News 30

FABIG NEWSLETTER
http://www.fabig.com Issue No.30 October 2001

Published by:
The Steel Construction Institute
R412 EDITORIAL
Welcome to the 30th issue of the FABIG Newsletter. blast engineering:
FABIG held its 23rd Technical Meeting on the 11th  Correction note (leaflet which is enclosed with
and 12th of September on Fire and Blast Issues on this Newsletter) and corrected article that was
Deepwater Platforms. The London meeting coincided previously published as R406 ‘A Workbook
with the tragic events that were caused by the terrorist Approach to Estimating the Flammable Volume
attacks in the United States. Dr Charles Smith of Produced by a Gas Release’ (see Article R416).
the Minerals Management Service (MMS) in the  Risk Based Design of Passive Fire Protection,
USA was very kind to continue with the scheduled which incorporates risks, costs and benefits in the
meeting in Aberdeen despite the tragic events of the decision making process (see Article R417).
day before. Our sincere condolences and sympathies  Safety Management Offshore: A Systematic
go to him and to the American people. Approach, which is intended to maintain risk
within acceptable range in an organisation’s
Delegates at the above meeting should have operations (see Article R418).
already received copies of the Technical Meeting  New Guidelines on Pressure Relief and Blowdown
Review and Certificates of Attendance at the Systems, which report on the results of a Joint
Technical Meeting. Industry Project on safe and optimum design of
such systems (see Article R419).
We have been very busy lately, issuing Technical Note
6 (Design Guide for Steel at Elevated Temperatures The FABIG Steering Committee meeting took place
and High Strain Rates) and organising future FABIG on the 11th of September 2001. Several items were
activities and deliverables that are coming up over discussed including extending our membership to the
the next few months. The December Technical downstream oil and gas industry (see article R414).
Meeting will be on Process Integrity and its Role
in Mitigating Fire and Blast. Speakers from Nova We would like to encourage our members to use the
Scotia Offshore Petroleum Board, HSE and Shell search facility on our web site, which allows users to
are expected to contribute at the meeting. Our next search through all past FABIG deliverables including
Technical Meeting tentatively scheduled for the end individual Newsletter Articles. FABIG needs and
of January will be on our forthcoming Technical Note welcomes your feedback on how the search facility may
entitled “Extensions to the BIGGS Method”. Our last be improved further (e.g. additional search keywords).
Technical Meeting for the current year scheduled for
early April 2002 will be on the COMAH Safety Case I look forward to meeting you at future Technical
(See the Steering Committee Article R414). Meetings and other related events. Meanwhile, if you
have any suggestions or comments on any FABIG
We have a series of articles in this issue, which focus deliverable or activity, please do not hesitate to contact
on recent improvements in our knowledge of fire and me (Fadi Hamdan) at the SCI.
CONTENTS PAGE PAGE

EDITORIAL
Risk-Based Design of Passive Fire Protection 8
Editorial October 2001 1
RESEARCH AND DEVELOPMENT
FABIG
Safety Management Offshore: A Systematic
FABIG Membership 2
Approach 13
FABIG Steering Committee 3
New Guidelines on Pressure Relief
20
FABIG Web Statistics 4
CONFERENCES, SEMINARS & COURSES 23
Silwood Park, Ascot, TECHNICAL DISCUSSION
Berkshire, SL5 7QN, UK CONTACT & FEEDBACK FORM 24
A Workbook Approach to Estimating the Flammable
Tel: +44 (0) 1344 623345 Volume Produced by a Gas Release 5
Fax: +44 (0) 1344 622944
E-mail: fabig@steel-sci.com
http://www.fabig.com
FABIG
R413 FABIG MEMBERSHIP

(as of September 2001)
Oil Companies University

Agip (UK) Ltd Heriot-Watt University, Edinburgh
Amerada Hess Ltd Imperial College of Science, Technology and Medicine
BG University of Bath
BP University of Kingston
Chevron (UK) Ltd University of Liverpool
Chevron, USA University of Manchester
Den norske stats oljeselskap AS University of Ulster
Enterprise Oil plc
ExxonMobil Development Corporation Consultant / Contractor
ExxonMobil Production Corporation Advantica Technologies Ltd
Gaz de France AMEC Services Ltd
Kvaerner Hydrocarbons Amey VECTRA Ltd
Maersk Olie og Gas AS Astonframe Ltd
Marathon Oil UK Ltd BOMEL Ltd
Norsk Hydro COWI (Consulting Engineers &
Shell (UK) Exploration & Production Planners) AS
Talisman Energy (UK) Ltd CREA Consultants Ltd
TotalFinaElf Exploration UK plc EQE International Ltd
Woodside Energy Galbraith Consulting Ltd
GexCon AS
Regulator Granherne Ltd
Canada Nova Scotia Offshore Petroleum Board Kellogg Brown & Root
Health & Safety Executive MSL Engineering Ltd
Minerals Management Service Offshore Environmental Services
Norwegian Petroleum Dictorate RAMBØLL
Risk, Reliability and Safety Engineering
Manufacturer Safetec Nordic AS
Century Dynamics Ltd Salamis (Marine & Industrial) Ltd
Cintec International Ltd SAUF Consulting Ltd
International Coatings Ltd WS Atkins
MechTool Engineering Ltd
Shell Global Solutions Ltd
Van Dam bv
Verifier
Det Norske Veritas AS
Det Norske Veritas Ltd
Det Norske Veritas Principia
Lloyd’s Register of Shipping
Nederlandse Aardolie Maatschappij B.V.
Page 2 Issue 30 - October 2001

FABIG
R414 FABIG STEERING COMMITTEE MEETING

Introduction search through previous Technical Meeting Reviews, Newsletters
and Technical Notes is believed to be currently underused. FABIG
The activities of FABIG are monitored and directed by a Steering
was asked to report on site access statistics (see Article R415) and
Committee drawn from the FABIG membership. The Steering
to try to determine the location of people using the web site. It was
Committee has members from organisations that represent the
also suggested that it would be beneficial to FABIG and FABIG
breadth of industry sectors with interests in FABIG. The following
members for reciprocal member links to exist with the site.
are the current members of the FABIG Steering Committee:
A Chart showing FABIG deliverables since FABIG’s establishment
Richard Barnett Kellogg Brown & Root
(1992) is shown in Figure 414.1.
Brian Corr BP
Fadi Hamdan SCI
Howard Harte Health & Safety Executive Finances and Membership
David Piper Amey VECTRA The Steering Committee reviewed and endorsed the income and
Nilesh Popat WS Atkins expenditure for the current FABIG Year to date (April 2001 to end
Terry Rhodes Shell UK Exploration of August 2001). It was noted that the membership fee has not
Graham Schleyer University of Liverpool increased for the last 10 years (since it has not kept up with inflation,
Niall Sinclair Amerada Hess the FABIG membership has actually decreased in real terms). The
Charles Smith MMS FABIG Project Manager was asked to review this and consider an
inflationary rise to ensure that FABIG is able to continue to generate
The most recent FABIG Steering Committee Meeting was held on all its deliverables.
11th September 2001 and this article summaries the key points of
discussion and decisions arising from this meeting. The FABIG Project Manager was asked to contact several
organisations (including the Danish and Australian regulators,
FABIG Deliverables and UK operators who are not FABIG members) to discuss possible
FABIG membership.
All of the FABIG deliverables were reviewed. It was noted that the
recent Technical Meetings had very strong attendance in both
The Steering Committee was pleased to learn that the Nova Scotia
London and Aberdeen. The topic of the next Technical Meeting,
Offshore Petroleum Board has now become FABIG members. It
to be held in early December in London and Aberdeen respectively,
was decided that the drive to increase FABIG membership abroad
was agreed as Process Integrity and its Role in Mitigating Fire and
should continue and that FABIG should participate in the 2002
Blast. Topics for forthcoming Technical Meetings were decided
OTC Exhibition.
as The Modified BIGGS Method (to be held in late January 2002)
and the COMAH Onshore Safety Case (to be held in April 2002).
A Technical Meeting will also be held on Phase IIIb Fire and Blast Future Trends
Joint Industry Project in late June 2002. The Committee discussed extending FABIG activities into new
geographical areas and into the downstream oil and gas market, in
This year two Newsletters have been published so far (Issues 28 – line with many of its members’ interests. The April 2002 Technical
April 2001 and Issue 29 - July 2001). Two more Newsletters are Meeting will be on the COMAH Onshore Safety Case and will
being published before the end of the calendar year (October 2001 launch FABIG onshore.
and December 2001). It was decided to send an electronic copy of
the Newsletter for all main contacts in the various FABIG member Further information
organisations. The objectives of the electronic copies are to provide
For further details, please contact:
an added value to our members and to increase FABIG exposure
within the member organisations. However, our member
Fadi Hamdan or Martin Homer
organisations that feel they are unable to prevent piracy of the
Newsletter are kindly requested to refrain from placing it on their
Silwood Park
intranet sites.
Ascot
Berkshire SL5 7QN
It was noted that the Web Site was used primarily to provide
United Kingdom
information on FABIG for prospective members, and to contact
FABIG on-line (e.g. to register for Technical Meetings). However,
Tel: +44 (0) 1344 623 345
the search facility on the FABIG Web Site which allows users to
Fax: +44 (0) 1344 622 944
E-mail: fabig@steel-sci.com
Web Site: http://www.fabig.com
Figure 414.1 Variation of FABIG deliverables with time
Issue 30 - October 2001 Page 3

