Offshore Safety Studies Technical Safety Note / November 2008

Insights into Offshore Emergency System Survivability Assessment (ESSA)

A. Preface:

As offshore HSE consultants, the authors has come across various assessment methodologies ofoffshore emergency systems and has found that the assessment has some typical flaws thusmaking the assessment process unclear resulting in incomplete assessment. In this short note,an attempt is made to bring about clarity by suggesting some improvements to enhance theemergency systems assessment in the ESSA study.

B. Background of ESSA:

In 1988, the Piper Alpha disaster that occurred in North Sea resulted in 167 fatalities and a totalasset loss of £1.7 billion (US$ 3.4 billion) and finally caused Occidental Petroleum to go out ofbusiness in UK. A public inquiry by Lord Cullen was commissioned in November 1988 toestablish the circumstances that led to the accident on Piper Alpha and its causes. In November1990, the report [1] was concluded and the report revealed that several emergency systems onthe Piper Alpha did not survive the fire/ explosion and hence could perform its intended designobjectives. Among the recommendations that Lord Cullen proposed, was a thorough

‘review of the ability of emergency systems to survive severe accident be performed’

[1 – R 65] for allinstallations.This recommendation has been transformed into a study known as the ‘Emergency SystemsSurvivability Assessment (ESSA)’ and included as one of the Formal Safety Assessment (FSA)studies as required by UK Safety Case Regulations, 2005.

C. Interesting findings on Piper Alpha:

Lord Cullen investigation report summarized and highlighted issues related to emergencysystems on Piper Alpha. The key flaws associated with emergency systems that were identified inthe Piper alpha disaster are listed below:

•

The control room and radio room was both outside the TSR. Hence when the explosionoccurred, both the control and radio room were damaged. There were no facilities in the ERQto assess or exercise control over it or to communicate with external parties. They were alsounable to obtain information on status of Fire and Gas (F&G) Detection, EmergencyShutdown (ESD) or deluge systems [1-19.176];

Offshore Safety Studies Technical Safety Note / November 2008

•

Both the main and emergency power supplies as well as part of the Uninterrupted PowerSupply (UPS) were knocked out after the explosion and hence there was no electrical powersupply on Piper Alpha platform;

•

Battery power supplies dedicated to individual equipment mainly performed well;

•

It was suspected that the main means of communication to the personnel on the platform, thePA/GA, (Public Address /General Alarm) was not functioning/ disabled as it was not used;

•

The first explosion occurred before signals from the gas detection systems led to either amanual or automatic ESD [1-19.38];

•

ESD of the gas pipelines were not part of the platform ESD system and had to be affectedmanually for each pipeline separately from the control room [1-19.38];

•

Some of the ESD valves appear not to have closed fully [1-19.38];

•

The Piper Alpha had only firewalls retrofitted and not blast walls. [1-19.55] even after theinstallation of gas compression module;

•

Lord Cullen report inferred that emergency power supply, ESD system and communicationsystem should possess a high degree the ability to survive severe accident conditions [1-19.189];

•

The vulnerability of the emergency systems to severe accident conditions need to bereviewed and steps need to be taken to enhance their ability to survive such conditions [1-19.190]:

Vulnerability of the ESD and SSIV (Sub Surface Isolation Valve) systems to bereviewed [1-R48];

The ability of fire water deluge systems to survive severe accident conditions [1-R51].

•

Design to be fail safe i.e. they can still convey their essential message even on loss of power[1-19.193]; and

•

The initial explosion on the Piper knocked out the control room and disabled power supplies,communications and firewater deluge systems and caused severe vibration which may haveaffected the ESD system [1-19.44].Note:[1-19.38]: Reference to specific findings in Lord Cullen Report

Offshore Safety Studies Technical Safety Note / November 2008

E. Typical Offshore Emergency Systems:

Typically, the following systems are considered as emergency systems in offshore installations:

No. Systems

1. Fire and Gas (F&G) Detection and Alarm System2. Emergency Shut Down (ESD) System3. Blow Down & Relief System4. Active Fire Protection System5. Passive Fire Protection6. Heating, Ventilation and Air Conditioning (HVAC) System7. Emergency Communications System8. Emergency Power System (Emergency Power Generator & UPS)9. Emergency Lighting System

F. Issues to Consider:

1. Identification of emergency systems:Based on the definition of Emergency Systems, these systems mitigate / recover effects of majoraccident events such fire / explosion, ship collision, hydrocarbon release, dropped objects, etc.From this perspective, the safety systems / barriers that are on the right side of the bow tie areemergency systems. Once the bow ties are constructed for MAEs (major Accident Event) as partof the HAZID (Hazard Identification), the mitigation and recovery measures should be listed asemergency systems and assessed for survivability.

Bow Tie Diagram

PreventionMitigation &RecoveryMAE