5

requirements and performed calculations and modelling to determine if the TRs met the
minimum survivability criteria. The identified gaps in the functional assessments were evaluated
by multi-disciplinary team utilizing risk based approach. Options were evaluated to determine
which combination of gap closure options would deliver required TR performance. The final gap
closure plan was developed after conducting a risk based assessment to manage risks to ALARP.
All agreed risk reduction recommendations from the ALARP assessment were implemented and
have now been closed.
STRUCTURAL INTEGRITY
The TR structural integrity depends on number of structural components including the TR
structure itself, supporting structures, and for mobile unit components providing for buoyancy,
stability and station keeping. The design of adjacent structures including cranes, helidecks and
derricks were also assessed to ensure their impairment did not led to impairment of the TR.
Selective Passive Fire Protection was applied to such structures to ensure that in event of
structural failure these collapse away from the TR.
The TR design should minimise the number of external doors as these are the weak points in the
structural integrity of a TR. TR doors should be located such that potential impairment by radiant
heat and blast overpressures is minimized. The TR doors and doorframes are designed to
maintain the integrity of bulkhead in which they are placed when subjected to fire and
overpressure. Windows should be avoided and where provided these should match the fire and
blast ratings of the bulkheads in which they are placed. A number of doors were replaced or
upgraded and windows were covered with metal shields as a result of this initiative.
Operating experience and integrity assessments have shown that the integrity of the TR can be
vulnerable for multiple reasons; the prevailing ones are detailed below;

TR Design Blast Resistance

POB Increase
Air Quality

TR design blast resistance

Some of the older facilities were built prior to existence of sophisticated fire and explosion
models and absence of consistent blast design criteria. Detailed CFD based explosion modelling
was conducted to determine the blast over pressures for each facility based on pre-defined
exceedance criteria. After initial installation the facilities continue to undergo changes as a result
of tie-in of new risers/subsea developments, modification or upgrades to equipment, addition of
new equipments and deck extensions etc. Often these changes are in small increments and by
themselves do not significantly change the risk profile of the facility. However, over time the
cumulative effect of the changes may result in significant changes to the risk profile. For
example, the addition of equipment for subsea tie backs or to increase oil recovery later in field
life, deck extensions, risers etc. over period of time can significantly increase the number of the
leak sources and the degree of congestion on the facility increasing the magnitude of the
facilities credible overpressure event.
Where the calculated blast overpressure exceeded the stated nominal blast resistance of the
building, detailed structural studies were conducted to determine actual blast resistance. Where
6

the gaps or deficiencies were identified, the structure was reinforced to achieve required blast
resistance. On one facility the cumulative effect of the changes increased the calculated credible
exceedance overpressure which was determined to be higher than the blast resistance of the TR.
Reinforcement of the TR structure itself was not practicable in this specific case hence it was
decided to provide a large blast wall to shield the Multi-level TR building. Additionally the
windows were covered with steel plates to protect damage from blast overpressure and a
program was instituted to repair and maintain the integrity of PFP coatings on all installations.
Increased POB The POB of facility is often increased from the original design due to
increased needs for facility operation, testing and maintenance or for long term projects. Often
temporary or permanent sleeper buildings are placed on the facilities to accommodate increased
personnel on board. In the past the risks associated with increase in POB were sometimes not
recognized and assessed. The additional personnel on-board not only require additional lifeboat
capacity, and additional mustering space but potentially increased time for evacuation. The
existing mustering area may not be adequate for the number of personnel increased neither the
increased time required is beneficial. Additionally these buildings need to be designed to provide
protection from fire and explosion hazards.
The assessments conducted at facilities identified sleeper buildings which did not meet the
integrity requirements and these were replaced. To prevent similar occurrence in future an
occupied building procedure was developed & implemented with a detailed specification,
checklist, required assessments, and review & approval requirements.
Air Quality
The TR fabric or external surface has many potential leak paths by way of doors, windows and
other penetrations such as galley hoods, laundry vents and cabling. The wind introduces a
differential pressure between windward and leeward side of TR resulting in outside air moving
into the TR. The movement of outside air into the TRis measured in terms of Equivalent Air
Change Rate. In a large leak or fire/explosion event the TR would experience ingress of smoke
and/or hazardous and the contaminants inside TR will gradually build up leading to TR
impairment.
Prevention of smoke and/or hazardous gas ingress into TR, to provide breathing air quality for
the TR endurance period is required to maintaining TR integrity. The HVAC units in TR are
automatically shut down and dampers closed if smoke or hazardous gas reaches the HVAC
intakes or by loss of HVAC power. The duration for which air quality is maintained is function
of TR leak rate or Air Change Rate (ACH). The leakage rate for TRs should be low enough
such that the air quality is maintained for the defined endurance period. Depending on the
duration of the endurance period the target leak rate may range from 0.1-0.5 ACH.
The actual leakage rate on some of the older facilities was found to be higher and may lead to TR
impairment. Examples include damaged seals around doors and penetrations with HVAC
damper(s) impaired. The assessments identified several problems including;

No HVAC shut in system

Non-functional fire & smoke dampers (in HVAC air intakes & exhausts) in stuck open
condition
Non-Fire & Smoke rated dampers (in HVAC air intakes & exhausts)
Large penetrations in TR with no fire & smoke dampers
7