FABIG
R415 FABIG WEB STATISTICS

FABIG Web Site statistics are shown in an attempt to better
understand by-whom and for-what the FABIG Web Site is being
used. N o. of
Domain
requests
For those of you who are not familiar with our web site, you may 68488 Commercial (.com)
use the FABIG search facility to search through all past FABIG
deliverables. The web site may also be used to get details of Non-Profit Making
forthcoming Technical Meetings, and to register on-line for these 56127
Organisations (.org)
meetings. You can also use the web site to get details of FABIG
members (and in some cases the members’ web site). 9601 United Kingdom
5737 Network
We are eager to receive your comments on how we can improve
the web site to better serve your needs. 1327 Australia
1262 Norway
% of Area Related to 766 France

Requests Request
657 Denmark
31 Technical Meetings
652 Canada
23 Deliverables
471 Argentina
18 Membership 286 Netherlands
16 Information About FABIG 280 Germany
8 Conferences 227 Austria
3 Forthcoming Events 195 Greece
Table 415.1 Web access per request 167 USA Military
137 Brazil
137 Malaysia
Table 415.2 Web access per domain

Technical Discussion
R416 A WORKBOOK APPROACH TO ESTIMATING THE

FLAMMABLE VOLUME PRODUCED BY A GAS
RELEASE
Introduction the data to detect any obvious trends and to produce correlations
Over the past few years, work has been carried out to assess the to reflect such trends; using a number of simple integral or zonal
consequences of gas explosions in offshore modules [1,2]. This models to examine factors such as the significance of the release
work has often included studies of a “worst case” scenario, in buoyancy or momentum and finally, for the use of a commercial
which a module has been filled with a stoichiometric gas-air CFD package to simulate a number of the experiments. Further
mixture and the pressure that has been generated as a result of details of the experimental programme and of the findings of the
the combustion of the mixture has been recorded. The results of technical committee are given in the papers published at the
these studies have provided information to assess the maximum ERA annual conference on Offshore Installations: Fire and
severity of a gas explosion in offshore modules and on the Explosion Engineering [4,5]. It was noted in the most recent paper
circumstances in which the explosions can be mitigated through that the technical committee had commissioned the production
the use of water sprays, for example. The studies have also of a workbook. This workbook was to be based on the results of
helped guide the development or validation of mathematical that experimental programme and was to provide the user with a
models for gas explosions. rapid technique for estimating the flammable volume arising from
the release of natural gas within a naturally ventilated offshore
However, these studies by themselves do not provide an process module. This workbook has now been completed and a
accurate assessment of the hazards produced by a specific gas brief summary of it is given in the remainder of this article.
release in a module. In particular, a specific gas release may not
result in a uniform stoichiometric mixture throughout the module. The Workbook Approach
The pressures such modules would experience as a result of an
The approach adopted in the workbook is to provide separate
explosion arising from that release may be less than would be
methods to determine the ventilation flow through a confined,
assumed, based on the results of a “worst case” explosion of a
congested region and to determine the flammable volume based
stoichiometric gas cloud extending throughout the entire module.
on that ventilation flow, the gas release characteristics and the
This may have implications for the design of modules and their
geometry of the region. In determining the flammable volume
protective systems.
two estimates are made:
Considerations such as these led the UK Health & Safety
l an upper, but realistic, estimate of the flammable volume that
Executive to organise a meeting in 1996, to review the state of
a certain release would produce; and
knowledge on gas dispersion in offshore modules. Further
l a mid-range estimate of the “typical” flammable volume that
discussions arising after the meeting led to the formation of a
a release would produce. That is, when many possible release
joint industry project to undertake a study entitled “Gas Build
positions, rates, orientations and geometries are being
Up from High Pressure Natural Gas Releases In Naturally
considered within a quantitative risk assessment what is a
Ventilated Offshore Modules.” The project was carried out on
“typical” value for the flammable volume.
behalf of a group of eleven sponsoring companies (BG plc, BHP
Petroleum Ltd., BP Exploration Operation Company Ltd.,
Enterprise Oil plc, Elf Exploration UK plc, Health and Safety The former can be used in a screening stage to determine if a
Executive, Marathon Oil UK Ltd., Mobil North Sea Ltd., Shell more detailed analysis is necessary and the latter may be used
International Petroleum Company, Texaco Britain Ltd. and Total to give a ‘best estimate’ of the likely outcome.
Oil Marine plc) and was managed by BP Exploration. The project
commenced in September 1997 and a series of 66 large-scale The approach adopted in the analysis is to describe the flow
experiments was carried out at the Advantica test site at and dispersion in terms of a number of relevant non-dimensional
Spadeadam in Cumbria, England. Measurements were taken variables.
during the experiments by Advantica and Shell Global
Solutions, [3]. The test rig in which the experiments were carried The flow through the module is characterised by a representative
out had previously been used for the Blast and Fire Engineering ‘ventilation velocity’ that is assumed to be related to the external
Project for Topside Structures-2, co-ordinated by the SCI [1], and wind field in a functional way as:
it represented at full scale an offshore process module of the
Uv
type in operation in the North Sea. = f1 (geometry and orientation, confinement, congestion)
Ua
A technical committee was set up with members elected from BP,
Advantica (formerly BG Technology) and Shell and with an where Ua is the ambient wind speed upwind of the module and
independent expert from Cambridge Environmental Research U v is the ventilation velocity through the module. Non-
Consultants representing the interests of the sponsors. The dimensional geometry and orientation, confinement and
committee members were responsible for producing computer congestion variables are then defined to allow the characteristic
software to enable the gas cloud to be visualised; for analysing velocity to be evaluated.

Similarly, a normalised or non-dimensional volume of the

flammable gas cloud is defined as a function of the relevant non-
dimensional independent variables by:
Vf
= f 3 (R )
Vm
where Vf is the volume of the flammable cloud, Vm is the module

volume,
 m ρ s 
R= 
 U L2 
 v  Figure 416.1 Definition of the geometry and orientation
. factor for module type 1
m is the mass flow rate of the release, ρ s is the density the
released material at ambient conditions and L is a characteristic Determining the Flammable Volume
length scale of the module, defined so that L3 = Vm .
For the purposes of the workbook, the flammable volume has
Although a large number of experiments were carried out during been defined as the volume of released material at concentrations
the Joint Industry Project, they were all performed in one between 5% and 15 % contained within the module. Based on
particular module, albeit with different arrangements of perimeter the results for many different release rates, source locations and
confinement. Hence, interpolation and extrapolation, guided by source geometries, Figure 416.2 shows the correlation that was
dimensional and physical arguments, are used in the workbook deduced for the ‘upper limit’ estimation and for the ‘typical’
to extend the applicability of the relationships. A pragmatic flammable volume produced by a release.
approach was adopted, opting for the simplest, operationally
useful technique; only considering more complicated approaches
if subsequent experience shows this to be essential.
Determining the Ventilation Velocity

Two techniques have been considered to determine the
representative ventilation velocity through an offshore module.
The first is through the use of a zonal or integral model. This
technique was found to be a good predictor of the experimental
results undertaken in the JIP study (see previous section for
details). However this method relies on performing calculations
with a computer package or a sophisticated spreadsheet. Hence
a second, very simple, approach was also developed as an
alternative, rapid estimation procedure. This was based on the
experimental programme of the JIP study and uses, directly, the
results obtained in that study.
Figure 416.2 Plot of non-dimensional flammable volume
This approach assumes that the effects relating to the geometry versus ventilation parameter
and orientation of the module relative to the wind, the internal
congestion within the module and its perimeter confinement can
each be treated independently. Based on an analysis of the This approach has been extended to provide a means of estimating
experimental results and a physical understanding of the flow, the volume of material between any two concentration levels C1
formulae are provided for each factor for a number of common, and C2, expressed as volume percentages and in the range of 2%
generic cases of platform and module layout. to 15%, by means of the formula:
The specification for the ‘geometry and orientation’ of the module   . 

3/ 2    . 
3/ 2 
  m / ρs     m / ρs  
is provided for four different generic module layouts. The Vc1 − Vc 2 = Min1670C1−3 / 2   , L  − Min1670C 2−3 / 2 
3
 , L3 
  Uv     Uv  
specification of the effect of internal congestion and of perimeter        
confinement is provided by two simple algebraic equations.
Using the above formula, a maximum flammable volume of about
By way of illustration, the geometry and orientation factor for a three quarters of the total volume is produced by a non-
module with relatively open ends and closed sides and top is dimensional release rate, R, of about 0.04, a result that is
given in Figure 416.1. consistent with the experiments.

Discussion Further information

In developing the simplified approach described above, there For further details, please contact:
are inevitably many uncertainties that arise and also some
restrictions on the circumstances in which the approach may be R.P. Cleaver
applied. For example, the treatment of very low wind speed Advantica Techologies Ltd
conditions in the workbook could be improved by taking account Ashby Road
of additional factors, such as the momentum of the gas release. Loughborough LE11 3GR
However, it is most likely that the workbook would be used at United Kingdom
the early stages of a new development when some idea of the
overall level of risk is required. The probability of various release Tel: +44 (0) 1509 282 000
scenarios can be obtained from direct experience from data held E-mail: phil.cleaver@advanticatech.com
by regulatory authorities. It would be relatively easy to automate
the process of combining this information with the frequency of or
occurrence of various wind speeds and directions, in order to
evaluate the distribution of the flammable volumes that may be R.E. Britter
produced. Such an approach would reduce to some extent the Department of Engineering
uncertainties involved in using a correlation developed University of Cambridge
specifically to predict an upper estimate of the flammable volume Trumpington Street
produced by a certain release or the ‘average’ value produced Cambridge CB2 1PZ
by that release. Given suitable data, it may be possible to link United Kingdom
this approach to a similar ‘workbook’ for assessing the pressures
generated, should the flammable mixtures be ignited.
Further, as more details of the module layout are produced it is

likely that more detailed analysis would be warranted, using a
range of more sophisticated models. Having carried out the
workbook analysis first, such analysis could be focused on those
scenarios that lead to unacceptable risks. In this way, the
screening analysis afforded by the workbook would be refined
and the resulting detailed results used to further the design
process.
References
[1]
Selby, C.A. and Burgan, B.A., Blast and Fire Engineering for
Topside Structures Phase 2, Final Summary Report, Steel
Construction Institute, UK. SCI Publication Number 253, 1998.
[2]
Al-Hassan, T. and Johnson, D.M. in 17th International
Conference on Offshore Mechanics and Artic Engineering,
Lisbon, 6-9 July, 1998.
[3]
Cleaver, R.P., Buss, G.Y., Tam, V., Connolly, S and Britter, R.E.
Gas Build-up from High Pressure Natural Gas Releases in
Naturally Ventilated Offshore Modules, 7 th Annual
Conference on Offshore Installations: Fire and Explosion
Engineering, Church House Conference Centre, London, 2
December, 1998
[4]
Cleaver R.P., Buss G.Y., Tam, V., Connolly S., and Britter R.E.
Analysis of Gas Build-up from High Pressure Natural Gas
Releases in Naturally Ventilated Offshore Modules, 8th Annual
Conference on Offshore Installations: Fire and Explosion
Engineering, Lord’s Conference and Banqueting Centre,
London, 30 November, 1999.
[5]
Savvides, C., Tam, V., Cleaver, R.P., Darby, S., Buss, G.Y., Britter,
R.E. and Connolly, S. Gas Dispersion in a Congested, Partially
Confined Volume, International Conference and Workshop on
Modeling the Consequences of Accidental Releases of
Hazardous Materials, San Francisco, 28th September, 1999.

R417 RISK-BASED DESIGN OF PASSIVE FIRE

PROTECTION
The design of Passive Fire Protection implies making a choice total risk of structural failure needs to be assessed. This total
from a few alternatives - for each alternative solution the designer risk combines the various levels of threat from fires i.e. the
should assess the total associated risk. The selection or decision uncertainty regarding the structural strength, intensity and
process demands weighing up the costs, risks, and benefits of duration of the fire, the extent and thickness of PFP, its
the alternatives. The total risk is a combination of both the effectiveness after explosion and finally, the ability of the system
likelihood and level of the fire’s size and duration, and the to redistribute internal forces (redundancy). The choice of a
uncertainty in the response of the system. In this note, the outline design strategy demands an evaluation and weighing up of costs,
of a method is presented, which examines, in probabilistic terms, risks, and benefits, and must also include any factor, which leads
the damage that a certain fire of given duration will cause to a to economic or other losses.
particular structure that is designed with a design strategy that
could include accepting some or no damage. The current practice attempts to answer the question of which
structural members to protect and for how long in a prescribed
Introduction manner. Generally, a selected number of primary members, which
would be potentially exposed to the fire heating, are usually
In general, the topside structures of offshore installations are
protected. The survival duration could be a nominal number of
designed to withstand normal loads, then structural members
minutes, e.g. 120 minutes, or the shorter of how long it takes to
are coated by Passive Fire Protection (PFP). BS5950 Section 8
evacuate personnel on board and how long it takes for the fire to
gives guidance for determining the necessary PFP. This is a
subside by depleting the inventory. Although this approach
manual method for the fire proofing design. However, computer
provides some level of asset protection, it views fire coating as
methods can also be used to design an optimal PFP scheme.
a safety issue only. Moreover, as the survivability of the total
There is a systematic uncertainty with the manual method since
system is not established, the system behaviour under fire attack
the extent of fire proofing cannot be optimised. In contrast a
is not known. It is suggested that the extent, thickness and
computational approach can minimise the uncertainty, account
duration should be established using a risk-based approach,
for random errors and optimise the extent of required PFP.
subject to the condition that the survival time should not fall
below the time required for the safe evacuation.
It is generally accepted practice that a topside structure should
be designed so that:
Analysis of Total Risk
l it does not collapse during a major fire within the given The calculation of the total risk for a particular fire resistant
survival time; and design is based on the combination of two statistically varying
l it does not incur significant damage from moderate or minor characteristics. The first is the response of the particular
fires. structure, which may be better or worse than expected. The
second is the type of fire as characterised by its intensity and
While both of these principles are widely accepted as a basis for duration - factors that are obviously subject to statistical
design, it is difficult to be precise in their implementation. The variation.
second criterion clearly implies a balancing of the risk of future
loss against the initial cost of providing more PFP. Even the first The determination of the total risk as a basis for design is in
criterion implies some risk, since calculating a fire’s size and contrast to the usual design process undertaken for a
duration involves uncertainty and the definition of a major fire is structure[1,2]. In the latter case, the designer calculates the
always a compromise between the cost of providing more PFP maximum (or equivalent) stresses for a given structural member
and its benefit. The fire proofing design of North Sea structures since these stresses are correlated with structural failure and
during the last decade represents a very serious attempt to economic loss. For fire resistant design, however, the interest is
implement these principles. There is a requirement to analyse containment of the fire effect, i.e. preventing escalation of the
statistical information on the leak sizes and ignition probability event and progressive collapse of the structure by limiting
as well as structural material properties. To protect the topside, deformations and avoiding rupture that could aggravate the
there is generally a choice of measures that can be used. On the situation. A specific deformation or rupture may be caused, for
control side, these measures include breaking large sections example, by a moderate fire coupled with an unexpectedly bad
into smaller ones with less inventory, providing some kind of response of the structural system, or as the result of an unusually
deluge system to mitigate the effect of fire and so on. This paper large fire combined with better than expected behaviour of the
concentrates on the passive measures to mitigate the effects of structural system. This could happen due to variation in material
fire. strength or the PFP thickness among other things. If both of
these input-response combinations have the same net result in
Those measures that affect the structural resistance to fire are terms of the state of the system (i.e. the size of deformation or
called design strategies in this note. In the context of fire rupture), then they are considered equivalent within the selection
protection this only involves the extent of PFP, its thickness and process. That is, in the analysis of the fire resistant design it is
the coat-backs on unprotected members (increasing the members not necessary to distinguish further between any combinations
size is not an efficient strategy in these situations). For each of that have the same result on the structural system.
the alternative protective measures (strategies), the associated