Damaged doors which failed to fully close and latch

Doors with damaged or missing seals
Doors with unknown or inadequate fire rating

Many of the items listed above were addressed prior to leak testing. The leak testing of the TR is
the only practical method to determine the leakage rate in terms of Air Change Rate. A blower
door test was performed on all TRs. The blower door test measures the effective Air Change
Rate by pressurizing the TR. The blower door test program show that the TR met acceptable
leaks rates provided the items listed above were addressed.
To ensure that the TR delivers its intended design function a test should be performed during
commissioning and regularly during operations to measure and monitor the leak rate. If the
measured leak rates exceed the design leak rates then the measures should be undertaken to
investigate and fix the leakage rates.
It is evident from the findings that the safety critical equipments (e.g., HVAC system, fire and
gas detection etc.) must be part of a comprehensive testing, inspection and maintenance
programme to insure equipment continues to meet the required functional performance.
COMMAND SUPPORT SYSTEM
The command support system enables effective communication, monitoring and control to affect
suitable response to a major incident. These typically include systems which ensure that adequate
information on the condition of the facility and operation of key safety systems is available to
allow decisions to be made on the need to stay or evacuate and the ability to request outside
assistance. The emergency power is designed to be available for functions essential to maintain
TR integrity i.e., communications, monitoring and control, and emergency lighting. Emergency
power should be available for duration greater than the TR endurance period. The emergency
lighting is required in all area required for muster and safe evacuation from the facility by any
designated means.
Emergency Systems: Assessments identified several gaps in key systems including
communications systems, emergency power (UPS) and emergency lighting. In some instances
communication systems were added in late stages of the projects and the communication
modules (enclosures) were placed in process area making them more vulnerable to impairment.
Following the assessment, the communication equipment deemed emergency critical were
relocated to safe area. Additionally the following common deficiencies were identified;

UPS significantly degraded or overloaded

Emergency lighting systems degraded
Essential equipment not connected to emergency power (e.g., one of the facilities lost all
communications except for satellite phones and handheld radios were lost on loss of
power. It was later found that the fixed communication equipment were erroneously
connected to the normal power bus instead of the emergency power bus following
relocation).

ESCAPE AND EVACUATION SYSTEM

The evaluation of TR impairment included assessment of the adequacy of Escape and
Evacuation Systems. As mentioned the TR provides a safe refuge until the incident is either
brought under control or evacuation is required. Escape routes are designed to provide direct and
safe means for personnel to reach the TR. It is typically achieved by separation of escape routes
or where this is not possible by direct protection. A minimum of two independent routes (to
prevent impairment by the same incident scenario) are provided.
Evacuation systems are provided to facilitate safe evacuation from the facility. The primary
means of evacuation include bridge-linked installations, helicopters. Secondary means of
evacuation is typically a survival craft such as TEMPSC (Totally Enclosed Motor Propelled
Survival Crafts). Tertiary evacuation systems intended for use only in circumstances where
evacuation by primary or secondary methods is not possible are life rafts, personnel chutes, etc.
Impairment of Escape & Evacuation Systems
The study looked at the design integrity of the lifeboats or TEMPSC. A study conducted to
assess the average weight of the personnel working at Shell installations in GoM had increased
over the years to 210 lbs. This raised immediate questions on the accuracy of life boat load
capacity as the average weight of personnel working at Shell installations far exceeded the
average design weight basis of personnel (165 lbs). A new lifeboat failed catastrophically during
initial load testing. The follow-up investigation and detailed engineering assessment indicated
several design and manufacturing deficiencies.
To mitigate the above risks a new design and engineering standard was developed for lifeboats
(TEMPSC) addressing the load capacity and structural integrity. Two of the key design
requirements are noted below;

The lifeboats design load capacity was exceeded as average weight of personnel working
offshore far exceeded the average design weight basis (210 lbs vs 165 lbs).
Specification of increased design safety factors to account for variability in fibreglass,
fabrication techniques employed and lack of lifeboat design safety factor validation with
an objective to enhance and assure the design structural integrity of the lifeboats.

CONCLUSION
The paper shows that changes to the facility and/or degradation of key safety system during the
life of the facility can lead to impairment of the Temporary Refuge. A comprehensive evaluation
of the hazard scenarios which could lead to functional impairment of the key Safety Systems
relied on to ensure that the TR continues to provide a safe refuge is recommended. A five step
process is suggested:
1) Identify major hazards scenarios which could impact the TR.
2) Identify safety systems / equipment required to ensure the TR provides a safe refuge.
3) Specify functional performance criteria for each system, and implement an integrity
management system to periodically verify the performance criteria are met
4) Include step for Process Safety Professionals to evaluate potential TR impairment as part
of MOC process.
5) Periodically conduct detailed major hazard evaluation studies to assess the adequacy of
the TR with potential changes in assessed risk and industry risk acceptance criteria.
9

REFERENCES
1. UK Health & Safety Executive, Testing regime for offshore TR-HVAC fire dampers & TR
pressurization requirements, Offshore Information Sheet No. 1/2006.
2. UK Health & Safety Executive, Modelling smoke and gas ingress into offshore temporary
refuges, Research Report RR997.
3. UK Health & Safety Executive, Guidance on Risk Assessment of Offshore Installations.
Offshore Information Sheet No. 3/2006.
4. UK Health & Safety Executive HID Inspection Guide Offshore, Inspection of Temporary
Refuge Integrity (TRI).
5. Stewart, C., Sheikh, S., Robinson, C, A New Guideline Document for Temporary Refuge
Testing, April, 2013, SPE International, SPE 164948.

10