In estimating the risk that a particular level of response will be The event tree technique is used to determine an estimate of the
experienced by the structural system, it is necessary to determine risk related to process leaks. Event trees are simplified models of
the total probability associated with all possible combinations the possible accidents and sequence of events leading to the
of fire intensity and the deviations in the response of a particular accident but they give a reasonably accurate picture of the risk.
design strategy. The event tree identifies all accident scenarios by showing their
path from the initiating event to the terminating event. There are
The total risk is determined by[2,4]: three main categories of leaks, namely blowouts, riser leaks and
∑ P[R E ]P[E ]
process leaks.
P[Ri ] = i j j (1)
all j For each tree a risk contribution is calculated. The sum of these
here P • represents the probability of the event indicated risk contributions gives the total risk related to process leaks.
within the brackets, Ri denotes the event that the state of the To be able to estimate the possible outcome of the identified
structure is i, Ej indicates that the fire size/duration experienced events, each leakage is divided into a number of categories, for
[ ]
is “level” j, and P R i E j denotes the probability that the state instance:
(response) of the structure will be Ri given that the event Ej
takes place. Minor: < 0.05 kg/s
Medium: 0.05 - 1.0 kg/s
In the context of a fire resistant design of a topside structure, Ri Large: 1- 50 kg/s
is the worst post-fire state (or state of damage, response, or Very large: > 50 kg/s
loss) of the installation during its design lifetime. Ej represents Minor leaks would not contribute significantly to the risk.
the entire range of possible fire size/duration which could happen
during the lifetime of the platform. In this case, Ri is a unique The fire frequencies and probabilities may be derived from the
description of the installation condition after each event. analysis of different leak scenarios and paths in the event tree.
The frequency of a fire decreases as the duration increases; i.e.
The form of the total probability Equation (1) emphasises that it short duration fires are more frequent than long duration fires.
couples the two sources of uncertainty and that it accumulates The probability of escalation is a result of considering different
all combinations having the same behaviour or response. In this escalation mechanisms in the paths of the event tree, and
form of the equation the responsibilities of the quantitative risk modelling of this is a time dependent function. In principle such
assessor and structural engineer are also clarified. The risk a diagram should be determined for each leak scenario in each
assessor should compute the values of the fire risk P[E j ] for all segregated compartment, but in practice it is possible to group
j, and the structural engineer must estimate the likelihood of together similar cases. This leads to a discrete representation of
different levels of behaviour Ri given different levels of fire size/ frequency against fire duration.
[
duration P R i E j . ]
It is usual to also account for the release rate. To do this an
Frequencies of Events estimate of the hole size distribution for each type of component
is made[3]. An example is shown in Table 417.1.
Probabilities and frequencies are used to describe the uncertainty
of the occurrence of an incident such as a leak. This is an attempt
to explicitly account for the most important factors affecting Normalised hole size (% of
0.1 0.2 0.4 1.0
safety. However, this simple model itself is subject to uncertainty. diameter)
Some attempt should be made to explicitly quantify uncertainties
associated with fire risk. Proportion of holes 0.60 0.25 0.10 0.05
The systematic identification of undesirable events is carried Table 417.1 Distribution of hole size
out based on operational experience, the HAZOP study and
experience with similar studies[3]. Leaks and the probability of It is necessary to introduce an additional step in the above
ensuing fires and explosions are one group of undesirable events calculations. After having counted the number of items of a
that will be identified at this stage. particular component and multiplied this by the leakage rate of
that component, the resulting leakage frequency is split into a
Blowout is the main sources of fire for wellhead platforms and all set of frequencies, each specific to a given range of release
floating platform with their own drilling facilities. Most floating rates. Having carried out this calculation for all components and
production facilities are well away from the blowout hazard area. categories involved, all frequencies that belong to a certain
A short duration blowout may last for some hours. Thus, the release rate range are added.
safe evacuation of personnel is the primary concern.
Standard formulae for releases of hydrocarbons from a hole in
Leaks from flexible flowlines or rigid still risers, as well as pipeline pressurised equipment can be used to determine the leakage
leaks, could endanger the safety of the structural system. For a rates and time to depletion of inventory.
full bore rupture of a riser the dimension is quite substantial. In
the case of jacket structures, less of the structure is exposed to An ignition will result in fire or an explosion, depending on the
fire. Process leaks require the most effort. available volume of combustible gas and when the ignition
occurs. The probability of ignition depends on:

1. The probability of the occurrence of a combustible mixture. especially for proprietary materials. It also should be noted that
2. The probability that the combustible mixture reaches a source most countries do not allow any credit to be taken due to water
of ignition. deluge.
The range of fire duration is a continuous variable. This Multiple Damage States
continuous distribution can be divided into five bands
The Damage State, which is assumed here to be the cost of
compatible with five levels of PFP requirement, see Table 417.2
repair or replacement, may be represented in discrete form in a
below, assuming it is possible to have five design strategies.
similar manner to the fire size/duration. Five general states of
These bands would represent the whole spectrum of possible
damage, Ri, are defined in terms of such loss-related factors as
protective measures available to the designers. Within each
level of repair cost, degree of the structural and non-structural
duration band, the fire size is a random variable.
damage and the fraction of personnel injured and killed. This
Fire discrete definition of damage states is described briefly in Table
Duration < 10 10 to 30 30 to 60 60 to 90 90 to 120 417.4. The coefficient of variation for mean values noted in Table
(min) 417.4 are around 0.25. Numbers given in Table 417.4 are only an
indication of what one should expect and their applicability must
Frequencies 6.8E-3 1.86E-3 0.82E-3 0.34E-3 0.15E-3 be verified before use.
Table 417.2 Fire duration frequencies (sample) Due to non-uniform design and construction practices, like
variations of material properties and the distribution of topside
The choice of five bands is adequate, considering all possible equipment, structures that are designed to the same code
measures available to counteract the fire effect. The logic behind specification will not all experience the same level of damage
the above discrete representation of fire size/duration is a even if subjected to identical fire loads. Furthermore, the degree
corollary of the current practice. A topside structure designed of damage is dependent on the fire size and fire duration, which
are also uncertain. Thus, for each level of fire size/duration it is
according to the API-WSD method has enough capacity to
withstand 160 kW/m2 for about 10 minutes. To increase this [
necessary to define a probability distribution function P Ri E j ]
capacity to beyond 10 minutes requires most of the primary for damage. The determination of the damage probability
steel and parts of the secondary steel to be fire coated. As the function is explained in a case study later in this paper.
requirement reaches 120 minutes, the amount of fire coating
increases. The damage probability distribution function can be used to
determine the probability that a structure will find itself with
There are three parameters that together determine a fire, these associated repair cost and injuries or deaths. The first step is to
are fire loads (or intensity), size and duration. All structural calculate the mean annual frequency λ Ri of events in which the
member within a compartment would not experience a uniform structure experiences the Damage State Ri. The mean rate is
fire load. The current UK practice uses a hydrocarbon fire determined by the application of equation (1) modified to apply
temperature curve, which is designed for fire testing. This fire is frequencies.
almost equivalent to 200 kW/m2. Since this curve is used in the
certification of PFP material, 200 kW/m2 became a standard value λ Ri = ∑ P[R | E = I ](λ
I
i I − λ I +1 ) (2)
for pool fires. For jet fires, the associated heat flux is 350 kW/m2.
NORSOK Technical guidance (NTS, 1996)[5] have specified fire in which (λ I − λ I +1 ) is the annual frequency of events with E = I
loads for the selection of PFP, see Table 417.3. These values are (assuming repair, if necessary). Accumulating the appropriate
lower than those used in the UK. Furthermore, the way fire tables mean annual rates of different states will yield the mean annual
for PFP are produced, these values cannot be used easily, rate of events causing damage of a given level or greater.
Reduced average
Initial heat flux Initial heat flux
inital heat load taking
Type of fire density density
credit for w ater
Maximum point loads Average loads
deluge
Pool fire (crude)

Open or closed area, 150 kW/m 2 100 kW/m 2 kW/m 2
fuel controlled
Pool fire (crude)

Enclosed area, 200 kW/m 2 130 kW/m 2 100 kW/m 2
ventilation controlled
Jet fire 250 kW/m 2 200 kW/m 2
Table 417.3 NORSOK recommended fire loads

The ultimate goal of an assessment is to determine the probability during repair, or, in extreme cases, injury or loss of life, and other
of survival for a topside structure. To calculate the installation impacts such as the operator’s standing in the community and
survivability, all the failure mechanisms must be identified. The its stock value. In general, not all of the incident losses can be
load is a function of the amount of combustible material, ignition expressed in monetary terms.
probability and location, topside layout, ventilation and so on.
The resistance is a function of framing, material properties, If it were possible to express all losses in terms of money, then
workmanship, possible and so on. the criterion for selecting the optimal design strategy would be
the minimum present total expected cost, that is a design strategy
Application that minimises the sum of initial costs plus the discounted value
of expected future losses.
The simplest form of a design strategy is the basic design, in
which no PFP is provided to resist the fire effects. As a result,
Most PFP in use are proprietary type whose established
the cost of a fire resistant design is limited to the cost of firewalls
theoretical behaviour in a fire situation is known. In addition, for
for segregation purposes. As PFP is added to delay the
certification purposes fire tests and tables are produced with
degradation of material strength, the cost of enhancing the
discrete time steps, e.g. 30, 60 and so on are. Furthermore
capacity over the basic design starts to rise.
continuos variation of thickness is not practical. Consequently
the choice of thickness is stepwise.
One key step in the calculation of the fire risk is to determine the
probability that a fire of some stated duration would occur during
In heat transfer analysis the temperature time histories of all
a year. Fire severity is expressed as convective and radiative
structural members are calculated[6]. The operational loads are
heat fluxes, or by gas temperatures.
applied in the first step of a two-step non-linear structural analysis.
The temperature time-histories are applied in then the second
The effect of fire on the structure is expressed by a number of
step. In both heat transfer calculation and the structural analysis
Damage Probabilities (DP’s). Each DP is associated with a fire
the effect of random errors can be accounted for using a Monte
size/duration (rise and fall) and a design strategy and gives the
Carlo simulation.
probability that various levels of damage would result from
various levels of fire duration. By combining the fire with the
The process starts with no PFP at all. If the calculated risk is
information in the DP table, the probability that the topside
intolerable or the time to collapse is less than that required for
structure will sustain various levels of damage can be assessed
evacuation, then another strategy, e.g., having 30 minutes PFP
and the future repair costs may be determined.
only on certain members is investigated. The number of members
and the PFP thickness are increased until the calculated risk for
For each damage state there is an incident loss; such incident
each category becomes acceptably low. Often previous
losses include loss of function or loss due to deferred production
experience can be used to reduce the amount of computation.
Damage State Description of * Mean material ** Mean injuries ** Mean loss of

and Symbol damage loss ratio ratio life ratio
No or minimal non- Minor Potential

1. Limited (L) 0.5%
structural damage. (1%) (0.1%)
Minor localised
structural and F ew Minor
2. Moderate (M) (5%)
extensive non (2%) (0.5%)
structural damage.
Major structural
damage; possibly Some F ew
3. Substantial (S) (30%)
total non-structural (5%) (1%)
damage.
Severe damage to
Several Up to 10
4. Total (T) parts of platform. (100%)
(20%) (5%)
Structure replaced.
Widespread
Significant Greater than 20
5. Catastrophic (C) platform damage. (100%)
(100%) (20%)
Total collapse.
* Mean value of material loss as a percentage of installation cost.
** Mean values of injuries or loss of life as a percentage of personnel on board.
NB: These values are dependent on the platform and are shown here for illustration purpose only.
Table 417.4 Description of Damage States

Conclusions
A methodology has been outlined for deciding on the level of
fire protection for the topside of an offshore installation. This
method accounts for all probable fire intensities, their duration
and the strength of the topside to withstand the degradation of
material strength. The method allows the level of protection to
be improved until the residual risk becomes ALARP.
References
[1]
Yasseri, S., Risk-Based Decision Analysis for the Protection
of Marine Pipeline from Dropped Objects, 97-JSC-235, ISOPE
1997.
[2]
Yasseri, S., Decision Analysis for Target Fatigue Lives,
Presented at SIMoNET inaugural meeting, University College,
March 30th 2000.
[3]
Vinnem, J.E., Offshore Risk Assessment: Principal, Modelling
and Applications of QRA Studies, Kluwer Academic
Publishers, London, 1999.
[4]
Yasseri, S., Design Decision analysis for Topside Blast loads,
Major Hazard conference, ERA, London 2000.
[5]
NTS 1996, NORSOK Technical safety, Design principles,
NORSOK standard S-DP-001, Rev2, January 1996.
[6]
SINTEF, Handbook for Fire Calculations and Fire Risk
Assessment in the Process Industries, SINTEF/Scandpower,
1992.
Further information
Sirous Yasseri
Kellogg Brown & Root (KBR)
ACS Full Field Development Project- Phase 1
South Point
6-14 Sutton Court Road
Sutton
Surrey SM1 4TY
United Kingdom
Tel: +44 (0) 1372 865 226

Fax: +44 (0) 1372 865 111
E-mail: sirous.yasseri@halliburton.com

Research and Development
R418 SAFETY MANAGEMENT OFFSHORE: A

SYSTEMATIC APPROACH
A Systemic Safety Management System Model and opportunities, system 4 can suggest changes to the
organisation’s safety policies. This function may be regarded as
The Systemic Safety Management System (SSMS) model
a part of effective safety planning. System 4 first deals with the
described here is intended to represent a systemic approach
safety policy received from system 5. Second, it senses all
intended to maintain risk within an acceptable range in an
relevant threats and opportunities from the wider physical and
organisation’s operations. This model builds on the Viable System
socio-economic infrastructure of the organisation, including the
Model (VSM) developed and proposed by Beer[1,2,3] and the
safety future environment. Third, system 4 deals with all relevant
Failure Paradigm Method (FPM) proposed by Fortune and
needs of system 1 performance, and its potential future. Finally,
Peters[4] as described elsewhere[5]. A brief description of the
it deals with the confidential or special information communicated
SSMS model is given below.
by system 4*. System 4*, safety confidential reporting, is part
of system 4 and it is concerned with confidential reports or
Recursive SSMS Structural Organisation causes of concern that may require the direct and immediate
The SSMS needs to achieve five functions associated with intervention of system 5. Finally, system 5, safety policy, is
systems 1 to 5. System 1 consists of various operations within responsible for deliberating safety policies and for making
an organisation that deal directly with the organisation’s normative decisions. According to alternative safety plans
production activities. received from system 4, system 5 considers and chooses feasible
alternatives, which aim to maintain an acceptable level of safety
A typical organisation’s operations, for example, power throughout the organisation’s operations. It also monitors the
generation, transport, oil and gas exploration, production, and interaction of system 3 and system 4, as represented by the lines
treatment could form part of system 1, as shown in Figure 418.1. that connect the loop between systems 3 and 4 as shown in
It should be noted that each operation performs five functions Figure 418.1. Also shown on Figure 418.1 is a dashed line directly
namely safety policy, development, functional, co-ordination, from system 1 to system 5, representing a direct communication
and implementation. This means that the SSMS as a whole is or ‘hot-line’ for use in exceptional circumstances; e.g. during an
replicated in each operation of system 1. Systems 2 to 5 facilitate emergency.
the function of system 1, as well as ensuring the continuous
adaptation of the whole organisation. System 2, safety co- The SSMS and its Environment
ordination, co-ordinates the activities of the operations of
The SSMS relies on five functional imperatives and the extent to
system 1. System 2, along with system 1, implements the safety
which the SSMS structural organisation accommodates
plans received from system 3. It informs system 3 about routine
contextual constraints determines its ability to adapt. The
information on the performance of the operations of system 1.
organisational structure of the SSMS is shown as interacting in
To achieve the plans of system 3 and the needs of system 1,
a defined way with its environment through system 1 operations,
system 2 gathers and manages the safety information of the
and through system 4, as illustrated in Figure 418.1. Environment,
system 1 operations. System 3, safety functional, is not only
both socio-economic and physical is understood as being those
responsible for maintaining risk within an acceptable range in
circumstances to which the SSMS response is necessary. The
system 1, but also ensures that system 1 implements the
SSMS also needs to respond to necessary internal matters, e.g.,
organisation’s safety policy. It achieves its function on a day-
inadequate training. System 4 deals with the SSMS’s total or
to-day basis according to the safety plans received from system
wider socio-economic and physical environment into which an
4. Detailed aspects of safety plans are given below. System 3
organisation is embedded. The broken line elliptic symbol
requests from systems 1, 2, and 3* information about the safety
represents the SSMS total environment, as illustrated in Figure
performance of system 1 to formulate its safety plans and to
418.1. System 4 deals also with the safety ‘future environment’,
communicate future needs to system 4. It is also responsible for
which is also embedded into the SSMS total environment. The
allocating the necessary resources to system 1 to accomplish
safety future environment is concerned with threats and
the organisation’s safety plans. System 3*, safety audit, is part
opportunities for the future development of safety. On the other
of system 3 and its function is to conduct audits sporadically
hand, system 1 operations deal with local environments or
into the operations of system 1. System 3* intervenes in the
institutionalised environments with which the organisation’s
operations of system 1 according to the safety plans received
operations must deal. These local environments are embedded
from system 3. System 3 needs to ensure that the reports received
into the total environment of the SSMS as illustrated in Figure
from system 1 reflect not only the current status of the system 1
418.1. For example, organisations are embedded within a wider
operations, but are also aligned with the overall objectives of
socio-economic and physical structure that will constrain the
the organisation. The audit activities should be sporadic (i.e.
way they can develop. There are various important socio-
unannounced) and they should be implemented under common
economic and physical characteristics that need to be taken into
agreement between system 3* and system 1.
account. These characteristics can be segregated thus; first
physical characteristics, such as the geography of the area, for
System 4, safety development, is concerned with safety research
example the North Sea oil and gas fields, weather conditions and
and development (R&D) for the continual adaptation of the
public utilities. Second, economic characteristics such as oil and
organisation. By considering strengths, weaknesses, threats,
gas markets, level of employment, other oil and gas operators

Figure 418.1 A Systemic Safety Management System (SSMS) for an oil and gas organisation

and other types of industry and commerce, and finally, socio- Recursive Structure and Autonomy
political characteristics, such as regulators, and social
According to Beer[1], in a recursive organisational structure any
organisations. The demands and needs inherent in these
viable system contains, and is contained in, a viable system.
characteristics will suggest and condition patterns of structural
This means that the organisational structure of the SSMS for
organisation of the SSMS. Organisations need to pay more
the organisation as a whole is replicated in each operation of
attention not only to these characteristics, but also to the
system 1. That means that the SSMS model is intended to
complexity, stability or uncertainty of changing technologies.
manage safety of an organisation at three levels of recursion, as
shown in Figure 418.1 (The three levels should be seen in the
Apart from confronting demands for its products, an organisation
context of Figure 418.2). The top right hand side broken line
faces an environment upon which it is dependent for finance,
square box is the management unit of system 1 of the next higher
work force and materials, that is, for its resources. The
level of recursion. The operations of system 1, on the other
organisation’s total environment has a certain pattern of resource
hand, represent the SSMS for the level of recursion next below,
availability to which the organisation has to relate. The supply
depicted at 45 degrees in Figure 418.1. The SSMS for the
of resources to the organisation changes over time forcing it to
organisation as a whole is replicated for every operation of system
make organisational adaptations. These adaptations may involve
1.
merging departments, changing the location of decision making,
introducing new procedures, and so on. These changes may
Very little attention has been given by both academe and
have significant impacts on the safety performance of the whole
practitioners to understanding the appropriate degree of
organisation. Similarly, local or institutionalised environments
interdependence amongst the parts that constitute an
also are characterised by the socio-economic and physical
organisation in order to design an effective SMS. In addition,
characteristics of the organisation’s total environment. These
the impact of the organisational structure on the effectiveness
characteristics can be segregated into a) physical characteristics,
of the SMS, as well as on the subsystems of the SMS, is not well
for example a specific oil and gas production field, local weather
understood. The SSMS is organised in recursive levels, which
conditions; b) economic characteristics, for example other oil
may have a significant impact not only in designing a more
and gas field operations, and c) socio-political characteristics,
effective SMS, but also a SMS including health, safety and
such as government regulations, for example, the safety case
environment. The SSMS for the whole organisation is replicated
regulations.
in each operation of system 1, as illustrated in Figure 418.1. The
SSMS is intended to be able to maintain risk within an acceptable
Whenever a line appears in the Figure 418.1 representing the
range at each level of recursion, but this safety achievement, at
SSMS model, it represents a channel of communication, except
each level, is conditional on the cohesiveness of the whole
for the lines that connect the balancing loop that connects
organisation. The SSMS contains a structure that favours
systems 4 and 3. The zigzag lines connecting the operations of
autonomy and local safety problem-solving capacity. Autonomy
system 1 indicate inter-dependency, which may be strong or
means that each operation of system 1 of the SSMS is responsible
weak according to the degree of interdependence amongst the
for its own activity with minimal intervention of systems 2, 3, 4,
operations. For example, in the case of an oil and gas offshore
and 5. The organisational structure of the SSMS allows decisions
production field, the operations might stand for offshore platforms
to be made at the local level. Decision making is distributed
OIA, OIB and OIC (see Figure 418.2). A succession of processes
throughout the whole organisation. This means that distributed
feeding each other with oil/gas in normal operation may be
decision making involves a set of decision makers in each
regarded as strong physical inter-dependence. A weak inter-
operation of system 1 and at each level of recursion. These
dependence may be the case when the three offshore platforms
decision makers should be autonomous in their own right and
do not feed each other with oil/gas as part of normal operation
act independently based on their own understanding of safety
but there is a physical connection which might allow it. For
and their specific tasks. However, it should be recognised that
example in the Piper Alpha disaster there was a physical
they have interdependence with other decision makers of other
connection between the Piper and Claymore platforms which
operations of system 1. Therefore, each operation of system 1
allowed unintended passage of gas; i.e. during non-normal
should be endowed with autonomy so that the organisational
operation. There is a particular concern in the SSMS about the
safety policy can be achieved more effectively. These aspects
nature of these channels and the information which flows in the
of organisational structure, which have a role in making
communication channels. These channels of communication
organisations more rather than less effective, are poorly
obey four organisational principles. These organisational
understood in safety literature.
principles are understood as responding appropriately to the
weaknesses and strengths, threats and opportunities as
Communication and Control in the SSMS Model
presented in the wider and local environment of the SSMS; the
channels of communication, and the necessary transducers Pro-active Commitment to Safety
translating information when it crosses boundaries of systems An organisation’s safety approach can be reactive or pro-active
must be designed according to the requirements of Ashby’s law and less or more committed to safety. Additionally, organisations
of requisite variety[1,2,3] and these principles must be put into may focus on technical aspects of incidents or accidents. For
effect without time-lags (see Appendix A). The bi-directional example, passive and active fire fighting systems have been
arrows represented in the SSMS total environment indicate the developed with the purpose of controlling and mitigating fire
interactions among the local environments, as well as the incidents. However, the degree of risk in an organisation or system
interaction of these local environments with the total is an emergent property resulting from the interrelated activities
environment. of people who design it, manage it, and operate it. Humans,

Figure 418.2 Recursive structure of an oil and gas industry

individually, in teams and in organisations decide the technical which they are implemented into a particular organisation’s
aspects. People who are involved in the product, service, or operations should be clearly understood. These two aspects
process life cycle, such as product and plant designers, are known here as Internally Committed Systems (ICS) and
constructors or manufacturers, operators or users and Externally Committed Systems (ECS). The distinction between
maintainers make decisions which effectively contribute to these two aspects may be a source of insight into the ways
creating the risk. Furthermore, there is the need to look at the safety can be approached, as well as the ways in which these
people responsible for designing and managing the organisation two aspects differ from each other. Table 418.1 illustrates some
or system itself. These factors, which are the potential, but not characteristics of ICS and ECS.
obvious or explicit causes of incidents or accidents, are known
here as latent factors. It is claimed elsewhere[6] that common (i.e. ECS refers to the safety performance of systems that are
common-place) causal failures form part of an “incubation committed to a particular purpose, function, or objective based
process” in a sequence of disaster development. Moreover, latent on external reasons or motivation. This definition addresses both
factors accumulate unnoticed until a precipitative event or trigger technical aspects and humans. For example, production
leads to the onset of the incident, accident or disaster[7]. (In installations are designed to accomplish a well-defined objective,
addition to latent factors as described above, i.e. in the sense of whilst the production operations’ procedures are formulated by
human/organisational factors, there may also be long-term process designers to be followed by production personnel. Here,
physical factors such as a very slowly developing crack.) the performance of production machines satisfy the purpose of
product designers and the production personnel satisfy the
Traditionally, organisations may not be aware of latent factors, production process designer’s purpose. Traditionally,
but they look for immediate causes of incidents or accidents organisations tend to address safety by seeking the direct or
after they have taken place. Both academe and practitioners immediate causes of incidents or accidents after they have taken
tend to divide them into separate objects and events. This place. An inquiry or assessment process is conducted to
division is, of course, useful and necessary to cope with risk, determine the immediate causes so that the existing
but is not a fundamental feature of a real safety situation. understanding is adjusted to fit the newly gained understanding
Immediate causes of incidents or accidents as readily observed of safety. Goals for improvement are defined to address the newly
or understood are known here as immediate factors. The found failure so that the same failure will not occur again.
“incubation”[6] period of a “latent failure” before the immediate Moreover, very often it is assumed by organisations that the
failure appears is known as the “latent period”. It is contended absence of incidents or accidents or other negative outcomes is
here that all parts that constitute an organisation can be seen as an indication of good safety management. For example, some oil
interdependent and inseparable parts of the organisation as a and gas organisations, like many others, traditionally use lost
whole. Moreover, these constituents are all interconnected, time injuries (LTI) and deaths as the basis to measure the
interrelated and interdependent in that they cannot be effectiveness of their safety management.
understood as isolated entities, but only as integrated parts of
the organisation as a whole. Loss is therefore seen as a systemic Organisations need to address safety pro-actively. However,
failure, not a result of a single cause. Clearly, addressing latent often they still tend to comply with external safety objectives,
failures is as important as focusing on apparent failures or that is, existing regulations, standards or procedures in a narrow
incidents or accidents. way. It is generally accepted that safety is better assessed and
managed by addressing in advance the hazards of the
In addition to latent and immediate factors, the distinction organisation’s operations. This is usually done through i) a
between technical and human factors should be emphasised so systematic identification of hazards, ii) assessment of the
that realistic safety objectives, plans and measures of significance of hazards, and iii) hazard management by
performance can be set. This distinction should replace the prevention, control, and mitigation. However, organisations are
emphasis on unique causes and isolated technical explanations often still only committed to complying with existing regulations,
of failure of systems. This will require knowledge about the degree standards or procedures in a narrow sense and this is basically
to which the technical and human factors are committed to safety reactive mentality. Of course, a regulation may demand or imply
and linked together into a coherent whole. Moreover, the way in a pro-active approach, however only complying with externally
External Commitment Internal commitment
Tasks in the organisation are defined by others Employees participate in defining tasks
Employees participate in defining the behaviour

The behaviour required to perform tasks with an
required to perform tasks with an acceptable degree of
acceptable degree of risk is defined by others
risk
Safety performance goals are defined by the Organisation's management and employees jointly
organisation's management or others define safety performance goals
Others define the importance of the safety performance Employees participate in defining the importance of the
goals. goals
Table 418.1 Internally and Externally Committed Systems

[3]
imposed regulations or existing standards does not necessarily Beer, S., Diagnosing the System for Organisations, John
mean that an organisation’s operations will be ‘acceptably safe’. Wiley, Chichester, 1979.
[4]
Moreover, organisations still tend to focus on immediate factors Fortune, J. and Peters, G., Learning From Failure - The
and have very little understanding and appreciation of latent Systems Approach. John Wiley, Chichester, 1995.
[5]
factors and ICS. Santos-Reyes, J., and Beard, A. N., A Systemic Approach
to Offshore Fire Safety Management, FABIG Newsletter,
The idea of ECS may produce important insights into the ways Issue No. 24, June 1999.
[6]
safety can be addressed, but it is fundamentally incomplete. Turner, B. A., “The Organisational and Interorganisational
There is growing evidence that human factors have quite Development of Disasters”, Administrative Science
dramatic safety consequences; this requires a fundamentally Quarterly, September 1976, Vol. 21, 1976, 378-397.
different approach. It seems that there is a substantial gap
between safety objectives as defined by regulators, standards Appendix A
or procedures, or the organisation’s management and what may
The First Principle of Organisation (from Ashby’s Law[1])
be achieved in a real-world situation. It is necessary to introduce
the idea of ICS. An ICS is a system that is committed to a “Managerial, operational and environmental varieties, diffusing
particular purpose or objective based on its own reasons or through an institutional system, tend to equate; they should be
motivation. In other words, an ICS refers to the critical awareness designed to do so with minimum damage to people and to cost.”
of self-reflective human beings regarding their purposes and (i.e., for a viable system).
the implications of their actions for all those who might be
affected by the consequences. This means that all those involved An example could be an evacuation system designed to save
in the life cycle of the organisation’s operations should be lives in the case of a fire or explosion on an offshore platform;
committed to addressing safety pro-actively and anticipating then the number of lifeboat spaces must be at least as great as
incidents or accidents, motivated by their own objectives or the number of possible evacuees.
purposes. This freedom to achieve safety objectives is, however,
limited by the organisation’s safety policy, plans, standards and The Second Principle of Organisation (derived from
procedures. Individuals, teams, groups, and departments that Shannon[1])
perform an organisation’s operations should not only be “The four directional channels carrying information between
assigned tasks but they should have both authority and the management unit, the operation, and the environment must
responsibility by their understanding of safety and their specific each have higher capacity to transmit a given amount of
tasks. They should be endowed with authority in their daily information relevant to variety selection in a given time than the
tasks by their knowledge to perform their tasks properly and in originating subsystem has to generate it in that time.” (As shown
an acceptable way with regard to risk. This knowledge involves in Figure 418.A1).
their knowledge of risk itself and the skills required to perform a
specific activity. In other words, individuals, teams, groups and Example, the channels carrying procedures of evacuation must
departments that constitute an organisation should have more have enough specificity so as to reduce ambiguities or eliminate
involvement with safety in their daily tasks. Top and line unclear instructions.
management should encourage the development of ICS. The
more the organisation’s management wants internal commitment
from its employees, teams, and departments the more it must try
to involve employees in defining safety objectives, specifying
what these are and how to achieve them, and setting safety
targets. There is no safety vision, strategy or policy that can be
achieved without able and committed employees. However, it is
unrealistic to expect the management of an organisation to allow
total autonomy to employees. The degree to which internal
commitment is plausible is certainly limited.
Conclusion
A SSMS model for an oil and gas organisation has been created
based on a systemic approach. The model elucidates an
alternative way of managing safety. It is hoped that this approach
will lead not only to more effective management of safety, but
also to more effective management of health and the environment Figure 418.A1 The basic elements of a viable system,
for any organisation. illustrating the 4 key information channels
The Third Principle of organisation

References
[1]
“Wherever the information carried on a channel capable of
Beer, S., The Heart of Enterprise, John Wiley, Chichester, distinguishing a given variety crosses a boundary, it undergoes
1979. transduction; and the variety of the transducer must be at least
[2]
Beer, S., Brain of the Firm, John Wiley, Chichester, 1982. equivalent to the variety of the channel.”

Example, in the case of means of escape for offshore employees,

a transducer might be a fire instruction notice. This would
‘transduce’ between the person making up the evacuation rules
and the workers the rules are aimed; then the notice must be
comprehensive and clear.
The Fourth Principle of Organisation

“The operation of the first three principles must be cyclically
maintained through time, and without hiatus or lags.” (That is,
they must be adhered to continuously).
Further information
Dr Alan N. Beard or Jaime Santos Reyes

Department of Civil and Offshore Engineering
Heriot-Watt University
Edinburgh EH14 4AS
United Kingdom
Tel: +44 (0) 131 449 5111

Fax: +44 (0) 131 451 5078
E-mail: a.n.beard@hw.ac.uk

R419 NEW GUIDELINES ON PRESSURE RELIEF

In 1996, members of the Aberdeen Branch of the Institute of questioned. During the 1990’s the American Institute of Chemical
Chemical Engineers proposed that a study should be initiated Engineers’ DIERS group (Design Institute for Emergency Relief
with the aim of developing a reference document containing Systems) investigated the methodologies available and
current industry practices for the design and operation of relief concluded that the addition of areas method could significantly
systems for offshore oil and gas facilities. A large joint industry under predict the required relief area. The plot in Figure 419.1
project was formed and, after nearly 5 years of work, the Institute from an investigation undertaken by Imperial College, London
of Petroleum (IP) has recently published Guidelines for the safe in 1995[2] graphically illustrates the variations in different
and optimum design of hydrocarbon pressure relief and methodologies for a typical two-phase fluid. It compares predicted
blowdown systems [1], which was edited by Professor Geoff orifice flow rates with upstream gas mass fraction for three
Hewitt. methods, the Homogenous Equilibrium Method (HEM), the
Homogenous Frozen Method (HFM) and the then industry norm
The drafting of the Guidelines and experimental work was carried of the (API) addition of areas method.
out under contract to the IP as managers for the Relief and
Blowdown Systems (RaBs) Joint Industry Project. This project In the latest (7th) edition of API RP 520 Part 1 (January 2000), the
included participation by several companies involved in the oil recommendation for sizing gas-liquid releases has been changed
and gas industry, and also the UK Health and Safety Executive. from the addition of areas method to sizing based on the
Colin Weil, an independent consultant, acted as project co- homogeneous equilibrium model (HEM). The HEM assumes
ordinator throughout. that the gas and liquid move at the same speed and are in
thermodynamic equilibrium. API RP 520 includes an
These guidelines are intended primarily for process engineers approximation known as the omega method to perform the
who are familiar with the basic principles and calculation calculations, but in practice many engineers may find it is as
techniques involved. They were developed to supplement the simple to undertake a full HEM calculation. API RP 520 Part 1
industry’s codes and standards and include sections discussing does, however, note that the methods have not been validated
overall system design philosophies, sizing methodologies and by test.
the advantages and disadvantages for various types of
frequently used hardware. There is also an extensive review of In order to validate HEM for hydrocarbon fluids, Professor
real incidents, their causes, and observations to minimise the Stephen Richardson, Dr Graham Saville and colleagues at Imperial
risk of recurrence. College in London, undertook an extensive series of experimental
tests at the Advantica (formerly BG) Spadeadam test site in
Pressure Relief Cumbria. The studies, including the results of the experimental
work, have been fully written up in the IP guidelines.
The requirement for providing over-pressure protection is
mandatory in all pressurised systems. Most commonly, relief
and blowdown valves or bursting discs are fitted to protect Spadeadam Tests
vessels, and their associated piping, by discharging to a suitable The Spadeadam tests were conducted using a specially designed
receiver or to vent or flare. The American Petroleum Institute and constructed rig. Three typical hydrocarbon fluids were used:
(API) recommended practices have been widely used in the sizing
of such devices for releases of hydrocarbon gas or liquid. l natural gas (essentially methane with some ethane);
l commercial propane (essentially propane and butane with
some ethane);
l condensate (essentially pentane to nonane with some decane
to dodecane).
Figure 419.1 Comparison of various methodologies for

sizing an orifice for two-phase flow
For many years industry has used an addition of areas method
to size relief systems operating in two-phases, that is where
liquid and vapour coexist in the fluid being relieved. This method
calculated the cross sectional area required to relieve the liquid
content of the fluid and this was added to that area required for Figure 419.2 Part of the test rig, showing the mixing and
the gas. In recent years the adequacy of this approach has been monitoring piping upstream of the orifice

Figure 419.2 shows the 3-inch diameter phase mixing section of

the rig. The orifice plate is mounted at the extreme right
downstream of the natural gas and condensate inlets. The
supplies were independently metered (to within 1%), temperature
was measured at 20 locations within the rig and pressure at 10.
Restriction orifices of diameter 5 mm to 15 mm were used and
pressures upstream from these ranged from 10 to 90 bar (150 to
1300 psi). Flow rates were up to about 3 kg/s (10 mmscfd).
Some 50 flow experiments were conducted each covering a range

of flow variables. The tests investigated one-phase gas alone,
two-phase gas/liquid and also one-phase compressed (flashing)
liquid. Figure 419.3 shows the impressive plume of two-phase
hydrocarbons downstream of the orifice. These were ignited to
minimise environmental contamination.
Figure 419.4 Discharge coefficients plotted as a function

of liquid mass fraction
It was reassuring to note that the experimental results indicated

that the impact of mixing, or non-mixing, of the phases upstream
of the orifice was negligible and therefore need not be factored
into the design of two-phase orifice sizing.
Conclusions
Values of discharge coefficients for two-phase flow through
restriction orifices were determined by analysis of the results
obtained in the experiments. These results suggested there is a
weak correlation of discharge coefficients against gas fraction
(or quality). This relationship can been seen in Figure 419.4,
which shows the discharge coefficients calculated for tests on
releases of natural gas and propane mixtures. Thus it can be
suggested that if an average discharge coefficient Cd of 0.93 is
used in a fully-implemented HEM, this will give predictions of
flow rate that agree very well with the measurements. The
discrepancy is never more than 5% and is generally less than
Figure 419.3 Flaring a two-phase hydrocarbon flow
2%.
As part of the experiment, investigations were also undertaken
to find out whether or not pre-mixing of the streams had any The experiments indicate that use of the API RP 520 omega
discernible effect. This would be critical to the robustness of method and the API-recommended discharge coefficient Cd of
any calculation methods. 0.85, will give predictions of flow rate that also agree fairly well
with the measurements. Within the range of the experiments the
Results discrepancy is never more than 15% and is generally less than
The main part of the work was the measurement of the discharge 10%. It would be expected the omega method would be less
coefficient for flows of two-phase mixtures through an orifice. accurate the more complex the mixture of fluid involved.
However, as a base position measurements were also obtained
for single phase (gaseous) natural gas releases and these showed However, the advantage of using the omega method over a full
discharge coefficients determined for various flow rates through HEM calculation seems marginal as, for most hydrocarbon
three different orifices as 0.90. mixtures found in practice it would be necessary to use Equation
D.3 of RP520 Part 1. This means that a flash calculation must be
Various comparisons of the data were undertaken, including carried out and performing the full HEM calculation is only
comparing the experimental data against the original (pre 7th marginally more difficult whilst it is certainly more accurate. Thus,
edition) API method and their new methodology. As expected it is recommended that the full HEM method is employed as a
the omega methodology does give results much closer to those standard, and an algorithm for its use is given within the IP
measured. Guideline.

It should be noted, however, that the work did not include

validation of HEM for:
l systems for which the upstream gas fraction (or quality) is

very small;
l systems in which the liquid is of high viscosity (such as,
say, a heavy oil).
References
[1]
Guidelines for the Safe and Optimum Design of Hydrocarbon
Pressure Relief and Blowdown Systems, published by the IP
in August 2001 may be purchased from Portland Press Ltd.,
Commerce Way, Whitehall Industrial Estate, Colchester CO2
8HP, United Kingdom. Telephone: + 44 (0) 1206 796351;
Facsimile: + 44 (0) 1206 799331; E-mail: sales@portlandpress.com
[2]
Two-Phase Pressure Relief Sizing – an assessment study, by
G F Hewitt, S M Richardson, G Saville and C Weil. Imperial
College Consultants Limited [MPS/73], June 1995.
Further information
If you require more information on the RaBs project, information
for purchase of the Guideline is included in the references or for
additional information contact:
Sjoerd Schuyleman
Upstream Operations Manager
Institute of Petroleum
61 New Cavendish Street
London W1G 7AR
United Kingdom
Tel: +44 (0) 20 7467 7132

Fax: +44 (0) 20 7255 1472
E-mail: sfs@petroleum.co.uk

Conferences
R420 CONFERENCES, SEMINARS AND COURSES
Conferences
Title Dates Venue Contact Tel/Fax Number
Post Seminar Workshop: 2 Jury’s Great Russell Patricia Harris, +44 (0) 1932 893 857
Identifying Human Errors Nov 2001 Street Hotel, London IBC Global Conferences +44 (0) 1932 893 893
cust.serv@informa.com
http://www.ibcglobal.com/is1167
Confined Explosions and 6 University of Leeds, Alison Whiteley, +44 (0) 113 233 2494
Detonations Nov 2001 Leeds University of Leeds +44 (0) 113 233 2511
cpd.speme@leeds.ac.uk
http://www.leeds.ac.uk/fuel/shortc/sc.htm
Vapour Cloud Explosions 7 University of Leeds, Alison Whiteley, +44 (0) 113 233 2494
Nov 2001 Leeds University of Leeds +44 (0) 113 233 2511
Blast Prediction and Blast 8 University of Leeds, Alison Whiteley, +44 (0) 113 233 2494
Response Nov 2001 Leeds University of Leeds +44 (0) 113 233 2511
Blast Prediction and Blast 9 University of Leeds, Alison Whiteley, +44 (0) 113 233 2494
Response (CFD) Nov 2001 Leeds University of Leeds +44 (0) 113 233 2511
Major Hazards Offshore 2001 27 - 28 The Paragon Hotel, Emma Gardner, +44 (0) 1372 367 064
Nov 2001 London ERA Technology +44 (0) 1372 377 927
emma.gardner@era.co.uk
http://www.era.co.uk
OTC 2001 6-9 Houston, TX http://www.spe.org

May 2002 USA
OMAE 2002 23 - 28 Oslo, http://www.omae.org/omae2002/omae2002.htm

June 2002 Norway
Seminars
Title Dates Venue Contact Tel/Fax Number
Process Integrity and its Role in Dec 2001 London Martin Homer, SCI +44 (0) 1344 623345
Mitigating Fire and Blast (Location to be fabig@steel-sci.com +44 (0) 1344 622944
confirmed) http://www.fabig.com
Process Integrity and its Role in Dec 2001 Aberdeen Martin Homer, SCI +44 (0) 1344 623345
Mitigating Fire and Blast (Location to be fabig@steel-sci.com +44 (0) 1344 622944
confirmed) http://www.fabig.com

Feedback
R421 FABIG CONTACT INFORMATION AND FEEDBACK FORM
Please use this form to update SCI on your mailing details (e.g. change of address
or telephone number), change of personnel (e.g. someone leaving your company
or a new recipient) or to provide feedback on FABIG deliverables.
CONTACT INFORMATION
Title: Initials: Forename: Surname:
Job Title:
Direct Tel: Direct Fax:
E-mail:
Company:
Address:
Town
County: Postcode:
Country:
Switchboard Tel:
Switchboard Fax:
Web Site Address:
 Please inform me of forthcoming FABIG Technical Meetings

 Please delete me from your mailing list
 Please amend my details
FEEDBACK ON FABIG DELIVERABLES
Comments/Further details:
Please address any comments, queries or updated contact details to:

The FABIG Administrator
Silwood Park, Ascot, Berkshire, SL5 7QN, UK
Tel: +44 (0) 1344 623345 Fax: +44 (0) 1344 622944
Alternatively you can E-mail us at: fabig@steel-sci.com
Or visit our Web Site at: http://www.fabig.com

News 30

Uploaded by

Copyright:

Available Formats

News 30

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

News 30

Uploaded by

Copyright:

Available Formats

FABIG NEWSLETTER

http://www.fabig.com Issue No.30 October 2001

CONTENTS PAGE PAGE

R413 FABIG MEMBERSHIP

Oil Companies University

Page 2 Issue 30 - October 2001

R414 FABIG STEERING COMMITTEE MEETING

Figure 414.1 Variation of FABIG deliverables with time

Issue 30 - October 2001 Page 3

R415 FABIG WEB STATISTICS

% of Area Related to 766 France

Page 4 Issue 30 - October 2001

R416 A WORKBOOK APPROACH TO ESTIMATING THE

Issue 30 - October 2001 Page 5

Similarly, a normalised or non-dimensional volume of the

where Vf is the volume of the flammable cloud, Vm is the module

Determining the Ventilation Velocity

The specification for the ‘geometry and orientation’ of the module   . 

Page 6 Issue 30 - October 2001

Discussion Further information

Further, as more details of the module layout are produced it is

Issue 30 - October 2001 Page 7

R417 RISK-BASED DESIGN OF PASSIVE FIRE

Page 8 Issue 30 - October 2001

Issue 30 - October 2001 Page 9

Pool fire (crude)

Pool fire (crude)

Jet fire 250 kW/m 2 200 kW/m 2

Table 417.3 NORSOK recommended fire loads

Page 10 Issue 30 - October 2001

Damage State Description of * Mean material ** Mean injuries ** Mean loss of

No or minimal non- Minor Potential

Issue 30 - October 2001 Page 11

Tel: +44 (0) 1372 865 226

Page 12 Issue 30 - October 2001

R418 SAFETY MANAGEMENT OFFSHORE: A

Issue 30 - October 2001 Page 13

Page 14 Issue 30 - October 2001

Issue 30 - October 2001 Page 15

Figure 418.2 Recursive structure of an oil and gas industry

Page 16 Issue 30 - October 2001

External Commitment Internal commitment

Employees participate in defining the behaviour

Issue 30 - October 2001 Page 17

The Third Principle of organisation

Page 18 Issue 30 - October 2001

Example, in the case of means of escape for offshore employees,

The Fourth Principle of Organisation

Dr Alan N. Beard or Jaime Santos Reyes

Tel: +44 (0) 131 449 5111

Issue 30 - October 2001 Page 19

R419 NEW GUIDELINES ON PRESSURE RELIEF

Figure 419.1 Comparison of various methodologies for

Page 20 Issue 30 - October 2001

Figure 419.2 shows the 3-inch diameter phase mixing section of

Some 50 flow experiments were conducted each covering a range

Figure 419.4 Discharge coefficients plotted as a function

It was reassuring to note that the experimental results indicated

Issue 30 - October 2001 Page 21

Damage State Description of * Mean material Mean injuries Mean loss of